Changes

Every recent change to an AWS Managed IAM Policy, newest first, with the actions added and removed named in full. AWS reissues a policy version for a Resource or Condition edit more often than for a permission change, so a change with no action delta is normal and says so rather than implying nothing happened.

1,000 changes between Mar 12, 2026 and Aug 7, 2026. 139 named something never seen anywhere in the archive before, and 52 added a permissions management action. Older changes are in each policy's own version history, back to 2019.

These land in real time in the IAM policies RSS feed and by email via digests.

25 changes - loading the full timeline

AWSManagedBudgetsSpendLimitManagementAccessv2updated

scope changed, no action added or removed

today

AmazonSageMakerJobRuntimeAccessv2updated

2 actions added

today

CloudWatchAutomaticDashboardsAccessv5updated

2 actions added

today

AmazonODBReadOnlyAccessv1new policy

32 actions added

today

AmazonODBNetworkAdminv1new policy

24 actions added

today

4 permissions management, incl. ec2:CreateOdbNetworkPeering: ec2:CreateOdbNetworkPeering, ec2:DeleteOdbNetworkPeering, ec2:ModifyOdbNetworkPeering, iam:CreateServiceLinkedRole

AmazonODBExadataInfrastructureAdminv1new policy

21 actions added

today

Permissions management: iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole

AmazonODBAutonomousVmClusterAdminv1new policy

21 actions added

today

AWSManagedSettingsAdminAccessv3updated

scope changed, no action added or removed

today

AgentRegistryReadOnlyAccessv1new policy

9 actions added

yesterday

New AWS service agent-registry

AgentRegistryFullAccessv1new policy

11 actions added

yesterday

3 never-before-seen actions: bedrock-agentcore:CreateWorkloadIdentity, bedrock-agentcore:DeleteWorkloadIdentity, bedrock-agentcore:GetResourceOauth2Token

2 permissions management, incl. iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole, iam:PassRole

AWSBackupAccessPointOperatorAccessv1new policy

11 actions added

yesterday

6 never-before-seen actions: backup:ListBackupAccessPoints, backup:ListBackupAccessPointsByRecoveryPoint, backup:ListBackupAccessPointsByResource, s3:CreateAccessPoint, s3:DeleteAccessPoint, s3:PutAccessPointPolicy

Permissions management: s3:PutAccessPointPolicy: s3:PutAccessPointPolicy

AWSTransformServerMigrationAgentPolicyv1new policy

125 actions added

yesterday

30 never-before-seen actions: mgn:AssociateApplications, mgn:AssociateSourceServers, mgn:CreateApplication, mgn:CreateWave, mgn:DeleteApplication, mgn:DeleteWave, mgn:DisassociateApplications, mgn:DisassociateSourceServers, mgn:GetAccountSettings, mgn:ListConnectors, mgn:ListImportFileEnrichments, mgn:PauseReplication, mgn:PutSourceServerAction, mgn:PutTemplateAction, mgn:RemoveSourceServerAction, mgn:RemoveTemplateAction, mgn:ResumeReplication, mgn:StartExport, mgn:StartImport, mgn:StartImportFileEnrichment, mgn:StartReplication, mgn:StopReplication, mgn:TerminateTargetInstances, mgn:UpdateAccountSettings, mgn:UpdateApplication, mgn:UpdateLaunchConfiguration, mgn:UpdateLaunchConfigurationTemplate, mgn:UpdateReplicationConfigurationTemplate, mgn:UpdateSourceServer, mgn:UpdateWave

Permissions management: iam:PassRole: iam:PassRole

AWSTransformNetworkMigrationAgentPolicyv1new policy

221 actions added

yesterday

25 never-before-seen actions: mgn:CreateNetworkMigrationDefinition, mgn:DeleteNetworkMigrationDefinition, mgn:GetNetworkMigrationDefinition, mgn:ListNetworkMigrationAnalyses, mgn:ListNetworkMigrationAnalysisResults, mgn:ListNetworkMigrationCodeGenerationSegments, mgn:ListNetworkMigrationCodeGenerations, mgn:ListNetworkMigrationDefinitions, mgn:ListNetworkMigrationDeployedStacks, mgn:ListNetworkMigrationDeployedStacksDeletions, mgn:ListNetworkMigrationDeployments, mgn:ListNetworkMigrationExecutions, mgn:ListNetworkMigrationMapperSegmentConstructs, mgn:ListNetworkMigrationMapperSegments, mgn:ListNetworkMigrationMappingUpdates, mgn:ListNetworkMigrationMappings, mgn:StartNetworkMigrationAnalysis, mgn:StartNetworkMigrationCodeGeneration, mgn:StartNetworkMigrationDeployedStacksDeletion, mgn:StartNetworkMigrationDeployment, mgn:StartNetworkMigrationMapping, mgn:StartNetworkMigrationMappingUpdate, mgn:UpdateNetworkMigrationDefinition, mgn:UpdateNetworkMigrationMapperSegment, mgn:UpdateNetworkMigrationMapperSegmentConstruct

14 permissions management, incl. iam:AttachRolePolicy: iam:AttachRolePolicy, iam:CreateRole, iam:CreateServiceLinkedRole, iam:DeleteRole, iam:DeleteRolePolicy, iam:DetachRolePolicy, iam:PassRole, ram:AssociateResourceShare, ram:CreateResourceShare, ram:DeleteResourceShare, ram:DisassociateResourceShare, ram:UpdateResourceShare, ssm:DeleteResourcePolicy, ssm:PutResourcePolicy

AWSTransformLandingZoneAgentPolicyv1new policy

61 actions added

yesterday

5 never-before-seen actions: controltower:EnableBaseline, controltower:EnableControl, controltower:GetBaseline, controltower:TagResource, organizations:CreateOrganizationalUnit

AWSAgentRegistryServiceRolePolicyv1new policy

1 action added

yesterday

BedrockAgentCoreRuntimeInstancesOperatorRolePolicyv2updated

scope changed, no action added or removed

yesterday

AWSIAMRoleManagerServiceRolePolicyv2updated

1 action added

2 days ago

Permissions management: iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole

BatchServiceRolePolicyv8updated

7 actions added

2 days ago

4 never-before-seen actions: ecs:CreateCapacityProvider, ecs:DeleteCapacityProvider, ecs:PutClusterCapacityProviders, ecs:UpdateCapacityProvider

AIDevOpsConstellationAccessPolicyv1new policy

11 actions added

2 days ago

BedrockAgentCoreRuntimeInstancesInstanceRolePolicyv1new policy

1 action added

2 days ago

1 never-before-seen action: bedrock-agentcore:PutSystemLogEvents

BedrockAgentCoreRuntimeInstancesOperatorRolePolicyv1new policy

34 actions added

2 days ago

1 never-before-seen action: autoscaling:LaunchInstances

2 permissions management, incl. iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole, iam:PassRole

AWSBedrockAgentCoreRuntimeInstancesServiceRolePolicyv1new policy

16 actions added

2 days ago

AmazonHealthLakeReadOnlyAccessv2updated

6 actions added

3 days ago

6 never-before-seen actions: healthlake:DescribeDataTransformationJob, healthlake:GetDataTransformationProfile, healthlake:ListDataTransformationJobs, healthlake:ListDataTransformationProfileVersions, healthlake:ListDataTransformationProfiles, healthlake:ValidateSource

EC2FastLaunchFullAccessv5updated

1 action added

3 days ago

AWSServiceCatalogAdminFullAccessv9updated

1 action added

3 days ago