AssuranceServiceRolePolicy
Last Modified
Aug 26, 2026
August 26, 2026 at 10:02 PM UTC
Version
v1
Total Versions
1
Created
Aug 26, 2026
Actions
388
Risk
no risk signalRead from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
IAM Access Analyzer (24)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 12794 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:CreateComment specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:DownloadEvidence specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetAssessment specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetComment specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetControl specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetEnvironment specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetEvidence specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetProject specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:GetTask specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListAssessmentAnnotations specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListAssessments specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListComments specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListControls specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListDiscoveredResources specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListEnabledFrameworks specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListEvidence specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListEvidenceAnnotations specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListProjects specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:ListTasks specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:StartResourceDiscovery specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:UpdateTask specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE_IN_ACTION
The service assurance:UploadEvidence specified in the action does not exist. AWS docs
- Error / INVALID_SERVICE
The service assurance does not exist. Use a valid service name. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AssuranceComplianceRead",
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAccountLimits",
"autoscaling:DescribeAdjustmentTypes",
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeAutoScalingInstances",
"autoscaling:DescribeAutoScalingNotificationTypes",
"autoscaling:DescribeInstanceRefreshes",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeLifecycleHookTypes",
"autoscaling:DescribeLifecycleHooks",
"autoscaling:DescribeLoadBalancerTargetGroups",
"autoscaling:DescribeLoadBalancers",
"autoscaling:DescribeMetricCollectionTypes",
"autoscaling:DescribeNotificationConfigurations",
"autoscaling:DescribePolicies",
"autoscaling:DescribeScalingActivities",
"autoscaling:DescribeScalingProcessTypes",
"autoscaling:DescribeScheduledActions",
"autoscaling:DescribeTags",
"autoscaling:DescribeTerminationPolicyTypes",
"autoscaling:DescribeTrafficSources",
"autoscaling:DescribeWarmPool",
"bedrock-agentcore:GetAgentCard",
"bedrock-agentcore:GetAgentRuntime",
"bedrock-agentcore:GetAgentRuntimeEndpoint",
"bedrock-agentcore:GetEvaluator",
"bedrock-agentcore:GetGateway",
"bedrock-agentcore:GetGatewayTarget",
"bedrock-agentcore:GetMemory",
"bedrock-agentcore:GetOnlineEvaluationConfig",
"bedrock-agentcore:GetPolicy",
"bedrock-agentcore:GetPolicyEngine",
"bedrock-agentcore:GetResourcePolicy",
"bedrock-agentcore:GetTokenVault",
"bedrock-agentcore:GetWorkloadIdentity",
"bedrock-agentcore:ListActors",
"bedrock-agentcore:ListAgentRuntimeEndpoints",
"bedrock-agentcore:ListAgentRuntimeVersions",
"bedrock-agentcore:ListAgentRuntimes",
"bedrock-agentcore:ListApiKeyCredentialProviders",
"bedrock-agentcore:ListBrowserProfiles",
"bedrock-agentcore:ListBrowserSessions",
"bedrock-agentcore:ListBrowsers",
"bedrock-agentcore:ListCodeInterpreterSessions",
"bedrock-agentcore:ListCodeInterpreters",
"bedrock-agentcore:ListEvaluators",
"bedrock-agentcore:ListEvents",
"bedrock-agentcore:ListGatewayTargets",
"bedrock-agentcore:ListGateways",
"bedrock-agentcore:ListMemories",
"bedrock-agentcore:ListMemoryExtractionJobs",
"bedrock-agentcore:ListMemoryRecords",
"bedrock-agentcore:ListOauth2CredentialProviders",
"bedrock-agentcore:ListOnlineEvaluationConfigs",
"bedrock-agentcore:ListPolicies",
"bedrock-agentcore:ListPolicyEngines",
"bedrock-agentcore:ListSessions",
"bedrock-agentcore:ListTagsForResource",
"bedrock-agentcore:ListWorkloadIdentities",
"bedrock:GetAgent",
"bedrock:GetAgentActionGroup",
"bedrock:GetAgentAlias",
"bedrock:GetAgentCollaborator",
"bedrock:GetAgentKnowledgeBase",
"bedrock:GetAgentMemory",
"bedrock:GetAgentVersion",
"bedrock:GetCustomModel",
"bedrock:GetDataSource",
"bedrock:GetFlow",
"bedrock:GetFlowAlias",
"bedrock:GetFlowExecution",
