Changes

Every recent change to an AWS Managed IAM Policy, newest first, with the actions added and removed named in full. AWS reissues a policy version for a Resource or Condition edit more often than for a permission change, so a change with no action delta is normal and says so rather than implying nothing happened.

1,000 changes between Mar 12, 2026 and Nov 2, 2026. 225 named something never seen anywhere in the archive before, and 100 added a permissions management action. Older changes are in each policy's own version history, back to 2019.

These land in real time in the IAM policies RSS feed and by email via digests.

25 changes - loading the full timeline
AWSMarketplaceSellerFullAccessv35updated

scope changed, no action added or removed

3f85a07
AWSRevenueAttributionManagementv2updated

4 actions added

03d55c1
Route53PrivateHealthChecksServiceRolePolicyv1new policy

7 actions added

da9f168
AWSResourceExplorerServiceRolePolicyv59updated

11 actions added

8c4f97a
AssuranceServiceRolePolicyv4updated

scope changed, no action added or removed

e5c2fe1
ReadOnlyAccessv191updated

49 actions added

4f7ba36
New AWS service startups
3 never-before-seen actions: bedrock-agentcore:GetPaymentInstrumentBalance, bedrock-mantle:CountTokens, bedrock:RenderPrompt
ViewOnlyAccessv48updated

87 actions added

884bc20
7 never-before-seen actions: bedrock-agentcore:GetConsentPortal, bedrock-agentcore:GetGatewayRateLimit, bedrock-mantle:GetAccountDataRetention, bedrock:GetModelEvaluationJob, bedrock:ListAdvancedPromptOptimizationJobs, bedrock:ListDataAutomationLibraryEntities, bedrock:ListDataAutomationLibraryIngestionJobs
WellArchitectedConsoleReadOnlyAccessv4updated

1 action added

6adae12
WellArchitectedConsoleFullAccessv3updated

1 action added

aab2847
SageMakerStudioUserIAMPermissiveExecutionPolicyv27updated

5 actions added

86a0379
SageMakerStudioUserIAMDefaultExecutionPolicyv32updated

38 actions added

1eb9f76
2 permissions management, incl. logs:PutResourcePolicy: logs:PutResourcePolicy, s3:CreateAccessGrantsInstance
SageMakerStudioProjectUserRolePolicyv76updated

4 actions added

b3361e6
SageMakerStudioProjectRoleMachineLearningPolicyv47updated

37 actions added

d7209a4
3 never-before-seen actions: bedrock-agentcore:ConnectBrowserAutomationStream, bedrock-agentcore:CreateHarnessEndpoint, bedrock-agentcore:InvokeCodeInterpreter
Permissions management: logs:PutResourcePolicy: logs:PutResourcePolicy
SageMakerStudioAdminIAMPermissiveExecutionPolicyv25updated

4 actions added

25d4a20
Permissions management: iam:UpdateAssumeRolePolicy: iam:UpdateAssumeRolePolicy
SageMakerStudioAdminIAMDefaultExecutionPolicyv28updated

14 actions added

f589b23
3 permissions management, incl. iam:UpdateAssumeRolePolicy: iam:UpdateAssumeRolePolicy, s3:CreateAccessGrantsInstance, s3tables:PutTableBucketPolicy
ECRReplicationServiceRolePolicyv2updated

1 action added

e33eb68
1 never-before-seen action: ecr:ReplicateImageDelete
FinOpsAgentIdentityReaderPolicyv1new policy

3 actions added

d8f2d10
AWSAccountSettingsManagementRolev12updated

6 actions added

13bfd44
5 never-before-seen actions: user-subscriptions:CancelPurchaseSession, user-subscriptions:ConfirmPurchaseSession, user-subscriptions:CreatePurchaseSession, user-subscriptions:GetPurchaseSession, user-subscriptions:ListEntitlements
AIDevOpsOperatorAppAccessPolicyv11updated

1 action added

67cac8b
1 never-before-seen action: aidevops:SearchAssets
CloudWatchNetworkMonitorServiceRolePolicyv4updated

2 actions added

02538ef
AWSTransformNetworkMigrationAgentPolicyv3updated

13 actions added

a760224
6 never-before-seen actions: wellarchitected:CreateAgentContext, wellarchitected:CreateAgentGoal, wellarchitected:StartAgentRecommendationGeneration, wellarchitected:UpdateAgentContext, wellarchitected:UpdateAgentGoal, wellarchitected:UpdateAgentProfile
TagsHealthServiceRolePolicyv1new policy

1 action added

002866e
AWS_ConfigRolev74updated

66 actions added

fc8fcaa
2 permissions management, incl. quicksight:DescribeKnowledgeBasePermissions: quicksight:DescribeKnowledgeBasePermissions, quicksight:DescribeSpacePermissions
AWSConfigServiceRolePolicyv97updated

66 actions added

c09bb35
5 never-before-seen actions: neptune-graph:GetExportTask, neptune-graph:ListExportTasks, quicksight:DescribeAgent, quicksight:DescribeAgentPermissions, quicksight:DescribeBrand
2 permissions management, incl. quicksight:DescribeKnowledgeBasePermissions: quicksight:DescribeKnowledgeBasePermissions, quicksight:DescribeSpacePermissions
AmazonConnectSynchronizationServiceRolePolicyv7updated

74 actions added

712432e
15 never-before-seen actions: app-integrations:CreateApplication, app-integrations:DeleteApplication, app-integrations:ListApplicationAssociations, app-integrations:TagResource, app-integrations:UntagResource, app-integrations:UpdateApplication, wisdom:CreateAssistantAssociation, wisdom:CreateContentAssociation, wisdom:DeleteAssistantAssociation, wisdom:DeleteContentAssociation, wisdom:GetContentAssociation, wisdom:GetContentSummary, wisdom:ListModels, wisdom:RemoveKnowledgeBaseTemplateUri, wisdom:UpdateKnowledgeBaseTemplateUri
Permissions management: kms:CreateGrant: kms:CreateGrant