cloudformation:DescribeStacks
Literal appearances in AWS managed IAM policies. Statements that use wildcards (for example s3:*) are not counted here. This is not an IAM authorization simulation.
Policies (any)
79
Allow (Action)
79
Deny (Action)
0
NotAction
2
Index generated 4/7/2026, 3:29:24 AM. 559 policies include at least one wildcard action string (any service).
Action reference
SAR-style (unofficial)Service: AWS CloudFormation & Cloud Control API
Access level
ListDescription
Grants permission to return the description for the specified stack, and to all stacks when used in combination with the ListStacks action
Resource types
- stack
Dependent actions
- cloudformation:ListStacks
Allow (Action)
- AWSApplicationMigrationNetworkMigrationMultiAccount
- AWSBackupServiceRolePolicyForBackup
- AWSCloud9ServiceRolePolicy
- AWSCodePipeline_FullAccess
- AWSConfigServiceRolePolicy
- AWSControlTowerServiceRolePolicy
- AWSDeepRacerServiceRolePolicy
- AWSElasticBeanstalkMaintenance
- AWSElasticBeanstalkReadOnly
- AWSElasticBeanstalkServiceRolePolicy
- AWSElasticDisasterRecoveryConsoleFullAccess
- AWSElasticDisasterRecoveryConsoleFullAccess_v2
- AWSGlueConsoleFullAccess
- AWSGlueConsoleSageMakerNotebookFullAccess
- AWSLambdaFullAccess
- AWSLambdaReadOnlyAccess
- AWSLambda_FullAccess
- AWSLambda_ReadOnlyAccess
- AWSLicenseManagerMasterAccountRolePolicy
- AWSManagedServicesDeploymentToolkitPolicy
- AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicy
- AWSMarketplaceFullAccess
- AWSOpsWorksCMServiceRole
- AWSProtonCodeBuildProvisioningServiceRolePolicy
- AWSQuickSetupDeploymentRolePolicy
- AWSQuickSetupDevOpsGuruPermissionsBoundary
- AWSQuickSetupJITNADeploymentRolePolicy
- AWSQuickSetupPatchPolicyDeploymentRolePolicy
- AWSQuickSetupSSMDeploymentRolePolicy
- AWSReachabilityAnalyzerServiceRolePolicy
- AWSRefactoringToolkitFullAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResourceGroupsReadOnlyAccess
- AWSServiceCatalogAdminFullAccess
- AWSServiceCatalogAdminReadOnlyAccess
- AWSServiceCatalogAppRegistryFullAccess
- AWSServiceCatalogAppRegistryServiceRolePolicy
- AWSServiceCatalogEndUserFullAccess
- AWSServiceCatalogEndUserReadOnlyAccess
- AWSServiceRoleForSMS
- AWSThinkboxAWSPortalAdminPolicy
- AWSThinkboxDeadlineResourceTrackerAdminPolicy
- AWSTransformApplicationDeploymentPolicy
- AWSTransformApplicationECSDeploymentPolicy
- AWSTrustedAdvisorServiceRolePolicy
- AWSWellArchitectedDiscoveryServiceRolePolicy
- AWS_ConfigRole
- AdministratorAccess-Amplify
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDataZoneRedshiftGlueProvisioningPolicy
- AmazonDevOpsGuruConsoleFullAccess
- AmazonDevOpsGuruFullAccess
- AmazonDevOpsGuruReadOnlyAccess
- AmazonDevOpsGuruServiceRolePolicy
- AmazonEC2RolePolicyForLaunchWizard
- AmazonECSInfrastructureRolePolicyForManagedInstances
- AmazonSSMAutomationRole
- AmazonSSMServiceRolePolicy
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy
- AmplifyBackendDeployFullAccess
- ConfigConformsServiceRolePolicy
- EC2FastLaunchFullAccess
- EC2FastLaunchServiceRolePolicy
- ResourceGroupsServiceRolePolicy
- ResourceGroupsandTagEditorFullAccess
- ResourceGroupsandTagEditorReadOnlyAccess
- SSMQuickSetupRolePolicy
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SecretsManagerReadWrite
- ServerMigrationServiceConsoleFullAccess
- ServerMigrationServiceLaunchRole
- ServerMigrationServiceRole
- ServerMigration_ServiceRole
- ServiceCatalogAdminReadOnlyAccess
- ViewOnlyAccess
Deny (Action)
Thanks to Ian McKay for iam-dataset (MIT), structured data derived from the AWS Service Authorization Reference. Not maintained by AWS and not guaranteed current. IAMTrail's managed policy archive is separate.
Definitions bundle generated 4/7/2026, 3:29:24 AM