"bedrock:GetFlowVersion",
"bedrock:GetFoundationModel",
"bedrock:GetGuardrail",
"bedrock:GetIngestionJob",
"bedrock:GetInvocationStep",
"bedrock:GetKnowledgeBase",
"bedrock:GetModelInvocationLoggingConfiguration",
"bedrock:GetPrompt",
"bedrock:GetSession",
"bedrock:ListAgentActionGroups",
"bedrock:ListAgentAliases",
"bedrock:ListAgentCollaborators",
"bedrock:ListAgentKnowledgeBases",
"bedrock:ListAgentVersions",
"bedrock:ListAgents",
"bedrock:ListAutomatedReasoningPolicies",
"bedrock:ListBlueprints",
"bedrock:ListCustomModels",
"bedrock:ListDataSources",
"bedrock:ListEvaluationJobs",
"bedrock:ListFlowAliases",
"bedrock:ListFlowExecutionEvents",
"bedrock:ListFlowExecutions",
"bedrock:ListFlowVersions",
"bedrock:ListFlows",
"bedrock:ListFoundationModels",
"bedrock:ListGuardrails",
"bedrock:ListIngestionJobs",
"bedrock:ListInvocationSteps",
"bedrock:ListInvocations",
"bedrock:ListKnowledgeBases",
"bedrock:ListPrompts",
"bedrock:ListSessions",
"bedrock:ListTagsForResource",
"bedrock:ValidateFlowDefinition",
"cloudformation:GetResource",
"cloudformation:ListResources",
"cloudformation:ListStackResources",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetInsightSelectors",
"cloudtrail:GetQueryResults",
"cloudtrail:GetTrail",
"cloudtrail:GetTrailStatus",
"cloudtrail:ListChannels",
"cloudtrail:ListDashboards",
"cloudtrail:ListEventDataStores",
"cloudtrail:ListTags",
"cloudtrail:ListTrails",
"cloudtrail:LookupEvents",
"cloudtrail:StartQuery",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricData",
"cloudwatch:ListDashboards",
"cloudwatch:ListMetrics",
"config:DescribeComplianceByConfigRule",
"config:DescribeConfigRules",
"config:DescribeConfigurationAggregators",
"config:DescribeConfigurationRecorderStatus",
"config:DescribeConformancePacks",
"config:DescribeOrganizationConformancePacks",
"config:GetComplianceDetailsByConfigRule",
"config:SelectResourceConfig",
"dynamodb:DescribeBackup",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeContributorInsights",
"dynamodb:DescribeKinesisStreamingDestination",
"dynamodb:DescribeTable",
"dynamodb:DescribeTimeToLive",
"dynamodb:ListBackups",
"dynamodb:ListTables",
"dynamodb:ListTagsOfResource",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeFlowLogs",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeTransitGateways",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumes",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEncryptionControls",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:GetEbsEncryptionByDefault",
"ecr:DescribeImageScanFindings",
"ecr:DescribeImages",
"ecr:DescribeRegistry",
"ecr:DescribeRepositories",
"ecr:GetLifecyclePolicy",
"ecr:GetRegistryPolicy",
"ecr:GetRegistryScanningConfiguration",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:ListTagsForResource",
"ecs:DescribeCapacityProviders",
"ecs:DescribeClusters",
"ecs:DescribeContainerInstances",
"ecs:DescribeDaemon",
"ecs:DescribeServices",
"ecs:DescribeTaskDefinition",
"ecs:DescribeTaskSets",
"ecs:DescribeTasks",
"ecs:ListClusters",
"ecs:ListContainerInstances",
"ecs:ListDaemons",
"ecs:ListServices",
"ecs:ListTagsForResource",
"ecs:ListTaskDefinitionFamilies",
"ecs:ListTaskDefinitions",
"ecs:ListTasks",
"eks:DescribeAccessEntry",
"eks:DescribeAddon",
"eks:DescribeAddonVersions",
"eks:DescribeCapability",
"eks:DescribeCluster",
"eks:DescribeFargateProfile",
"eks:DescribeIdentityProviderConfig",
"eks:DescribeNodegroup",
"eks:DescribePodIdentityAssociation",
"eks:DescribeUpdate",
"eks:ListAccessEntries",
"eks:ListAddons",
"eks:ListAssociatedAccessPolicies",
"eks:ListCapabilities",
"eks:ListClusters",
"eks:ListFargateProfiles",
"eks:ListIdentityProviderConfigs",
"eks:ListNodegroups",
"eks:ListPodIdentityAssociations",
"eks:ListTagsForResource",
"elasticfilesystem:DescribeAccessPoints",
"elasticfilesystem:DescribeFileSystemPolicy",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeLifecycleConfiguration",
"elasticfilesystem:DescribeMountTargetSecurityGroups",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:ListTagsForResource",
"events:ListTagsForResource",
"events:DescribeEventBus",
"guardduty:DescribeOrganizationConfiguration",
"guardduty:GetAdministratorAccount",
"guardduty:GetDetector",
"guardduty:GetFindings",
"guardduty:GetMalwareProtectionPlan",
"guardduty:GetMasterAccount",
"guardduty:GetMemberDetectors",
"guardduty:GetMembers",
"guardduty:ListDetectors",
"guardduty:ListFilters",
"guardduty:ListFindings",
"guardduty:ListIPSets",
"guardduty:ListMembers",
"guardduty:ListOrganizationAdminAccounts",
"guardduty:ListTagsForResource",
"guardduty:ListThreatEntitySets",
"guardduty:ListThreatIntelSets",
"guardduty:ListTrustedEntitySets",
"iam:GenerateCredentialReport",
"iam:GetAccessKeyLastUsed",
"iam:GetAccountPasswordPolicy",
