# WellArchitectedAgentResourceScanning **Description**: Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations `WellArchitectedAgentResourceScanning` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Using this policy You can attach `WellArchitectedAgentResourceScanning` to your users, groups, and roles. ## Policy details + **Type**: AWS managed policy + **Creation time**: July 16, 2026, 20:27 UTC + **Edited time:** July 16, 2026, 20:27 UTC + **ARN**: `arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning` ## Policy version **Policy version:** v1 (default) The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request. ## JSON policy document ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "CloudControlDiscoveryCompact", "Effect" : "Allow", "Action" : [ "access-analyzer:GetAnalyzer", "access-analyzer:List*", "acm-pca:Describe*", "acm-pca:Get*", "acm-pca:List*", "acm:DescribeCertificate", "aco-automation:GetAutomationRule", "aco-automation:ListAutomationRules", "aidevops:DescribePrivateConnection", "aidevops:Get*", "aidevops:List*", "aiops:Get*", "aiops:List*", "airflow-serverless:GetWorkflow", "airflow-serverless:List*", "airflow:GetEnvironment", "airflow:ListEnvironments", "amplify:Get*", "amplify:List*", "amplifyuibuilder:Get*", "amplifyuibuilder:List*", "apigateway:GetRoutingRule", "apigateway:ListRoutingRules", "app-integrations:Get*", "app-integrations:List*", "appconfig:Get*", "appconfig:List*", "appflow:Describe*", "appflow:List*", "application-autoscaling:Describe*", "application-signals:GetServiceLevelObjective", "application-signals:List*", "applicationinsights:Describe*", "applicationinsights:List*", "apprunner:Describe*", "apprunner:List*", "appstream:Describe*", "appstream:List*", "apptest:GetTestCase", "apptest:List*", "aps:Describe*", "aps:List*", "arc-region-switch:GetPlan", "arc-region-switch:List*", "arc-zonal-shift:Get*", "arc-zonal-shift:ListManagedResources", "athena:Get*", "athena:List*", "auditmanager:GetAssessment", "auditmanager:List*", "autoscaling:Describe*", "aws-external-anthropic:GetWorkspace", "aws-external-anthropic:List*", "b2bi:Get*", "b2bi:List*", "backup-gateway:GetHypervisor", "backup-gateway:List*", "backup:Describe*", "backup:Get*", "backup:List*", "batch:Describe*", "batch:List*", "bcm-data-exports:GetExport", "bcm-data-exports:List*", "bcm-pricing-calculator:GetBillScenario", "bcm-pricing-calculator:List*", "bedrock-agentcore:Get*", "bedrock-agentcore:List*", "bedrock-mantle:GetProject", "bedrock-mantle:List*", "bedrock:Get*", "bedrock:List*", "billing:GetBillingView", "billing:List*", "billingconductor:List*", "braket:ListTagsForResource", "braket:Search*", "budgets:Describe*", "budgets:ListTagsForResource", "ce:DescribeCostCategoryDefinition", "ce:Get*", "ce:GetCostAndUsage", "ce:GetCostAndUsageWithResources", "ce:List*", "chatbot:Describe*", "chatbot:Get*", "chatbot:List*", "chime:Describe*", "chime:List*", "cleanrooms-ml:Get*", "cleanrooms-ml:List*", "cleanrooms:Get*", "cleanrooms:List*", "cloudformation:DescribeType", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListTypes", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "cloudwatch:Describe*", "cloudwatch:DescribeAlarms", "cloudwatch:Get*", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricWidgetImage", "cloudwatch:List*", "cloudwatch:ListMetrics", "codeartifact:Describe*", "codeartifact:Get*", "codeartifact:List*", "codebuild:BatchGetFleets", "codebuild:ListFleets", "codecommit:Get*", "codeconnections:GetConnection", "codeconnections:List*", "codedeploy:Get*", "codedeploy:List*", "codeguru-profiler:DescribeProfilingGroup", "codeguru-profiler:Get*", "codeguru-profiler:List*", "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:List*", "codepipeline:Get*", "codepipeline:List*", "codestar-connections:Get*", "codestar-connections:List*", "codestar-notifications:DescribeNotificationRule", "codestar-notifications:ListNotificationRules", "cognito-identity:DescribeIdentityPool", "cognito-identity:Get*", "cognito-identity:ListIdentityPools", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:GetStoredQuery", "config:List*", "connect-campaigns:Describe*", "connect-campaigns:List*", "controltower:Get*", "controltower:List*", "cur:Describe*", "cur:ListTagsForResource", "databrew:Describe*", "databrew:List*", "datapipeline:DescribePipelines", "datapipeline:GetPipelineDefinition", "datapipeline:ListPipelines", "datasync:Describe*", "datasync:List*", "deadline:Get*", "deadline:List*", "detective:Describe*", "detective:GetMembers", "detective:List*", "devicefarm:Get*", "devicefarm:List*", "devops-guru:Describe*", "devops-guru:Get*", "devops-guru:List*", "directconnect:Describe*", "dms:Describe*", "dms:List*", "ds:Describe*", "ds:ListTagsForResource", "dsql:Get*", "dsql:List*", "ecr-public:Describe*", "ecr-public:Get*", "ecr-public:ListTagsForResource", "ecr:Describe*", "ecr:Get*", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:Describe*", "eks:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticfilesystem:Describe*", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:List*", "elemental-inference:GetFeed", "elemental-inference:List*", "emr-containers:Describe*", "emr-containers:List*", "emr-serverless:GetApplication", "emr-serverless:ListApplications", "entityresolution:Get*", "entityresolution:List*", "events:Describe*", "events:List*", "evidently:GetSegment", "evidently:List*", "evs:GetEnvironment", "evs:List*", "finspace:GetEnvironment", "finspace:ListEnvironments", "firehose:DescribeDeliveryStream", "firehose:List*", "fis:Get*", "fis:List*", "fms:Get*", "fms:List*", "forecast:Describe*", "forecast:List*", "fsx:Describe*", "gamelift:Describe*", "gamelift:List*", "gamelift:ValidateMatchmakingRuleSet", "gameliftstreams:Get*", "gameliftstreams:List*", "geo:Describe*", "geo:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "grafana:Describe*", "grafana:ListWorkspaces", "greengrass:DescribeComponent", "greengrass:GetDeployment", "greengrass:List*", "groundstation:Get*", "groundstation:List*", "guardduty:DescribePublishingDestination", "guardduty:Get*", "guardduty:List*", "healthlake:DescribeFHIRDatastore", "healthlake:List*", "iam:Get*", "iam:List*", "imagebuilder:Get*", "imagebuilder:List*", "inspector:Describe*", "inspector:List*", "inspector2:Get*", "inspector2:List*", "interconnect:GetConnection", "interconnect:List*", "internetmonitor:Get*", "internetmonitor:List*", "invoicing:GetInvoiceUnit", "invoicing:List*", "iot:Describe*", "iot:Get*", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotdeviceadvisor:GetSuiteDefinition", "iotdeviceadvisor:ListSuiteDefinitions", "iotevents:Describe*", "iotevents:List*", "iotfleetwise:Get*", "iotfleetwise:List*", "iotsitewise:Describe*", "iotsitewise:List*", "iottwinmaker:Get*", "iottwinmaker:List*", "iotwireless:Get*", "iotwireless:List*", "ivs:Get*", "ivs:List*", "ivschat:Get*", "ivschat:List*", "kafka-cluster:Describe*", "kafka:Describe*", "kafka:Get*", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra-ranking:DescribeRescoreExecutionPlan", "kendra-ranking:List*", "kendra:Describe*", "kendra:List*", "kinesis:Describe*", "kinesis:List*", "kinesisanalytics:DescribeApplication", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kinesisvideo:List*", "lakeformation:Describe*", "lakeformation:GetLFTag", "lakeformation:List*", "lambda:GetFunctionConcurrency", "launchwizard:GetDeployment", "launchwizard:List*", "lex:Describe*", "lex:GetBotAlias", "lex:List*", "license-manager:Get*", "license-manager:List*", "logs:Describe*", "logs:Get*", "logs:List*", "lookoutequipment:DescribeInferenceScheduler", "lookoutequipment:ListInferenceSchedulers", "lookoutvision:DescribeProject", "lookoutvision:ListProjects", "m2:Get*", "m2:List*", "macie2:Get*", "macie2:List*", "managedblockchain:GetAccessor", "managedblockchain:ListAccessors", "mediaconnect:Describe*", "mediaconnect:Get*", "mediaconnect:List*", "medialive:Describe*", "medialive:Get*", "medialive:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:Get*", "mediapackagev2:List*", "mediatailor:Describe*", "mediatailor:GetPlaybackConfiguration", "mediatailor:List*", "medical-imaging:GetDatastore", "medical-imaging:List*", "mobiletargeting:Get*", "mobiletargeting:List*", "mpa:Get*", "mpa:List*", "mq:Describe*", "mq:List*", "network-firewall:Describe*", "network-firewall:List*", "networkmanager:Describe*", "networkmanager:Get*", "networkmanager:List*", "nimble:GetStudio", "nimble:ListStudios", "notifications-contacts:GetEmailContact", "notifications-contacts:List*", "notifications:Get*", "notifications:List*", "nova-act:GetWorkflowDefinition", "nova-act:ListWorkflowDefinitions", "oam:Get*", "oam:List*", "observabilityadmin:Get*", "observabilityadmin:List*", "odb:Get*", "odb:List*", "omics:Get*", "omics:List*", "organizations:Describe*", "organizations:List*", "osis:Get*", "osis:List*", "panorama:Describe*", "panorama:List*", "payment-cryptography:Get*", "payment-cryptography:List*", "pca-connector-ad:Get*", "pca-connector-ad:List*", "pca-connector-scep:Get*", "pca-connector-scep:List*", "pcs:Get*", "pcs:List*", "personalize:Describe*", "personalize:List*", "pipes:DescribePipe", "pipes:ListPipes", "profile:Get*", "profile:List*", "proton:Get*", "proton:List*", "qbusiness:Get*", "qbusiness:List*", "quicksight:Describe*", "quicksight:List*", "ram:Get*", "ram:List*", "rbin:GetRule", "rbin:List*", "refactor-spaces:Get*", "refactor-spaces:List*", "rekognition:Describe*", "rekognition:List*", "resiliencehub:Describe*", "resiliencehub:Get*", "resiliencehub:List*", "resource-explorer-2:Get*", "resource-explorer-2:List*", "resource-groups:Get*", "resource-groups:List*", "robomaker:Describe*", "robomaker:List*", "rolesanywhere:Get*", "rolesanywhere:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "route53:Get*", "route53:List*", "route53profiles:Get*", "route53profiles:List*", "route53resolver:Get*", "route53resolver:List*", "rtbfabric:Get*", "rtbfabric:List*", "rum:BatchGetRumMetricDefinitions", "rum:Get*", "rum:List*", "sagemaker:Describe*", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:List*", "sagemaker:ListMonitoringSchedules", "scheduler:Get*", "scheduler:List*", "schemas:Describe*", "schemas:List*", "securitylake:Get*", "securitylake:List*", "servicecatalog:Describe*", "servicecatalog:Get*", "servicecatalog:List*", "ses:Describe*", "ses:Get*", "ses:List*", "shield:Describe*", "shield:List*", "signer:Get*", "signer:List*", "simspaceweaver:DescribeSimulation", "simspaceweaver:ListSimulations", "sms-voice:Describe*", "sms-voice:Get*", "sms-voice:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:List*", "ssm-contacts:Get*", "ssm-contacts:List*", "ssm-guiconnect:Get*", "ssm-incidents:Get*", "ssm-incidents:List*", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:ListConfigurationManagers", "ssm-sap:GetApplication", "ssm-sap:List*", "sso:Describe*", "sso:Get*", "sso:List*", "states:Describe*", "states:List*", "supportapp:Get*", "supportapp:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "tag:GetResources", "thinclient:GetEnvironment", "thinclient:List*", "transfer:Describe*", "transfer:List*", "trustedadvisor:GetRecommendation", "trustedadvisor:ListChecks", "trustedadvisor:ListRecommendationResources", "trustedadvisor:ListRecommendations", "trustedadvisor:ListRecommendationsForResource", "verifiedpermissions:Get*", "verifiedpermissions:List*", "voiceid:DescribeDomain", "voiceid:List*", "vpc-lattice:Get*", "vpc-lattice:List*", "wafv2:Get*", "wafv2:List*", "wisdom:Get*", "wisdom:List*", "workspaces-instances:Get*", "workspaces-instances:List*", "workspaces-web:Get*", "workspaces-web:List*", "workspaces:Describe*", "xray:Get*", "xray:List*" ], "Resource" : "*" }, { "Sid" : "CloudControlDiscoveryCompactExact", "Effect" : "Allow", "Action" : [ "aoss:BatchGetCollection", "aoss:BatchGetCollectionGroup", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:ListAccessPolicies", "aoss:ListCollectionGroups", "aoss:ListCollections", "aoss:ListLifecyclePolicies", "aoss:ListSecurityConfigs", "aoss:ListSecurityPolicies", "aoss:ListTagsForResource", "aoss:ListVpcEndpoints", "appsync:GetApi", "appsync:GetChannelNamespace", "appsync:GetDataSource", "appsync:GetDomainName", "appsync:GetGraphqlApi", "appsync:GetSourceApiAssociation", "appsync:ListApis", "appsync:ListChannelNamespaces", "appsync:ListDataSources", "appsync:ListDomainNames", "appsync:ListFunctions", "appsync:ListGraphqlApis", "appsync:ListResolvers", "appsync:ListSourceApiAssociations", "appsync:ListTagsForResource", "cases:BatchGetCaseRule", "cases:BatchGetField", "cases:GetDomain", "cases:GetLayout", "cases:GetTemplate", "cases:ListCaseRules", "cases:ListDomains", "cases:ListFields", "cases:ListLayouts", "cases:ListTemplates", "cloudformation:BatchDescribeTypeConfigurations", "cloudformation:DescribePublisher", "cloudformation:DescribeStackInstance", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeType", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:ListStackInstances", "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudformation:ListTypes", "cloudformation:ListTypeVersions", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeTerms", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:GetGroup", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListTerms", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "connect:DescribeAgentStatus", "connect:DescribeContactFlow", "connect:DescribeContactFlowModule", "connect:DescribeContactFlowModuleAlias", "connect:DescribeDataTable", "connect:DescribeEvaluationForm", "connect:DescribeHoursOfOperation", "connect:DescribeInstance", "connect:DescribeInstanceStorageConfig", "connect:DescribeNotification", "connect:DescribePhoneNumber", "connect:DescribePredefinedAttribute", "connect:DescribePrompt", "connect:DescribeQueue", "connect:DescribeQuickConnect", "connect:DescribeRoutingProfile", "connect:DescribeRule", "connect:DescribeSecurityProfile", "connect:DescribeTrafficDistributionGroup", "connect:DescribeUserHierarchyGroup", "connect:DescribeView", "connect:DescribeWorkspace", "connect:GetTaskTemplate", "connect:ListAgentStatuses", "connect:ListApprovedOrigins", "connect:ListBots", "connect:ListContactFlowModuleAliases", "connect:ListContactFlowModules", "connect:ListContactFlowModuleVersions", "connect:ListContactFlows", "connect:ListContactFlowVersions", "connect:ListDataTableAttributes", "connect:ListDataTables", "connect:ListEvaluationForms", "connect:ListEvaluationFormVersions", "connect:ListHoursOfOperationOverrides", "connect:ListHoursOfOperations", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListInstanceStorageConfigs", "connect:ListIntegrationAssociations", "connect:ListLambdaFunctions", "connect:ListNotifications", "connect:ListPredefinedAttributes", "connect:ListPrompts", "connect:ListQueueEmailAddresses", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", "connect:ListRoutingProfileManualAssignmentQueues", "connect:ListRoutingProfileQueues", "connect:ListRoutingProfiles", "connect:ListRules", "connect:ListSecurityKeys", "connect:ListSecurityProfileApplications", "connect:ListSecurityProfileFlowModules", "connect:ListSecurityProfilePermissions", "connect:ListSecurityProfiles", "connect:ListTagsForResource", "connect:ListTaskTemplates", "connect:ListTrafficDistributionGroups", "connect:ListUserHierarchyGroups", "connect:ListUserProficiencies", "connect:ListUsers", "connect:ListViews", "connect:ListViewVersions", "connect:ListWorkspaceMedia", "connect:ListWorkspacePages", "connect:ListWorkspaces", "connect:SearchWorkspaceAssociations", "datazone:GetDataSource", "datazone:GetDomain", "datazone:GetDomainUnit", "datazone:GetEnvironment", "datazone:GetEnvironmentAction", "datazone:GetEnvironmentBlueprintConfiguration", "datazone:GetEnvironmentProfile", "datazone:GetGroupProfile", "datazone:GetProject", "datazone:GetProjectProfile", "datazone:GetSubscriptionTarget", "datazone:GetUserProfile", "datazone:ListConnections", "datazone:ListDataSources", "datazone:ListDomains", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", "datazone:ListEnvironmentBlueprintConfigurations", "datazone:ListEnvironmentProfiles", "datazone:ListEnvironments", "datazone:ListPolicyGrants", "datazone:ListProjectMemberships", "datazone:ListProjectProfiles", "datazone:ListProjects", "datazone:ListSubscriptionTargets", "datazone:SearchGroupProfiles", "datazone:SearchUserProfiles", "docdb-elastic:GetCluster", "docdb-elastic:ListClusters", "docdb-elastic:ListTagsForResource", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:GetResourcePolicy", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeAwsNetworkPerformanceMetricSubscriptions", "ec2:DescribeCapacityManagerDataExports", "ec2:DescribeCapacityReservationFleets", "ec2:DescribeCapacityReservations", "ec2:DescribeCarrierGateways", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeFleets", "ec2:DescribeFlowLogs", "ec2:DescribeHosts", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceConnectEndpoints", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstances", "ec2:DescribeInstanceSqlHaStates", "ec2:DescribeInternetGateways", "ec2:DescribeIpamPools", "ec2:DescribeIpamPrefixListResolvers", "ec2:DescribeIpamPrefixListResolverTargets", "ec2:DescribeIpamResourceDiscoveries", "ec2:DescribeIpamResourceDiscoveryAssociations", "ec2:DescribeIpams", "ec2:DescribeIpamScopes", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInsightsAccessScopeAnalyses", "ec2:DescribeNetworkInsightsAccessScopes", "ec2:DescribeNetworkInsightsPaths", "ec2:DescribeNetworkInterfaces", "ec2:DescribePlacementGroups", "ec2:DescribeRouteServerEndpoints", "ec2:DescribeRouteServerPeers", "ec2:DescribeRouteServers", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSecurityGroupVpcAssociations", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeTrafficMirrorFilterRules", "ec2:DescribeTrafficMirrorFilters", "ec2:DescribeTrafficMirrorSessions", "ec2:DescribeTrafficMirrorTargets", "ec2:DescribeTransitGatewayConnectPeers", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayMeteringPolicies", "ec2:DescribeTransitGatewayMulticastDomains", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGateways", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeVerifiedAccessEndpoints", "ec2:DescribeVerifiedAccessGroups", "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations", "ec2:DescribeVerifiedAccessInstances", "ec2:DescribeVerifiedAccessTrustProviders", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcBlockPublicAccessExclusions", "ec2:DescribeVpcEncryptionControls", "ec2:DescribeVpcEndpointAssociations", "ec2:DescribeVpcEndpointConnectionNotifications", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConcentrators", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetAssociatedEnclaveCertificateIamRoles", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetIpamPrefixListResolverRules", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetRouteServerAssociations", "ec2:GetRouteServerPropagations", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetTransitGatewayMeteringPolicyEntries", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:GetVerifiedAccessEndpointPolicy", "ec2:GetVerifiedAccessGroupPolicy", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayMulticastGroups", "ec2:SearchTransitGatewayRoutes", "elasticache:DescribeCacheClusters", "elasticache:DescribeCacheParameterGroups", "elasticache:DescribeCacheParameters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeGlobalReplicationGroups", "elasticache:DescribeReplicationGroups", "elasticache:DescribeServerlessCaches", "elasticache:DescribeUserGroups", "elasticache:DescribeUsers", "elasticache:ListTagsForResource", "es:GetApplication", "es:ListApplications", "es:ListTags", "frauddetector:BatchGetVariable", "frauddetector:DescribeDetector", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetListsMetadata", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:ListTagsForResource", "glue:DescribeIntegrations", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetCrawler", "glue:GetDatabase", "glue:GetDatabases", "glue:GetIntegrationResourceProperty", "glue:GetJob", "glue:GetRegistry", "glue:GetSchema", "glue:GetSchemaVersion", "glue:GetTags", "glue:GetTrigger", "glue:GetUsageProfile", "glue:ListCrawlers", "glue:ListIntegrationResourceProperties", "glue:ListJobs", "glue:ListRegistries", "glue:ListSchemas", "glue:ListSchemaVersions", "glue:ListTriggers", "glue:ListUsageProfiles", "identitystore:DescribeGroup", "identitystore:ListGroupMemberships", "identitystore:ListGroupMembershipsForMember", "identitystore:ListGroups", "kms:DescribeCustomKeyStores", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:GetParametersForImport", "kms:GetPublicKey", "kms:ListAliases", "kms:ListGrants", "kms:ListKeyPolicies", "kms:ListKeyRotations", "kms:ListKeys", "kms:ListResourceTags", "kms:ListRetirableGrants", "lambda:GetAlias", "lambda:GetCapacityProvider", "lambda:GetCodeSigningConfig", "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetFunctionRecursionConfig", "lambda:GetFunctionScalingConfig", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetRuntimeManagementConfig", "lambda:ListAliases", "lambda:ListCapacityProviders", "lambda:ListCodeSigningConfigs", "lambda:ListEventSourceMappings", "lambda:ListFunctionEventInvokeConfigs", "lambda:ListFunctions", "lambda:ListFunctionUrlConfigs", "lambda:ListLayerVersions", "lambda:ListTags", "lambda:ListVersionsByFunction", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetDiskSnapshot", "lightsail:GetDiskSnapshots", "lightsail:GetDistributions", "lightsail:GetDomain", "lightsail:GetDomains", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetInstanceSnapshot", "lightsail:GetInstanceSnapshots", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetRelationalDatabase", "lightsail:GetRelationalDatabases", "lightsail:GetRelationalDatabaseSnapshot", "lightsail:GetRelationalDatabaseSnapshots", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "memorydb:DescribeACLs", "memorydb:DescribeClusters", "memorydb:DescribeMultiRegionClusters", "memorydb:DescribeParameterGroups", "memorydb:DescribeSubnetGroups", "memorydb:DescribeUsers", "memorydb:ListTags", "neptune-graph:GetGraph", "neptune-graph:GetGraphSnapshot", "neptune-graph:GetPrivateGraphEndpoint", "neptune-graph:ListGraphs", "neptune-graph:ListGraphSnapshots", "neptune-graph:ListPrivateGraphEndpoints", "neptune-graph:ListTagsForResource", "qldb:DescribeJournalKinesisStream", "qldb:ListJournalKinesisStreamsForLedger", "qldb:ListTagsForResource", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargetGroups", "rds:DescribeDBProxyTargets", "rds:DescribeDBShardGroups", "rds:DescribeDBSubnetGroups", "rds:DescribeEngineDefaultParameters", "rds:DescribeEventSubscriptions", "rds:DescribeGlobalClusters", "rds:DescribeIntegrations", "rds:DescribeOptionGroups", "rds:ListTagsForResource", "redshift-serverless:GetNamespace", "redshift-serverless:GetSnapshot", "redshift-serverless:GetWorkgroup", "redshift-serverless:ListNamespaces", "redshift-serverless:ListSnapshotCopyConfigurations", "redshift-serverless:ListSnapshots", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusterDbRevisions", "redshift:DescribeClusterParameterGroups", "redshift:DescribeClusterParameters", "redshift:DescribeClusters", "redshift:DescribeClusterSubnetGroups", "redshift:DescribeEndpointAccess", "redshift:DescribeEndpointAuthorization", "redshift:DescribeEventSubscriptions", "redshift:DescribeIntegrations", "redshift:DescribeLoggingStatus", "redshift:DescribeScheduledActions", "redshift:DescribeTags", "redshift:GetResourcePolicy", "route53globalresolver:GetAccessSource", "route53globalresolver:GetDNSView", "route53globalresolver:GetFirewallDomainList", "route53globalresolver:GetFirewallRule", "route53globalresolver:GetGlobalResolver", "route53globalresolver:GetHostedZoneAssociation", "route53globalresolver:ListAccessSources", "route53globalresolver:ListAccessTokens", "route53globalresolver:ListDNSViews", "route53globalresolver:ListFirewallDomainLists", "route53globalresolver:ListFirewallRules", "route53globalresolver:ListGlobalResolvers", "route53globalresolver:ListHostedZoneAssociations", "route53globalresolver:ListTagsForResource", "s3-outposts:GetAccessPoint", "s3-outposts:GetAccessPointPolicy", "s3-outposts:GetBucket", "s3-outposts:GetBucketTagging", "s3-outposts:GetLifecycleConfiguration", "s3-outposts:ListAccessPoints", "s3-outposts:ListEndpoints", "s3-outposts:ListRegionalBuckets", "s3:GetAccelerateConfiguration", "s3:GetAccessGrant", "s3:GetAccessGrantsInstance", "s3:GetAccessGrantsLocation", "s3:GetAccessPoint", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetAnalyticsConfiguration", "s3:GetBucketAbac", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketMetadataTableConfiguration", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetIntelligentTieringConfiguration", "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMetricsConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetObjectAcl", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAccessGrants", "s3:ListAccessGrantsInstances", "s3:ListAccessGrantsLocations", "s3:ListAccessPoints", "s3:ListAccessPointsForObjectLambda", "s3:ListAllMyBuckets", "s3:ListMultiRegionAccessPoints", "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3:ListTagsForResource", "s3express:GetAccessPoint", "s3express:GetAccessPointPolicy", "s3express:GetAccessPointScope", "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:GetInventoryConfiguration", "s3express:GetLifecycleConfiguration", "s3express:GetMetricsConfiguration", "s3express:ListAccessPointsForDirectoryBuckets", "s3express:ListAllMyDirectoryBuckets", "s3express:ListTagsForResource", "s3files:GetAccessPoint", "s3files:GetFileSystem", "s3files:GetFileSystemPolicy", "s3files:GetMountTarget", "s3files:GetSynchronizationConfiguration", "s3files:ListAccessPoints", "s3files:ListFileSystems", "s3files:ListMountTargets", "s3files:ListTagsForResource", "s3tables:GetNamespace", "s3tables:GetTable", "s3tables:GetTableBucket", "s3tables:GetTableBucketEncryption", "s3tables:GetTableBucketMaintenanceConfiguration", "s3tables:GetTableBucketMetricsConfiguration", "s3tables:GetTableBucketPolicy", "s3tables:GetTableBucketReplication", "s3tables:GetTableBucketStorageClass", "s3tables:GetTableMaintenanceConfiguration", "s3tables:GetTablePolicy", "s3tables:GetTableStorageClass", "s3tables:ListNamespaces", "s3tables:ListTableBuckets", "s3tables:ListTables", "s3tables:ListTagsForResource", "s3vectors:GetIndex", "s3vectors:GetVectorBucket", "s3vectors:GetVectorBucketPolicy", "s3vectors:ListIndexes", "s3vectors:ListTagsForResource", "s3vectors:ListVectorBuckets", "secretsmanager:DescribeSecret", "secretsmanager:GetResourcePolicy", "secretsmanager:ListSecrets", "securityagent:BatchGetAgentSpaces", "securityagent:BatchGetPentests", "securityagent:BatchGetTargetDomains", "securityagent:GetApplication", "securityagent:ListAgentSpaces", "securityagent:ListApplications", "securityagent:ListIntegratedResources", "securityagent:ListPentests", "securityagent:ListTagsForResource", "securityagent:ListTargetDomains", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetSecurityControls", "securityhub:DescribeHub", "securityhub:DescribeOrganizationConfiguration", "securityhub:DescribeSecurityHubV2", "securityhub:DescribeStandardsControls", "securityhub:GetAggregatorV2", "securityhub:GetAutomationRuleV2", "securityhub:GetConfigurationPolicy", "securityhub:GetConfigurationPolicyAssociation", "securityhub:GetConnectorV2", "securityhub:GetEnabledStandards", "securityhub:GetFindingAggregator", "securityhub:GetInsights", "securityhub:ListAggregatorsV2", "securityhub:ListAutomationRules", "securityhub:ListAutomationRulesV2", "securityhub:ListConfigurationPolicies", "securityhub:ListConfigurationPolicyAssociations", "securityhub:ListConnectorsV2", "securityhub:ListEnabledProductsForImport", "securityhub:ListFindingAggregators", "securityhub:ListOrganizationAdminAccounts", "securityhub:ListSecurityControlDefinitions", "securityhub:ListTagsForResource", "ssm:DescribeAssociation", "ssm:DescribeDocument", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTargets", "ssm:DescribeMaintenanceWindowTasks", "ssm:DescribeParameters", "ssm:DescribePatchBaselines", "ssm:GetDefaultPatchBaseline", "ssm:GetDocument", "ssm:GetMaintenanceWindow", "ssm:GetMaintenanceWindowTask", "ssm:GetPatchBaseline", "ssm:GetResourcePolicies", "ssm:ListAssociations", "ssm:ListDocuments", "ssm:ListResourceDataSync", "ssm:ListTagsForResource", "sso-directory:DescribeGroup", "sso-directory:SearchGroups", "sts:GetCallerIdentity", "timestream-influxdb:GetDbCluster", "timestream-influxdb:GetDbInstance", "timestream-influxdb:ListDbClusters", "timestream-influxdb:ListDbInstances", "timestream-influxdb:ListTagsForResource", "timestream:DescribeDatabase", "timestream:DescribeEndpoints", "timestream:DescribeScheduledQuery", "timestream:DescribeTable", "timestream:ListDatabases", "timestream:ListScheduledQueries", "timestream:ListTables", "timestream:ListTagsForResource" ], "Resource" : "*" } ] } ``` ## Learn more + [Create a permission set using AWS managed policies in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [Understand versioning for IAM policies](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)