Allowed services in sandbox accounts
The following AWS services are allowed by default in sandbox accounts through the solution’s Allowed Services SCP. Sandbox users can access these services during an active lease.
Note
This list reflects the default baseline as of the current solution version. The list may change between releases as the solution adds support for new services.
| AWS service | IAM action prefix |
|---|---|
|
IAM Access Analyzer |
|
|
AWS Certificate Manager |
|
|
AWS Private Certificate Authority |
|
|
AWS Amplify |
|
|
Amazon OpenSearch Serverless |
|
|
Amazon API Gateway |
|
|
AWS AppConfig |
|
|
Application Auto Scaling |
|
|
Amazon CloudWatch Application Insights |
|
|
AWS App Mesh |
|
|
AWS App Runner |
|
|
Amazon AppStream 2.0 |
|
|
AWS AppSync |
|
|
Amazon Managed Service for Prometheus |
|
|
Amazon Athena |
|
|
Amazon EC2 Auto Scaling |
|
|
AWS Auto Scaling Plans |
|
|
AWS Backup |
|
|
AWS Batch |
|
|
Amazon Bedrock |
|
|
Amazon Bedrock AgentCore |
|
|
AWS Budgets |
|
|
AWS Cloud9 |
|
|
Amazon Cloud Directory |
|
|
AWS CloudFormation |
|
|
Amazon CloudFront |
|
|
AWS CloudHSM |
|
|
Amazon CloudSearch |
|
|
AWS CloudShell |
|
|
AWS CloudTrail |
|
|
Amazon CloudWatch |
|
|
AWS CodeArtifact |
|
|
AWS CodeBuild |
|
|
AWS CodeCommit |
|
|
AWS CodeDeploy |
|
|
Amazon CodeGuru Profiler |
|
|
Amazon CodeGuru Reviewer |
|
|
AWS CodePipeline |
|
|
AWS CodeStar |
|
|
Amazon Cognito Identity |
|
|
Amazon Cognito User Pools |
|
|
Amazon Comprehend |
|
|
AWS Config |
|
|
AWS Database Migration Service |
|
|
AWS Data Pipeline |
|
|
Amazon DynamoDB Accelerator (DAX) |
|
|
AWS Glue DataBrew |
|
|
AWS Device Farm |
|
|
Amazon DocumentDB Elastic Clusters |
|
|
AWS Directory Service |
|
|
Amazon Aurora DSQL |
|
|
Amazon DynamoDB |
|
|
Amazon EC2 |
|
|
Amazon EC2 Messages |
|
|
Amazon Elastic Container Registry |
|
|
Amazon ECR Public |
|
|
Amazon Elastic Container Service |
|
|
Amazon Elastic File System |
|
|
Amazon Elastic Kubernetes Service |
|
|
Amazon EKS Auth |
|
|
Amazon ElastiCache |
|
|
AWS Elastic Beanstalk |
|
|
Amazon OpenSearch Service |
|
|
Amazon Elastic Transcoder |
|
|
Elastic Load Balancing |
|
|
Amazon EMR |
|
|
Amazon EventBridge |
|
|
Amazon API Gateway (execute) |
|
|
Amazon Data Firehose |
|
|
AWS Firewall Manager |
|
|
Amazon FSx |
|
|
Amazon GameLift Servers |
|
|
AWS Global Accelerator |
|
|
AWS Glue |
|
|
Amazon Managed Grafana |
|
|
Amazon GuardDuty |
|
|
AWS Identity and Access Management |
|
|
EC2 Image Builder |
|
|
Amazon Inspector (classic) |
|
|
Amazon Inspector |
|
|
AWS IoT |
|
|
AWS IoT SiteWise |
|
|
AWS IoT TwinMaker |
|
|
Amazon Kendra |
|
|
Amazon Kinesis Data Streams |
|
|
Amazon Managed Service for Apache Flink |
|
|
Amazon Kinesis Video Streams |
|
|
AWS Key Management Service |
|
|
AWS Lake Formation |
|
|
AWS Lambda |
|
|
Amazon Lightsail |
|
|
Amazon CloudWatch Logs |
|
|
Amazon Machine Learning |
|
|
Amazon Macie |
|
|
Amazon Managed Blockchain |
|
|
AWS Elemental MediaConvert |
|
|
AWS Elemental MediaLive |
|
|
AWS Elemental MediaPackage |
|
|
AWS Elemental MediaStore |
|
|
AWS Elemental MediaTailor |
|
|
Amazon MemoryDB |
|
|
AWS Application Migration Service |
|
|
Amazon MQ |
|
|
Amazon Managed Streaming for Apache Kafka |
|
|
Amazon Neptune |
|
|
AWS Network Manager |
|
|
Amazon OpenSearch Service (new) |
|
|
AWS OpsWorks |
|
|
AWS OpsWorks for Chef Automate |
|
|
Amazon Pinpoint SMS and Voice |
|
|
Amazon Q |
|
|
Amazon EventBridge Pipes |
|
|
Amazon Polly |
|
|
Amazon Quantum Ledger Database |
|
|
Amazon QuickSight (Amazon Quick) |
|
|
Amazon RDS |
|
|
Amazon Redshift |
|
|
Amazon Redshift Serverless |
|
|
Amazon Rekognition |
|
|
AWS Resource Explorer |
|
|
AWS Resource Groups |
|
|
AWS RoboMaker |
|
|
Amazon Route 53 |
|
|
Amazon Route 53 Resolver |
|
|
Amazon S3 |
|
|
Amazon S3 Tables |
|
|
Amazon S3 Vectors |
|
|
Amazon SageMaker |
|
|
Amazon EventBridge Scheduler |
|
|
AWS Secrets Manager |
|
|
AWS Security Hub |
|
|
AWS Service Catalog |
|
|
AWS Cloud Map |
|
|
Amazon Simple Email Service |
|
|
AWS Step Functions |
|
|
AWS Signer |
|
|
Amazon SimpleDB |
|
|
Amazon SNS |
|
|
Amazon SQS |
|
|
AWS Systems Manager |
|
|
AWS Systems Manager GUI Connect |
|
|
AWS Systems Manager Messages |
|
|
AWS Storage Gateway |
|
|
AWS Security Token Service |
|
|
AWS Tag Editor |
|
|
Amazon Textract |
|
|
Amazon Timestream |
|
|
Amazon Transcribe |
|
|
AWS Transfer Family |
|
|
AWS WAF (classic) |
|
|
AWS WAF |
|
|
Amazon WorkSpaces |
|
|
AWS X-Ray |
|
