IAMTrail

Unofficial

AWS silently updates Managed IAM policies all the time.
We catch every single change.

Full version history and diffs for 1651 AWS Managed IAM Policies, archived since 2019. | A service by zoph.io

Total Policies

1,651

Active AWS Managed Policies

Brand New (v1)

48

New AWS services/features

Deprecated

76

Removed from AWS

Most Active

111

ReadOnlyAccess...

Latest Changes

What AWS changed most recently, and exactly which actions moved

AWSSecurityAgentWebAppPolicyv7updated

4 actions added

today

df95f77
4 never-before-seen actions: securityagent:BatchGetValidationRuns, securityagent:ListDiscoveredDomains, securityagent:StartValidationRun, securityagent:UpdateDiscoveredDomains
ROSAKubeControllerPolicyv8updated

1 action added

yesterday

aaeca7b
ReadOnlyAccessv189updated

7 actions added

3 days ago

9a391cd
4 never-before-seen actions: bedrock-agentcore:GetCapacityProvider, bedrock-agentcore:ListAgentRuntimeVersionsByCapacityProvider, bedrock-agentcore:ListCapacityProviders, directconnect:ListVirtualInterfaceRoutes
AWSWellArchitectedAgentOrganizationsServiceRolePolicyv1new policy

11 actions added

3 days ago

4aeaa99
AmazonECSInfrastructureRolePolicyForManagedInstancesv12updated

scope changed, no action added or removed

3 days ago

4197142
AWSApplicationMigrationNetworkMigrationMultiAccountv7updated

1 action added

3 days ago

3c3f758
Permissions management: iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole
View all 1,000 recent changes

Brand New Policies (v1)

Spot upcoming AWS services early - 48 new policies detected

AWSWellArchitectedAgentOrganizationsServiceRolePolicy

v1 / 9/15/2026

AmazonSageMakerHyperPodInferenceGatewayAccess

v1 / 9/9/2026

AmazonODBAutonomousDatabaseAdmin

v1 / 9/4/2026

AmazonODBExadataVmClusterAdmin

v1 / 9/4/2026

AmazonODBExascaleStorageVaultAdmin

v1 / 9/4/2026

AmazonODBExascaleVmClusterAdmin

v1 / 9/4/2026

View all 48 new policies
Free - No account needed

Get notified when policies change

Daily or weekly email digests with inline diffs. Pick specific policies or track them all.

Subscribe

Endpoint Signals

46 regions, 307 services tracked from botocore

Expansioncassandraap-east-2ap-northeast-3ap-south-2+8aws
Expansiondaxap-east-2ap-southeast-3ap-southeast-4+7aws
Expansiondaxaf-south-1ap-east-1ap-northeast-2+3aws
View all endpoint changes

Policy Creation by Year

Number of AWS managed policies first tracked each year

176
20
143
21
119
22
150
23
154
24
135
25
139
26
20201,016 total policies2026

Largest Policy

4533 actions

AWSSupportServiceRolePoli...

AWS Services Tracked

449

IAM service namespaces over time

IAM Actions (literals)

15,419

Distinct action strings in managed policies (no wildcards)

Year-over-Year Velocity

Total policy commits per year - new launches vs. updates

629 total (176 new, 453 updates)
20
488 total (143 new, 345 updates)
21
552 total (119 new, 433 updates)
22
669 total (150 new, 519 updates)
23
606 total (154 new, 452 updates)
24
753 total (135 new, 618 updates)
25
651 total (139 new, 512 updates)
26
UpdatesNew launches4,348 total commits tracked

Excludes 4 bulk-reformat day(s) where detection logic changes caused false-positive diffs.

Policy Lifecycle

Current version distribution across all policies

v1
653
v2
258
v3
184
v4
117
v5
68
v6-10
238
v11-20
92
v21+
41

40% of policies (653) are still at v1 - created once and never updated.

Most revised

ReadOnlyAccessv189AWSConfigServiceRolePolicyv95SecurityAuditv93SageMakerStudioProjectProvisioningRolePolicyv82SageMakerStudioProjectUserRolePolicyv75

Monthly Seasonality

Policy change volume by calendar month across all years

257
Jan
277
Feb
326
Mar
368
Apr
326
May
392
Jun
377
Jul
399
Aug
326
Sep
316
Oct
634
Nov
350
Dec
re:Invent season (Nov-Dec) - 36% above average

re:Invent Pulse

Policy changes during the Nov 15 - Dec 15 window each year

100 changes, 50 new
20
107 changes, 34 new
21
87 changes, 29 new
22
129 changes, 25 new
23
138 changes, 59 new
24
145 changes, 33 new
25
UpdatesNew launches

Recently Updated

AWSSecurityAgentWebAppPolicy

Today/ 5 versions

ROSAKubeControllerPolicy

Yesterday/ 6 versions

AWSWellArchitectedAgentOrganizationsServiceRolePolicy

3 days ago/ 1 version

ReadOnlyAccess

3 days ago/ 111 versions

AmazonECSInfrastructureRolePolicyForManagedInstances

3 days ago/ 6 versions

AWSApplicationMigrationNetworkMigrationMultiAccount

3 days ago/ 5 versions

AWSResourceExplorerServiceRolePolicy

3 days ago/ 35 versions

SageMakerStudioProjectRoleMachineLearningPolicy

4 days ago/ 21 versions

AmazonElasticMapReduceFullAccess

1 week ago/ 8 versions

AWSMarketplaceFullAccess

1 week ago/ 9 versions

Most Volatile (Trailing 12 Months)

SageMakerStudioProjectUserRolePolicy19 changesReadOnlyAccess17 changesSageMakerStudioProjectProvisioningRolePolicy16 changesAWSResourceExplorerServiceRolePolicy15 changesSageMakerStudioUserIAMDefaultExecutionPolicy13 changesAWSConfigServiceRolePolicy12 changesSageMakerStudioUserIAMPermissiveExecutionPolicy12 changesSecurityAudit12 changesAWS_ConfigRole11 changesAWSMarketplaceSellerFullAccess11 changes

Newest Policies

AWSSecurityAgentWebAppPolicy

Today

ROSAKubeControllerPolicy

Yesterday

ReadOnlyAccess

3 days ago

AWSWellArchitectedAgentOrganizationsServiceRolePolicy

3 days ago

AmazonECSInfrastructureRolePolicyForManagedInstances

3 days ago

AWSApplicationMigrationNetworkMigrationMultiAccount

3 days ago

AWSResourceExplorerServiceRolePolicy

3 days ago

SageMakerStudioProjectRoleMachineLearningPolicy

4 days ago

AmazonElasticMapReduceFullAccess

1 week ago

AWSMarketplaceFullAccess

1 week ago

Oldest Policies

AWSOpsWorksRegisterCLI

7y 7m ago

AmazonMachineLearningRoleforRedshiftDataSource

7y 7m ago

TagGovernancePolicy

7y 7m ago

AWSLambdaReplicatorInternal

7y 3m ago

AmazonEverestServicePolicy

7y 1m ago

AWSB9InternalServicePolicy

7 years ago

AWSBackupAdminPolicy

7 years ago

AWSBackupOperatorPolicy

7 years ago

AWSCloudTrailFullAccess

7 years ago

AWSDataPipelineRole

7 years ago