# Allowed services in sandbox accounts
<a name="allowed-services-reference"></a>

The following AWS services are allowed by default in sandbox accounts through the solution’s Allowed Services SCP. Sandbox users can access these services during an active lease.

**Note**  
This list reflects the default baseline as of the current solution version. The list may change between releases as the solution adds support for new services.


| AWS service | IAM action prefix | 
| --- | --- | 
| IAM Access Analyzer |  `access-analyzer`  | 
| AWS Certificate Manager |  `acm`  | 
| AWS Private Certificate Authority |  `acm-pca`  | 
| AWS Amplify |  `amplify`  | 
| Amazon OpenSearch Serverless |  `aoss`  | 
| Amazon API Gateway |  `apigateway`  | 
| AWS AppConfig |  `appconfig`  | 
| Application Auto Scaling |  `application-autoscaling`  | 
| Amazon CloudWatch Application Insights |  `applicationinsights`  | 
| AWS App Mesh |  `appmesh`  | 
| AWS App Runner |  `apprunner`  | 
| Amazon AppStream 2.0 |  `appstream`  | 
| AWS AppSync |  `appsync`  | 
| Amazon Managed Service for Prometheus |  `aps`  | 
| Amazon Athena |  `athena`  | 
| Amazon EC2 Auto Scaling |  `autoscaling`  | 
| AWS Auto Scaling Plans |  `autoscaling-plans`  | 
| AWS Backup |  `backup`  | 
| AWS Batch |  `batch`  | 
| Amazon Bedrock |  `bedrock`  | 
| Amazon Bedrock AgentCore |  `bedrock-agentcore`  | 
| AWS Budgets |  `budgets`  | 
| AWS Cloud9 |  `cloud9`  | 
| Amazon Cloud Directory |  `clouddirectory`  | 
| AWS CloudFormation |  `cloudformation`  | 
| Amazon CloudFront |  `cloudfront`  | 
| AWS CloudHSM |  `cloudhsm`  | 
| Amazon CloudSearch |  `cloudsearch`  | 
| AWS CloudShell |  `cloudshell`  | 
| AWS CloudTrail |  `cloudtrail`  | 
| Amazon CloudWatch |  `cloudwatch`  | 
| AWS CodeArtifact |  `codeartifact`  | 
| AWS CodeBuild |  `codebuild`  | 
| AWS CodeCommit |  `codecommit`  | 
| AWS CodeDeploy |  `codedeploy`  | 
| Amazon CodeGuru Profiler |  `codeguru-profiler`  | 
| Amazon CodeGuru Reviewer |  `codeguru-reviewer`  | 
| AWS CodePipeline |  `codepipeline`  | 
| AWS CodeStar |  `codestar`  | 
| Amazon Cognito Identity |  `cognito-identity`  | 
| Amazon Cognito User Pools |  `cognito-idp`  | 
| Amazon Comprehend |  `comprehend`  | 
| AWS Config |  `config`  | 
| AWS Database Migration Service |  `dms`  | 
| AWS Data Pipeline |  `datapipeline`  | 
| Amazon DynamoDB Accelerator (DAX) |  `dax`  | 
| AWS Glue DataBrew |  `databrew`  | 
| AWS Device Farm |  `devicefarm`  | 
| Amazon DocumentDB Elastic Clusters |  `docdb-elastic`  | 
| AWS Directory Service |  `ds`  | 
| Amazon Aurora DSQL |  `dsql`  | 
| Amazon DynamoDB |  `dynamodb`  | 
| Amazon EC2 |  `ec2`  | 
| Amazon EC2 Messages |  `ec2messages`  | 
| Amazon Elastic Container Registry |  `ecr`  | 
| Amazon ECR Public |  `ecr-public`  | 
| Amazon Elastic Container Service |  `ecs`  | 
| Amazon Elastic File System |  `elasticfilesystem`  | 
| Amazon Elastic Kubernetes Service |  `eks`  | 
| Amazon EKS Auth |  `eks-auth`  | 
| Amazon ElastiCache |  `elasticache`  | 
| AWS Elastic Beanstalk |  `elasticbeanstalk`  | 
| Amazon OpenSearch Service |  `es`  | 
| Amazon Elastic Transcoder |  `elastictranscoder`  | 
| Elastic Load Balancing |  `elasticloadbalancing`  | 
| Amazon EMR |  `elasticmapreduce`  | 
| Amazon EventBridge |  `events`  | 
| Amazon API Gateway (execute) |  `execute-api`  | 
| Amazon Data Firehose |  `firehose`  | 
| AWS Firewall Manager |  `fms`  | 
| Amazon FSx |  `fsx`  | 
| Amazon GameLift Servers |  `gamelift`  | 
| AWS Global Accelerator |  `globalaccelerator`  | 
| AWS Glue |  `glue`  | 
| Amazon Managed Grafana |  `grafana`  | 
| Amazon GuardDuty |  `guardduty`  | 
| AWS Identity and Access Management |  `iam`  | 
| EC2 Image Builder |  `imagebuilder`  | 
| Amazon Inspector (classic) |  `inspector`  | 
| Amazon Inspector |  `inspector2`  | 
| AWS IoT |  `iot`  | 
| AWS IoT SiteWise |  `iotsitewise`  | 
| AWS IoT TwinMaker |  `iottwinmaker`  | 
| Amazon Kendra |  `kendra`  | 
| Amazon Kinesis Data Streams |  `kinesis`  | 
| Amazon Managed Service for Apache Flink |  `kinesisanalytics`  | 
| Amazon Kinesis Video Streams |  `kinesisvideo`  | 
| AWS Key Management Service |  `kms`  | 
| AWS Lake Formation |  `lakeformation`  | 
| AWS Lambda |  `lambda`  | 
| Amazon Lightsail |  `lightsail`  | 
| Amazon CloudWatch Logs |  `logs`  | 
| Amazon Machine Learning |  `machinelearning`  | 
| Amazon Macie |  `macie2`  | 
| Amazon Managed Blockchain |  `managedblockchain`  | 
| AWS Elemental MediaConvert |  `mediaconvert`  | 
| AWS Elemental MediaLive |  `medialive`  | 
| AWS Elemental MediaPackage |  `mediapackage`  | 
| AWS Elemental MediaStore |  `mediastore`  | 
| AWS Elemental MediaTailor |  `mediatailor`  | 
| Amazon MemoryDB |  `memorydb`  | 
| AWS Application Migration Service |  `mgn`  | 
| Amazon MQ |  `mq`  | 
| Amazon Managed Streaming for Apache Kafka |  `kafka`  | 
| Amazon Neptune |  `neptune-db`  | 
| AWS Network Manager |  `networkmanager`  | 
| Amazon OpenSearch Service (new) |  `opensearch`  | 
| AWS OpsWorks |  `opsworks`  | 
| AWS OpsWorks for Chef Automate |  `opsworks-cm`  | 
| Amazon Pinpoint SMS and Voice |  `sms-voice`  | 
| Amazon Q |  `q`  | 
| Amazon EventBridge Pipes |  `pipes`  | 
| Amazon Polly |  `polly`  | 
| Amazon Quantum Ledger Database |  `qldb`  | 
| Amazon QuickSight (Amazon Quick) |  `quicksight`  | 
| Amazon RDS |  `rds`  | 
| Amazon Redshift |  `redshift`  | 
| Amazon Redshift Serverless |  `redshift-serverless`  | 
| Amazon Rekognition |  `rekognition`  | 
| AWS Resource Explorer |  `resource-explorer-2`  | 
| AWS Resource Groups |  `resource-groups`  | 
| AWS RoboMaker |  `robomaker`  | 
| Amazon Route 53 |  `route53`  | 
| Amazon Route 53 Resolver |  `route53resolver`  | 
| Amazon S3 |  `s3`  | 
| Amazon S3 Tables |  `s3tables`  | 
| Amazon S3 Vectors |  `s3vectors`  | 
| Amazon SageMaker |  `sagemaker`  | 
| Amazon EventBridge Scheduler |  `scheduler`  | 
| AWS Secrets Manager |  `secretsmanager`  | 
| AWS Security Hub |  `securityhub`  | 
| AWS Service Catalog |  `servicecatalog`  | 
| AWS Cloud Map |  `servicediscovery`  | 
| Amazon Simple Email Service |  `ses`  | 
| AWS Step Functions |  `states`  | 
| AWS Signer |  `signer`  | 
| Amazon SimpleDB |  `sdb`  | 
| Amazon SNS |  `sns`  | 
| Amazon SQS |  `sqs`  | 
| AWS Systems Manager |  `ssm`  | 
| AWS Systems Manager GUI Connect |  `ssm-guiconnect`  | 
| AWS Systems Manager Messages |  `ssmmessages`  | 
| AWS Storage Gateway |  `storagegateway`  | 
| AWS Security Token Service |  `sts`  | 
| AWS Tag Editor |  `tag`  | 
| Amazon Textract |  `textract`  | 
| Amazon Timestream |  `timestream`  | 
| Amazon Transcribe |  `transcribe`  | 
| AWS Transfer Family |  `transfer`  | 
| AWS WAF (classic) |  `waf`  | 
| AWS WAF |  `wafv2`  | 
| Amazon WorkSpaces |  `workspaces`  | 
| AWS X-Ray |  `xray`  | 

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for Innovation Sandbox on AWS. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query solutions` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).