"iam:GetAccountSummary",
"iam:GetCredentialReport",
"iam:GetGroupPolicy",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAccessKeys",
"iam:ListAttachedGroupPolicies",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedUserPolicies",
"iam:ListEntitiesForPolicy",
"iam:ListGroupPolicies",
"iam:ListGroups",
"iam:ListGroupsForUser",
"iam:ListInstanceProfiles",
"iam:ListMFADevices",
"iam:ListPolicies",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListSAMLProviders",
"iam:ListServerCertificates",
"iam:ListUserPolicies",
"iam:ListUsers",
"iam:ListVirtualMFADevices",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:ListAliases",
"kms:ListKeys",
"kms:ListResourceTags",
"lambda:GetFunction",
"lambda:GetFunctionUrlConfig",
"lambda:GetLayerVersionPolicy",
"lambda:GetPolicy",
"lambda:ListAliases",
"lambda:ListCapacityProviders",
"lambda:ListEventSourceMappings",
"lambda:ListFunctionEventInvokeConfigs",
"lambda:ListFunctionUrlConfigs",
"lambda:ListFunctions",
"lambda:ListLayerVersions",
"lambda:ListLayers",
"lambda:ListTags",
"lambda:ListVersionsByFunction",
"logs:DescribeDeliveryDestinations",
"logs:DescribeDeliverySources",
"logs:DescribeDestinations",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:DescribeMetricFilters",
"logs:DescribeQueryDefinitions",
"logs:DescribeResourcePolicies",
"logs:DescribeSubscriptionFilters",
"logs:FilterLogEvents",
"logs:GetDataProtectionPolicy",
"logs:GetQueryResults",
"logs:StartQuery",
"rds:DescribeDBClusterParameterGroups",
"rds:DescribeDBClusterParameters",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBClusters",
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBParameters",
"rds:DescribeDBProxies",
"rds:DescribeDBProxyEndpoints",
"rds:DescribeDBShardGroups",
"rds:DescribeDBSnapshots",
"rds:DescribeDBSubnetGroups",
"rds:DescribeEventSubscriptions",
"rds:ListTagsForResource",
"resource-explorer-2:GetDefaultView",
"resource-explorer-2:GetView",
"resource-explorer-2:ListViews",
"resource-explorer-2:Search",
"s3:GetAccountPublicAccessBlock",
"s3:GetBucketAbac",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketMetadataTableConfiguration",
"s3:GetBucketNotification",
"s3:GetBucketObjectLockConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPolicy",
"s3:GetBucketPolicyStatus",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetReplicationConfiguration",
"s3:ListAllMyBuckets",
"s3:ListBucket",
"securityhub:BatchGetSecurityControls",
"securityhub:DescribeHub",
"securityhub:GetEnabledStandards",
"securityhub:GetFindings",
"securityhub:ListSecurityControlDefinitions",
"tag:GetResources"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ApiGatewayRead",
"Effect": "Allow",
"Action": [
"apigateway:GET"
],
"Resource": [
"arn:aws:apigateway:*::/account",
"arn:aws:apigateway:*::/apis",
"arn:aws:apigateway:*::/apis/*",
"arn:aws:apigateway:*::/domainnames",
"arn:aws:apigateway:*::/domainnames/*",
"arn:aws:apigateway:*::/restapis",
"arn:aws:apigateway:*::/restapis/*",
"arn:aws:apigateway:*::/usageplans",
"arn:aws:apigateway:*::/usageplans/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "OrganizationsTopologyRead",
"Effect": "Allow",
"Action": [
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"organizations:ListDelegatedAdministrators",
"organizations:ListParents"
],
"Resource": "*"
},
{
"Sid": "AssuranceConfigurationRecorderManagement",
"Effect": "Allow",
"Action": [
"config:DeleteServiceLinkedConfigurationRecorder",
"config:DescribeConfigurationRecorders",
"config:PutServiceLinkedConfigurationRecorder"
],
"Resource": "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForAssurance/*"
},
{
"Sid": "AWSConfigServiceLinkedRole",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "config.amazonaws.com"
}
}
},
{
"Sid": "AssurancePolicy",
"Effect": "Allow",
"Action": [
"assurance:CreateComment",
"assurance:DownloadEvidence",
"assurance:GetAssessment",
"assurance:GetComment",
"assurance:GetControl",
"assurance:GetEnvironment",
"assurance:GetEvidence",
"assurance:GetProject",
"assurance:GetTask",
"assurance:ListAssessmentAnnotations",
"assurance:ListAssessments",
"assurance:ListComments",
"assurance:ListControls",
"assurance:ListDiscoveredResources",
"assurance:ListEnabledFrameworks",
"assurance:ListEvidence",
"assurance:ListEvidenceAnnotations",
"assurance:ListProjects",
"assurance:ListTasks",
"assurance:StartResourceDiscovery",
"assurance:UpdateTask",
"assurance:UploadEvidence"
],
"Resource": "arn:*:assurance:*:*:environment/*"
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2026-08-26T21:07:08+00:00"
}
}Version History (1 recorded)
Raw historyv1new policy
388 actions added
New AWS service assurance
1 never-before-seen action: bedrock:ValidateFlowDefinition
Permissions management: iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole