WellArchitectedAgentResourceScanning
Last Modified
Sep 30, 2026
September 30, 2026 at 07:02 PM UTC
Version
v2
Total Versions
2
Created
Sep 30, 2026
Actions
1121
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can read secrets
Reads Lambda environment variables, where credentials often live, on any resource with no condition.
lambda:GetFunctionConfigurationUse with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
IAM Access Analyzer (6)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 31145 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Suggestion / REDUNDANT_ACTION
The 3 action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: ce:GetCostAndUsageWithResources. AWS docs
- Suggestion / REDUNDANT_ACTION
The 2 action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: cloudwatch:DescribeAlarms. AWS docs
- Suggestion / REDUNDANT_ACTION
The 4 action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: cloudwatch:GetMetricWidgetImage. AWS docs
- Suggestion / REDUNDANT_ACTION
The 2 action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: cloudwatch:ListMetrics. AWS docs
- Suggestion / REDUNDANT_ACTION
The 2 action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: sagemaker:ListMonitoringSchedules. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CloudControlDiscoveryCompact",
"Effect": "Allow",
"Action": [
"access-analyzer:GetAnalyzer",
"access-analyzer:List*",
"acm-pca:Describe*",
"acm-pca:Get*",
"acm-pca:List*",
"acm:DescribeCertificate",
"aco-automation:GetAutomationRule",
"aco-automation:ListAutomationRules",
"aidevops:DescribePrivateConnection",
"aidevops:Get*",
"aidevops:List*",
"aiops:Get*",
"aiops:List*",
"airflow-serverless:GetWorkflow",
"airflow-serverless:List*",
"airflow:GetEnvironment",
"airflow:ListEnvironments",
"amplify:Get*",
"amplify:List*",
"amplifyuibuilder:Get*",
"amplifyuibuilder:List*",
"apigateway:GetRoutingRule",
"apigateway:ListRoutingRules",
"app-integrations:Get*",
"app-integrations:List*",
"appconfig:Get*",
"appconfig:List*",
"appflow:Describe*",
"appflow:List*",
"application-autoscaling:Describe*",
"application-signals:GetServiceLevelObjective",
"application-signals:List*",
"applicationinsights:Describe*",
"applicationinsights:List*",
"apprunner:Describe*",
"apprunner:List*",
"appstream:Describe*",
"appstream:List*",
"apptest:GetTestCase",
"apptest:List*",
"aps:Describe*",
"aps:List*",
"arc-region-switch:GetPlan",
"arc-region-switch:List*",
"arc-zonal-shift:Get*",
"arc-zonal-shift:ListManagedResources",
"athena:Get*",
"athena:List*",
"auditmanager:GetAssessment",
"auditmanager:List*",
"autoscaling:Describe*",
"aws-external-anthropic:GetWorkspace",
"aws-external-anthropic:List*",
"b2bi:Get*",
"b2bi:List*",
"backup-gateway:GetHypervisor",
"backup-gateway:List*",
"backup:Describe*",
"backup:Get*",
"backup:List*",
"batch:Describe*",
"batch:List*",
"bcm-data-exports:GetExport",
"bcm-data-exports:List*",
"bcm-pricing-calculator:GetBillScenario",
"bcm-pricing-calculator:List*",
"bedrock-agentcore:Get*",
"bedrock-agentcore:List*",
"bedrock-mantle:GetProject",
"bedrock-mantle:List*",
"bedrock:Get*",
"bedrock:List*",
"billing:GetBillingView",
"billing:List*",
"billingconductor:List*",
"braket:ListTagsForResource",
"braket:Search*",
"budgets:Describe*",
"budgets:ListTagsForResource",
"ce:DescribeCostCategoryDefinition",
"ce:Get*",
"ce:GetCostAndUsage",
"ce:GetCostAndUsageWithResources",
"ce:List*",
"chatbot:Describe*",
"chatbot:Get*",
"chatbot:List*",
"chime:Describe*",
"chime:List*",
"cleanrooms-ml:Get*",
"cleanrooms-ml:List*",
"cleanrooms:Get*",
"cleanrooms:List*",
"cloudformation:DescribeType",
"cloudformation:GetResource",
"cloudformation:ListResources",
"cloudformation:ListTypes",
"cloudfront:Describe*",
"cloudfront:Get*",
"cloudfront:List*",
"cloudtrail:Describe*",
"cloudtrail:Get*",
"cloudtrail:List*",
"cloudwatch:Describe*",
"cloudwatch:DescribeAlarms",
"cloudwatch:Get*",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:GetMetricWidgetImage",
"cloudwatch:List*",
"cloudwatch:ListMetrics",
"codeartifact:Describe*",
"codeartifact:Get*",
"codeartifact:List*",
"codebuild:BatchGetFleets",
"codebuild:ListFleets",
"codecommit:Get*",
"codeconnections:GetConnection",
"codeconnections:List*",
"codedeploy:Get*",
"codedeploy:List*",
"codeguru-profiler:DescribeProfilingGroup",
"codeguru-profiler:Get*",
"codeguru-profiler:List*",
"codeguru-reviewer:DescribeRepositoryAssociation",
"codeguru-reviewer:List*",
"codepipeline:Get*",
"codepipeline:List*",
"codestar-connections:Get*",
"codestar-connections:List*",
"codestar-notifications:DescribeNotificationRule",
"codestar-notifications:ListNotificationRules",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:Get*",
"cognito-identity:ListIdentityPools",
"comprehend:Describe*",
"comprehend:List*",
"config:Describe*",
"config:GetStoredQuery",
"config:List*",
"connect-campaigns:Describe*",
"connect-campaigns:List*",
"controltower:Get*",
"controltower:List*",
"cur:Describe*",
"cur:ListTagsForResource",
"databrew:Describe*",
"databrew:List*",
"datapipeline:DescribePipelines",
"datapipeline:GetPipelineDefinition",
"datapipeline:ListPipelines",
"datasync:Describe*",
"datasync:List*",
"deadline:Get*",
"deadline:List*",
"detective:Describe*",
"detective:GetMembers",
"detective:List*",
"devicefarm:Get*",
"devicefarm:List*",
"devops-guru:Describe*",
"devops-guru:Get*",
"devops-guru:List*",
"directconnect:Describe*",
"dms:Describe*",
"dms:List*",
"ds:Describe*",
"ds:ListTagsForResource",
"dsql:Get*",
"dsql:List*",
"ecr-public:Describe*",
"ecr-public:Get*",
"ecr-public:ListTagsForResource",
"ecr:Describe*",
"ecr:Get*",
"ecr:List*",
"ecs:Describe*",
"ecs:List*",
"eks:Describe*",
"eks:List*",
"elasticbeanstalk:Describe*",
"elasticbeanstalk:List*",
"elasticfilesystem:Describe*",
"elasticloadbalancing:Describe*",
"elasticmapreduce:Describe*",
"elasticmapreduce:GetStudioSessionMapping",
"elasticmapreduce:List*",
"elemental-inference:GetFeed",
"elemental-inference:List*",
"emr-containers:Describe*",
"emr-containers:List*",
"emr-serverless:GetApplication",
"emr-serverless:ListApplications",
"entityresolution:Get*",
"entityresolution:List*",
"events:Describe*",
"events:List*",
"evidently:GetSegment",
"evidently:List*",
"evs:GetEnvironment",
"evs:List*",
"finspace:GetEnvironment",
"finspace:ListEnvironments",
"firehose:DescribeDeliveryStream",
"firehose:List*",
"fis:Get*",
"fis:List*",
"fms:Get*",
"fms:List*",
"forecast:Describe*",
"forecast:List*",
"fsx:Describe*",
"gamelift:Describe*",
"gamelift:List*",
"gamelift:ValidateMatchmakingRuleSet",
"gameliftstreams:Get*",
"gameliftstreams:List*",
"geo:Describe*",
"geo:List*",
"globalaccelerator:Describe*",
"globalaccelerator:List*",
"grafana:Describe*",
"grafana:ListWorkspaces",
"greengrass:DescribeComponent",
"greengrass:GetDeployment",
"greengrass:List*",
"groundstation:Get*",
"groundstation:List*",
"guardduty:DescribePublishingDestination",
"guardduty:Get*",
"guardduty:List*",
"healthlake:DescribeFHIRDatastore",
"healthlake:List*",
"iam:Get*",
"iam:List*",
"imagebuilder:Get*",
"imagebuilder:List*",
"inspector:Describe*",
"inspector:List*",
"inspector2:Get*",
"inspector2:List*",
"interconnect:GetConnection",
"interconnect:List*",
"internetmonitor:Get*",
"internetmonitor:List*",
"invoicing:GetInvoiceUnit",
"invoicing:List*",
"iot:Describe*",
"iot:Get*",
"iot:List*",
"iotanalytics:Describe*",
"iotanalytics:List*",
"iotdeviceadvisor:GetSuiteDefinition",
"iotdeviceadvisor:ListSuiteDefinitions",
"iotevents:Describe*",
"iotevents:List*",
"iotfleetwise:Get*",
"iotfleetwise:List*",
"iotsitewise:Describe*",
"iotsitewise:List*",
"iottwinmaker:Get*",
"iottwinmaker:List*",
"iotwireless:Get*",
"iotwireless:List*",
"ivs:Get*",
"ivs:List*",
"ivschat:Get*",
"ivschat:List*",
"kafka-cluster:Describe*",
"kafka:Describe*",
"kafka:Get*",
"kafka:List*",
"kafkaconnect:Describe*",
"kafkaconnect:List*",
"kendra-ranking:DescribeRescoreExecutionPlan",
"kendra-ranking:List*",
"kendra:Describe*",
"kendra:List*",
"kinesis:Describe*",
"kinesis:List*",
"kinesisanalytics:DescribeApplication",
"kinesisanalytics:List*",
"kinesisvideo:Describe*",
"kinesisvideo:List*",
"lakeformation:Describe*",
"lakeformation:GetLFTag",
"lakeformation:List*",
"lambda:GetFunctionConcurrency",
"launchwizard:GetDeployment",
"launchwizard:List*",
"lex:Describe*",
"lex:GetBotAlias",
"lex:List*",
"license-manager:Get*",
"license-manager:List*",
"logs:Describe*",
"logs:Get*",
"logs:List*",
"lookoutequipment:DescribeInferenceScheduler",
"lookoutequipment:ListInferenceSchedulers",
"lookoutvision:DescribeProject",
"lookoutvision:ListProjects",
"m2:Get*",
"m2:List*",
"macie2:Get*",
"macie2:List*",
"managedblockchain:GetAccessor",
"managedblockchain:ListAccessors",
"mediaconnect:Describe*",
"mediaconnect:Get*",
"mediaconnect:List*",
"medialive:Describe*",
"medialive:Get*",
"medialive:List*",
"mediapackage-vod:Describe*",
"mediapackage-vod:List*",
"mediapackage:Describe*",
"mediapackage:List*",
"mediapackagev2:Get*",
"mediapackagev2:List*",
"mediatailor:Describe*",
"mediatailor:GetPlaybackConfiguration",
"mediatailor:List*",
"medical-imaging:GetDatastore",
"medical-imaging:List*",
"mobiletargeting:Get*",
"mobiletargeting:List*",
"mpa:Get*",
"mpa:List*",
"mq:Describe*",
"mq:List*",
"network-firewall:Describe*",
"network-firewall:List*",
"networkmanager:Describe*",
"networkmanager:Get*",
"networkmanager:List*",
"nimble:GetStudio",
"nimble:ListStudios",
"notifications-contacts:GetEmailContact",
"notifications-contacts:List*",
"notifications:Get*",
"notifications:List*",
"nova-act:GetWorkflowDefinition",
"nova-act:ListWorkflowDefinitions",
"oam:Get*",
"oam:List*",
"observabilityadmin:Get*",
"observabilityadmin:List*",
"odb:Get*",
"odb:List*",
"omics:Get*",
"omics:List*",
"organizations:Describe*",
"organizations:List*",
"osis:Get*",
"osis:List*",
"panorama:Describe*",
"panorama:List*",
"payment-cryptography:Get*",
"payment-cryptography:List*",
"pca-connector-ad:Get*",
"pca-connector-ad:List*",
"pca-connector-scep:Get*",
"pca-connector-scep:List*",
"pcs:Get*",
"pcs:List*",
"personalize:Describe*",
"personalize:List*",
"pipes:DescribePipe",
"pipes:ListPipes",
"profile:Get*",
"profile:List*",
"proton:Get*",
"proton:List*",
"qbusiness:Get*",
"qbusiness:List*",
"quicksight:Describe*",
"quicksight:List*",
"ram:Get*",
"ram:List*",
"rbin:GetRule",
"rbin:List*",
"refactor-spaces:Get*",
"refactor-spaces:List*",
"rekognition:Describe*",
"rekognition:List*",
"resiliencehub:Describe*",
"resiliencehub:Get*",
"resiliencehub:List*",
"resource-explorer-2:Get*",
"resource-explorer-2:List*",
"resource-groups:Get*",
"resource-groups:List*",
"resource-groups:SearchResources",
"robomaker:Describe*",
"robomaker:List*",
"rolesanywhere:Get*",
"rolesanywhere:List*",
"route53-recovery-control-config:Describe*",
"route53-recovery-control-config:List*",
"route53-recovery-readiness:Get*",
"route53-recovery-readiness:List*",
"route53:Get*",
"route53:List*",
"route53profiles:Get*",
"route53profiles:List*",
"route53resolver:Get*",
"route53resolver:List*",
"rtbfabric:Get*",
"rtbfabric:List*",
"rum:BatchGetRumMetricDefinitions",
"rum:Get*",
"rum:List*",
"sagemaker:Describe*",
"sagemaker:GetModelPackageGroupPolicy",
"sagemaker:List*",
"sagemaker:ListMonitoringSchedules",
"scheduler:Get*",
"scheduler:List*",
"schemas:Describe*",
"schemas:List*",
"securitylake:Get*",
"securitylake:List*",
"servicecatalog:Describe*",
"servicecatalog:Get*",
"servicecatalog:List*",
"ses:Describe*",
"ses:Get*",
"ses:List*",
"shield:Describe*",
"shield:List*",
"signer:Get*",
"signer:List*",
"simspaceweaver:DescribeSimulation",
"simspaceweaver:ListSimulations",
"sms-voice:Describe*",
"sms-voice:Get*",
"sms-voice:List*",
"sns:Get*",
"sns:List*",
"sqs:GetQueueAttributes",
"sqs:List*",
"ssm-contacts:Get*",
"ssm-contacts:List*",
"ssm-guiconnect:Get*",
"ssm-incidents:Get*",
"ssm-incidents:List*",
"ssm-quicksetup:GetConfigurationManager",
"ssm-quicksetup:ListConfigurationManagers",
"ssm-sap:GetApplication",
"ssm-sap:List*",
"sso:Describe*",
"sso:Get*",
"sso:List*",
"states:Describe*",
"states:List*",
"supportapp:Get*",
"supportapp:List*",
"synthetics:Describe*",
"synthetics:Get*",
"synthetics:List*",
"tag:GetResources",
"thinclient:GetEnvironment",
"thinclient:List*",
"transfer:Describe*",
"transfer:List*",
"trustedadvisor:GetRecommendation",
"trustedadvisor:ListChecks",
"trustedadvisor:ListRecommendationResources",
"trustedadvisor:ListRecommendations",
"trustedadvisor:ListRecommendationsForResource",
"verifiedpermissions:Get*",
"verifiedpermissions:List*",
"voiceid:DescribeDomain",
"voiceid:List*",
"vpc-lattice:Get*",
"vpc-lattice:List*",
"wafv2:Get*",
"wafv2:List*",
"wisdom:Get*",
"wisdom:List*",
"workspaces-instances:Get*",
"workspaces-instances:List*",
"workspaces-web:Get*",
"workspaces-web:List*",
"workspaces:Describe*",
"xray:Get*",
"xray:List*"
],
"Resource": "*"
},
{
"Sid": "CloudControlDiscoveryCompactExact",
"Effect": "Allow",
"Action": [
"aoss:BatchGetCollection",
"aoss:BatchGetCollectionGroup",
"aoss:BatchGetLifecyclePolicy",
"aoss:BatchGetVpcEndpoint",
"aoss:GetAccessPolicy",
"aoss:GetSecurityConfig",
"aoss:GetSecurityPolicy",
"aoss:ListAccessPolicies",
"aoss:ListCollectionGroups",
"aoss:ListCollections",
"aoss:ListLifecyclePolicies",
"aoss:ListSecurityConfigs",
"aoss:ListSecurityPolicies",
"aoss:ListTagsForResource",
"aoss:ListVpcEndpoints",
"appsync:GetApi",
"appsync:GetChannelNamespace",
"appsync:GetDataSource",
"appsync:GetDomainName",
"appsync:GetGraphqlApi",
"appsync:GetSourceApiAssociation",
"appsync:ListApis",
"appsync:ListChannelNamespaces",
"appsync:ListDataSources",
"appsync:ListDomainNames",
"appsync:ListFunctions",
"appsync:ListGraphqlApis",
"appsync:ListResolvers",
"appsync:ListSourceApiAssociations",
"appsync:ListTagsForResource",
"cases:BatchGetCaseRule",
"cases:BatchGetField",
"cases:GetDomain",
"cases:GetLayout",
"cases:GetTemplate",
"cases:ListCaseRules",
"cases:ListDomains",
"cases:ListFields",
"cases:ListLayouts",
"cases:ListTemplates",
"cloudformation:BatchDescribeTypeConfigurations",
"cloudformation:DescribePublisher",
"cloudformation:DescribeStackInstance",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackSet",
"cloudformation:DescribeType",
"cloudformation:GetStackPolicy",
"cloudformation:GetTemplate",
"cloudformation:ListStackInstances",
"cloudformation:ListStackResources",
"cloudformation:ListStacks",
"cloudformation:ListStackSets",
"cloudformation:ListTypes",
"cloudformation:ListTypeVersions",
"cognito-idp:DescribeIdentityProvider",
"cognito-idp:DescribeResourceServer",
"cognito-idp:DescribeTerms",
"cognito-idp:DescribeUserPool",
"cognito-idp:DescribeUserPoolClient",
"cognito-idp:GetGroup",
"cognito-idp:GetUserPoolMfaConfig",
"cognito-idp:ListGroups",
"cognito-idp:ListIdentityProviders",
"cognito-idp:ListResourceServers",
"cognito-idp:ListTerms",
"cognito-idp:ListUserPoolClients",
"cognito-idp:ListUserPools",
"connect:DescribeAgentStatus",
"connect:DescribeContactFlow",
"connect:DescribeContactFlowModule",
"connect:DescribeContactFlowModuleAlias",
"connect:DescribeDataTable",
"connect:DescribeEvaluationForm",
"connect:DescribeHoursOfOperation",
"connect:DescribeInstance",
"connect:DescribeInstanceStorageConfig",
"connect:DescribeNotification",
"connect:DescribePhoneNumber",
"connect:DescribePredefinedAttribute",
"connect:DescribePrompt",
"connect:DescribeQueue",
"connect:DescribeQuickConnect",
"connect:DescribeRoutingProfile",
"connect:DescribeRule",
"connect:DescribeSecurityProfile",
"connect:DescribeTrafficDistributionGroup",
"connect:DescribeUserHierarchyGroup",
"connect:DescribeView",
"connect:DescribeWorkspace",
"connect:GetTaskTemplate",
"connect:ListAgentStatuses",
"connect:ListApprovedOrigins",
"connect:ListBots",
"connect:ListContactFlowModuleAliases",
"connect:ListContactFlowModules",
"connect:ListContactFlowModuleVersions",
"connect:ListContactFlows",
"connect:ListContactFlowVersions",
"connect:ListDataTableAttributes",
"connect:ListDataTables",
"connect:ListEvaluationForms",
"connect:ListEvaluationFormVersions",
"connect:ListHoursOfOperationOverrides",
"connect:ListHoursOfOperations",
"connect:ListInstanceAttributes",
"connect:ListInstances",
"connect:ListInstanceStorageConfigs",
"connect:ListIntegrationAssociations",
"connect:ListLambdaFunctions",
"connect:ListNotifications",
"connect:ListPredefinedAttributes",
"connect:ListPrompts",
"connect:ListQueueEmailAddresses",
"connect:ListQueueQuickConnects",
"connect:ListQueues",
"connect:ListQuickConnects",
"connect:ListRoutingProfileManualAssignmentQueues",
"connect:ListRoutingProfileQueues",
"connect:ListRoutingProfiles",
"connect:ListRules",
"connect:ListSecurityKeys",
"connect:ListSecurityProfileApplications",
"connect:ListSecurityProfileFlowModules",
"connect:ListSecurityProfilePermissions",
"connect:ListSecurityProfiles",
"connect:ListTagsForResource",
"connect:ListTaskTemplates",
"connect:ListTrafficDistributionGroups",
"connect:ListUserHierarchyGroups",
"connect:ListUserProficiencies",
"connect:ListUsers",
"connect:ListViews",
"connect:ListViewVersions",
"connect:ListWorkspaceMedia",
"connect:ListWorkspacePages",
"connect:ListWorkspaces",
"connect:SearchWorkspaceAssociations",
"datazone:GetDataSource",
"datazone:GetDomain",
"datazone:GetDomainUnit",
"datazone:GetEnvironment",
"datazone:GetEnvironmentAction",
"datazone:GetEnvironmentBlueprintConfiguration",
"datazone:GetEnvironmentProfile",
"datazone:GetGroupProfile",
"datazone:GetProject",
"datazone:GetProjectProfile",
"datazone:GetSubscriptionTarget",
"datazone:GetUserProfile",
"datazone:ListConnections",
"datazone:ListDataSources",
"datazone:ListDomains",
"datazone:ListDomainUnitsForParent",
"datazone:ListEntityOwners",
"datazone:ListEnvironmentActions",
"datazone:ListEnvironmentBlueprintConfigurations",
"datazone:ListEnvironmentProfiles",
"datazone:ListEnvironments",
"datazone:ListPolicyGrants",
"datazone:ListProjectMemberships",
"datazone:ListProjectProfiles",
"datazone:ListProjects",
"datazone:ListSubscriptionTargets",
"datazone:SearchGroupProfiles",
"datazone:SearchUserProfiles",
"docdb-elastic:GetCluster",
"docdb-elastic:ListClusters",
"docdb-elastic:ListTagsForResource",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeContributorInsights",
"dynamodb:DescribeKinesisStreamingDestination",
"dynamodb:DescribeTable",
"dynamodb:DescribeTimeToLive",
"dynamodb:GetResourcePolicy",
"dynamodb:ListTables",
"dynamodb:ListTagsOfResource",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeAwsNetworkPerformanceMetricSubscriptions",
"ec2:DescribeCapacityManagerDataExports",
"ec2:DescribeCapacityReservationFleets",
"ec2:DescribeCapacityReservations",
"ec2:DescribeCarrierGateways",
"ec2:DescribeClientVpnEndpoints",
"ec2:DescribeCustomerGateways",
"ec2:DescribeDhcpOptions",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeFleets",
"ec2:DescribeFlowLogs",
"ec2:DescribeHosts",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceConnectEndpoints",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeInstances",
"ec2:DescribeInstanceSqlHaStates",
"ec2:DescribeInternetGateways",
"ec2:DescribeIpamPools",
"ec2:DescribeIpamPrefixListResolvers",
"ec2:DescribeIpamPrefixListResolverTargets",
"ec2:DescribeIpamResourceDiscoveries",
"ec2:DescribeIpamResourceDiscoveryAssociations",
"ec2:DescribeIpams",
"ec2:DescribeIpamScopes",
"ec2:DescribeKeyPairs",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeLocalGatewayRouteTables",
"ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
"ec2:DescribeLocalGatewayRouteTableVpcAssociations",
"ec2:DescribeLocalGatewayVirtualInterfaceGroups",
"ec2:DescribeLocalGatewayVirtualInterfaces",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInsightsAccessScopeAnalyses",
"ec2:DescribeNetworkInsightsAccessScopes",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePlacementGroups",
"ec2:DescribeRouteServerEndpoints",
"ec2:DescribeRouteServerPeers",
"ec2:DescribeRouteServers",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroupVpcAssociations",
"ec2:DescribeSpotFleetRequests",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeTrafficMirrorFilterRules",
"ec2:DescribeTrafficMirrorFilters",
"ec2:DescribeTrafficMirrorSessions",
"ec2:DescribeTrafficMirrorTargets",
"ec2:DescribeTransitGatewayConnectPeers",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayMeteringPolicies",
"ec2:DescribeTransitGatewayMulticastDomains",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGateways",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeVerifiedAccessEndpoints",
"ec2:DescribeVerifiedAccessGroups",
"ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
"ec2:DescribeVerifiedAccessInstances",
"ec2:DescribeVerifiedAccessTrustProviders",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumes",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcBlockPublicAccessExclusions",
"ec2:DescribeVpcEncryptionControls",
"ec2:DescribeVpcEndpointAssociations",
"ec2:DescribeVpcEndpointConnectionNotifications",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpointServicePermissions",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConcentrators",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetAssociatedEnclaveCertificateIamRoles",
"ec2:GetIpamPoolAllocations",
"ec2:GetIpamPoolCidrs",
"ec2:GetIpamPrefixListResolverRules",
"ec2:GetManagedPrefixListEntries",
"ec2:GetNetworkInsightsAccessScopeContent",
"ec2:GetRouteServerAssociations",
"ec2:GetRouteServerPropagations",
"ec2:GetSnapshotBlockPublicAccessState",
"ec2:GetTransitGatewayMeteringPolicyEntries",
"ec2:GetTransitGatewayMulticastDomainAssociations",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:GetVerifiedAccessEndpointPolicy",
"ec2:GetVerifiedAccessGroupPolicy",
"ec2:SearchLocalGatewayRoutes",
"ec2:SearchTransitGatewayMulticastGroups",
"ec2:SearchTransitGatewayRoutes",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeCacheParameterGroups",
"elasticache:DescribeCacheParameters",
"elasticache:DescribeCacheSubnetGroups",
"elasticache:DescribeGlobalReplicationGroups",
"elasticache:DescribeReplicationGroups",
"elasticache:DescribeServerlessCaches",
"elasticache:DescribeUserGroups",
"elasticache:DescribeUsers",
"elasticache:ListTagsForResource",
"es:GetApplication",
"es:ListApplications",
"es:ListTags",
"frauddetector:BatchGetVariable",
"frauddetector:DescribeDetector",
"frauddetector:GetDetectors",
"frauddetector:GetDetectorVersion",
"frauddetector:GetEntityTypes",
"frauddetector:GetEventTypes",
"frauddetector:GetExternalModels",
"frauddetector:GetLabels",
"frauddetector:GetListsMetadata",
"frauddetector:GetModelVersion",
"frauddetector:GetOutcomes",
"frauddetector:GetRules",
"frauddetector:GetVariables",
"frauddetector:ListTagsForResource",
"glue:DescribeIntegrations",
"glue:GetCatalog",
"glue:GetCatalogs",
"glue:GetCrawler",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:GetIntegrationResourceProperty",
"glue:GetJob",
"glue:GetRegistry",
"glue:GetSchema",
"glue:GetSchemaVersion",
"glue:GetTags",
"glue:GetTrigger",
"glue:GetUsageProfile",
"glue:ListCrawlers",
"glue:ListIntegrationResourceProperties",
"glue:ListJobs",
"glue:ListRegistries",
"glue:ListSchemas",
"glue:ListSchemaVersions",
"glue:ListTriggers",
"glue:ListUsageProfiles",
"identitystore:DescribeGroup",
"identitystore:ListGroupMemberships",
"identitystore:ListGroupMembershipsForMember",
"identitystore:ListGroups",
"kms:DescribeCustomKeyStores",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:GetParametersForImport",
"kms:GetPublicKey",
"kms:ListAliases",
"kms:ListGrants",
"kms:ListKeyPolicies",
"kms:ListKeyRotations",
"kms:ListKeys",
"kms:ListResourceTags",
"kms:ListRetirableGrants",
"lambda:GetAlias",
"lambda:GetCapacityProvider",
"lambda:GetCodeSigningConfig",
"lambda:GetEventSourceMapping",
"lambda:GetFunction",
"lambda:GetFunctionCodeSigningConfig",
"lambda:GetFunctionConfiguration",
"lambda:GetFunctionEventInvokeConfig",
"lambda:GetFunctionRecursionConfig",
"lambda:GetFunctionScalingConfig",
"lambda:GetFunctionUrlConfig",
"lambda:GetLayerVersionPolicy",
"lambda:GetPolicy",
"lambda:GetProvisionedConcurrencyConfig",
"lambda:GetRuntimeManagementConfig",
"lambda:ListAliases",
"lambda:ListCapacityProviders",
"lambda:ListCodeSigningConfigs",
"lambda:ListEventSourceMappings",
"lambda:ListFunctionEventInvokeConfigs",
"lambda:ListFunctions",
"lambda:ListFunctionUrlConfigs",
"lambda:ListLayerVersions",
"lambda:ListTags",
"lambda:ListVersionsByFunction",
"lightsail:GetAlarms",
"lightsail:GetBuckets",
"lightsail:GetCertificates",
"lightsail:GetContainerServices",
"lightsail:GetDisk",
"lightsail:GetDisks",
"lightsail:GetDiskSnapshot",
"lightsail:GetDiskSnapshots",
"lightsail:GetDistributions",
"lightsail:GetDomain",
"lightsail:GetDomains",
"lightsail:GetInstance",
"lightsail:GetInstances",
"lightsail:GetInstanceSnapshot",
"lightsail:GetInstanceSnapshots",
"lightsail:GetLoadBalancer",
"lightsail:GetLoadBalancers",
"lightsail:GetLoadBalancerTlsCertificates",
"lightsail:GetRelationalDatabase",
"lightsail:GetRelationalDatabases",
"lightsail:GetRelationalDatabaseSnapshot",
"lightsail:GetRelationalDatabaseSnapshots",
"lightsail:GetStaticIp",
"lightsail:GetStaticIps",
"memorydb:DescribeACLs",
"memorydb:DescribeClusters",
"memorydb:DescribeMultiRegionClusters",
"memorydb:DescribeParameterGroups",
"memorydb:DescribeSubnetGroups",
"memorydb:DescribeUsers",
"memorydb:ListTags",
"neptune-graph:GetGraph",
"neptune-graph:GetGraphSnapshot",
"neptune-graph:GetPrivateGraphEndpoint",
"neptune-graph:ListGraphs",
"neptune-graph:ListGraphSnapshots",
"neptune-graph:ListPrivateGraphEndpoints",
"neptune-graph:ListTagsForResource",
"qldb:DescribeJournalKinesisStream",
"qldb:ListJournalKinesisStreamsForLedger",
"qldb:ListTagsForResource",
"rds:DescribeDBClusterParameterGroups",
"rds:DescribeDBClusterParameters",
"rds:DescribeDBClusters",
"rds:DescribeDBEngineVersions",
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBParameters",
"rds:DescribeDBProxies",
"rds:DescribeDBProxyEndpoints",
"rds:DescribeDBProxyTargetGroups",
"rds:DescribeDBProxyTargets",
"rds:DescribeDBShardGroups",
"rds:DescribeDBSubnetGroups",
"rds:DescribeEngineDefaultParameters",
"rds:DescribeEventSubscriptions",
"rds:DescribeGlobalClusters",
"rds:DescribeIntegrations",
"rds:DescribeOptionGroups",
"rds:ListTagsForResource",
"redshift-serverless:GetNamespace",
"redshift-serverless:GetSnapshot",
"redshift-serverless:GetWorkgroup",
"redshift-serverless:ListNamespaces",
"redshift-serverless:ListSnapshotCopyConfigurations",
"redshift-serverless:ListSnapshots",
"redshift-serverless:ListTagsForResource",
"redshift-serverless:ListWorkgroups",
"redshift:DescribeClusterDbRevisions",
"redshift:DescribeClusterParameterGroups",
"redshift:DescribeClusterParameters",
"redshift:DescribeClusters",
"redshift:DescribeClusterSubnetGroups",
"redshift:DescribeEndpointAccess",
"redshift:DescribeEndpointAuthorization",
"redshift:DescribeEventSubscriptions",
"redshift:DescribeIntegrations",
"redshift:DescribeLoggingStatus",
"redshift:DescribeScheduledActions",
"redshift:DescribeTags",
"redshift:GetResourcePolicy",
"route53globalresolver:GetAccessSource",
"route53globalresolver:GetDNSView",
"route53globalresolver:GetFirewallDomainList",
"route53globalresolver:GetFirewallRule",
"route53globalresolver:GetGlobalResolver",
"route53globalresolver:GetHostedZoneAssociation",
"route53globalresolver:ListAccessSources",
"route53globalresolver:ListAccessTokens",
"route53globalresolver:ListDNSViews",
"route53globalresolver:ListFirewallDomainLists",
"route53globalresolver:ListFirewallRules",
"route53globalresolver:ListGlobalResolvers",
"route53globalresolver:ListHostedZoneAssociations",
"route53globalresolver:ListTagsForResource",
"s3-outposts:GetAccessPoint",
"s3-outposts:GetAccessPointPolicy",
"s3-outposts:GetBucket",
"s3-outposts:GetBucketTagging",
"s3-outposts:GetLifecycleConfiguration",
"s3-outposts:ListAccessPoints",
"s3-outposts:ListEndpoints",
"s3-outposts:ListRegionalBuckets",
"s3:GetAccelerateConfiguration",
"s3:GetAccessGrant",
"s3:GetAccessGrantsInstance",
"s3:GetAccessGrantsLocation",
"s3:GetAccessPoint",
"s3:GetAccessPointConfigurationForObjectLambda",
"s3:GetAccessPointForObjectLambda",
"s3:GetAccessPointPolicy",
"s3:GetAccessPointPolicyStatusForObjectLambda",
"s3:GetAnalyticsConfiguration",
"s3:GetBucketAbac",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketMetadataTableConfiguration",
"s3:GetBucketNotification",
"s3:GetBucketObjectLockConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPolicy",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetIntelligentTieringConfiguration",
"s3:GetInventoryConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetMetricsConfiguration",
"s3:GetMultiRegionAccessPoint",
"s3:GetMultiRegionAccessPointPolicy",
"s3:GetMultiRegionAccessPointPolicyStatus",
"s3:GetObjectAcl",
"s3:GetReplicationConfiguration",
"s3:GetStorageLensConfiguration",
"s3:GetStorageLensConfigurationTagging",
"s3:GetStorageLensGroup",
"s3:ListAccessGrants",
"s3:ListAccessGrantsInstances",
"s3:ListAccessGrantsLocations",
"s3:ListAccessPoints",
"s3:ListAccessPointsForObjectLambda",
"s3:ListAllMyBuckets",
"s3:ListMultiRegionAccessPoints",
"s3:ListStorageLensConfigurations",
"s3:ListStorageLensGroups",
"s3:ListTagsForResource",
"s3express:GetAccessPoint",
"s3express:GetAccessPointPolicy",
"s3express:GetAccessPointScope",
"s3express:GetBucketPolicy",
"s3express:GetEncryptionConfiguration",
"s3express:GetInventoryConfiguration",
"s3express:GetLifecycleConfiguration",
"s3express:GetMetricsConfiguration",
"s3express:ListAccessPointsForDirectoryBuckets",
"s3express:ListAllMyDirectoryBuckets",
"s3express:ListTagsForResource",
"s3files:GetAccessPoint",
"s3files:GetFileSystem",
"s3files:GetFileSystemPolicy",
"s3files:GetMountTarget",
"s3files:GetSynchronizationConfiguration",
"s3files:ListAccessPoints",
"s3files:ListFileSystems",
"s3files:ListMountTargets",
"s3files:ListTagsForResource",
"s3tables:GetNamespace",
"s3tables:GetTable",
"s3tables:GetTableBucket",
"s3tables:GetTableBucketEncryption",
"s3tables:GetTableBucketMaintenanceConfiguration",
"s3tables:GetTableBucketMetricsConfiguration",
"s3tables:GetTableBucketPolicy",
"s3tables:GetTableBucketReplication",
"s3tables:GetTableBucketStorageClass",
"s3tables:GetTableMaintenanceConfiguration",
"s3tables:GetTablePolicy",
"s3tables:GetTableStorageClass",
"s3tables:ListNamespaces",
"s3tables:ListTableBuckets",
"s3tables:ListTables",
"s3tables:ListTagsForResource",
"s3vectors:GetIndex",
"s3vectors:GetVectorBucket",
"s3vectors:GetVectorBucketPolicy",
"s3vectors:ListIndexes",
"s3vectors:ListTagsForResource",
"s3vectors:ListVectorBuckets",
"secretsmanager:DescribeSecret",
"secretsmanager:GetResourcePolicy",
"secretsmanager:ListSecrets",
"securityagent:BatchGetAgentSpaces",
"securityagent:BatchGetPentests",
"securityagent:BatchGetTargetDomains",
"securityagent:GetApplication",
"securityagent:ListAgentSpaces",
"securityagent:ListApplications",
"securityagent:ListIntegratedResources",
"securityagent:ListPentests",
"securityagent:ListTagsForResource",
"securityagent:ListTargetDomains",
"securityhub:BatchGetAutomationRules",
"securityhub:BatchGetSecurityControls",
"securityhub:DescribeHub",
"securityhub:DescribeOrganizationConfiguration",
"securityhub:DescribeSecurityHubV2",
"securityhub:DescribeStandardsControls",
"securityhub:GetAggregatorV2",
"securityhub:GetAutomationRuleV2",
"securityhub:GetConfigurationPolicy",
"securityhub:GetConfigurationPolicyAssociation",
"securityhub:GetConnectorV2",
"securityhub:GetEnabledStandards",
"securityhub:GetFindingAggregator",
"securityhub:GetInsights",
"securityhub:ListAggregatorsV2",
"securityhub:ListAutomationRules",
"securityhub:ListAutomationRulesV2",
"securityhub:ListConfigurationPolicies",
"securityhub:ListConfigurationPolicyAssociations",
"securityhub:ListConnectorsV2",
"securityhub:ListEnabledProductsForImport",
"securityhub:ListFindingAggregators",
"securityhub:ListOrganizationAdminAccounts",
"securityhub:ListSecurityControlDefinitions",
"securityhub:ListTagsForResource",
"ssm:DescribeAssociation",
"ssm:DescribeDocument",
"ssm:DescribeMaintenanceWindows",
"ssm:DescribeMaintenanceWindowTargets",
"ssm:DescribeMaintenanceWindowTasks",
"ssm:DescribeParameters",
"ssm:DescribePatchBaselines",
"ssm:GetDefaultPatchBaseline",
"ssm:GetDocument",
"ssm:GetMaintenanceWindow",
"ssm:GetMaintenanceWindowTask",
"ssm:GetPatchBaseline",
"ssm:GetResourcePolicies",
"ssm:ListAssociations",
"ssm:ListDocuments",
"ssm:ListResourceDataSync",
"ssm:ListTagsForResource",
"sso-directory:DescribeGroup",
"sso-directory:SearchGroups",
"sts:GetCallerIdentity",
"timestream-influxdb:GetDbCluster",
"timestream-influxdb:GetDbInstance",
"timestream-influxdb:ListDbClusters",
"timestream-influxdb:ListDbInstances",
"timestream-influxdb:ListTagsForResource",
"timestream:DescribeDatabase",
"timestream:DescribeEndpoints",
"timestream:DescribeScheduledQuery",
"timestream:DescribeTable",
"timestream:ListDatabases",
"timestream:ListScheduledQueries",
"timestream:ListTables",
"timestream:ListTagsForResource"
],
"Resource": "*"
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2026-09-30T18:37:07+00:00"
}
}Version History (2 recorded)
Raw historyv2updated
2 actions added
v1new policy
740 actions added
4 new AWS services
41 never-before-seen actions: aws-external-anthropic:GetWorkspace, bcm-pricing-calculator:GetBillScenario, bedrock-mantle:GetProject, connect:DescribeContactFlowModule, connect:DescribeContactFlowModuleAlias, connect:DescribeDataTable, connect:DescribeNotification, connect:DescribeWorkspace, connect:ListBots, connect:ListContactFlowModuleAliases, connect:ListContactFlowModuleVersions, connect:ListContactFlowModules, connect:ListContactFlowVersions, connect:ListContactFlows, connect:ListDataTableAttributes, connect:ListDataTables, connect:ListNotifications, connect:ListUserProficiencies, connect:ListWorkspaceMedia, connect:ListWorkspacePages, connect:ListWorkspaces, connect:SearchWorkspaceAssociations, ec2:DescribeAwsNetworkPerformanceMetricSubscriptions, ec2:DescribeInstanceSqlHaStates, ec2:DescribeIpamPrefixListResolverTargets, ec2:DescribeIpamPrefixListResolvers, ec2:DescribeTransitGatewayMeteringPolicies, ec2:DescribeVpnConcentrators, ec2:GetIpamPrefixListResolverRules, ec2:GetTransitGatewayMeteringPolicyEntries, glue:DescribeIntegrations, glue:GetIntegrationResourceProperty, glue:GetUsageProfile, glue:ListIntegrationResourceProperties, glue:ListUsageProfiles, kms:GetParametersForImport, neptune-graph:ListTagsForResource, s3express:GetInventoryConfiguration, securityagent:ListTagsForResource, securityhub:ListOrganizationAdminAccounts, trustedadvisor:ListRecommendationsForResource