AWS IAM Permissions Reference¶
AccuKnox's AWS scanner uses 403 read-only IAM permissions (List, Describe, and Get only) to inventory your resources and check their configuration. No write, delete, or data-download access, and it never reads object contents.
See the overview to compare clouds, or the AWS prerequisites for setup steps.
Reading this reference
Permissions are grouped by service; ones that serve the same purpose share a row. Hover (or tap) the ⓘ badge to see why AccuKnox needs each one.
IAM Access Analyzer (4)¶
| Permission | What it does |
|---|---|
access-analyzer:GetAnalyzer |
Read details of a specific IAM Access Analyzer resource in your account. Why |
access-analyzer:GetFinding |
Read details of a specific IAM Access Analyzer finding (external access or unused access). Why |
access-analyzer:ListAnalyzers |
List IAM Access Analyzer resources or findings in your account. Why |
access-analyzer:ListFindings |
List IAM Access Analyzer resources or findings in your account. Why |
ACM Private Certificate Authority (3)¶
| Permission | What it does |
|---|---|
acm-pca:DescribeCertificateAuthority |
Read-only permission to view configuration details for ACM Private Certificate Authority resources in your AWS account. Why |
acm-pca:ListCertificateAuthorities acm-pca:ListTags |
Read-only permission to list ACM Private Certificate Authority resources in your AWS account. Why |
AWS Certificate Manager (ACM) (4)¶
| Permission | What it does |
|---|---|
acm:DescribeCertificate |
Read-only permission to view configuration details for AWS Certificate Manager (ACM) resources in your AWS account. Why |
acm:GetCertificate |
Read-only permission to read settings and metadata for AWS Certificate Manager (ACM) resources in your AWS account. Why |
acm:ListCertificates acm:ListTagsForCertificate |
Read-only permission to list AWS Certificate Manager (ACM) resources in your AWS account. Why |
Amazon Managed Workflows for Apache Airflow (MWAA) (2)¶
| Permission | What it does |
|---|---|
airflow:GetEnvironment |
Read-only permission to read settings and metadata for Amazon Managed Workflows for Apache Airflow (MWAA) resources in your AWS account. Why |
airflow:ListEnvironments |
Read-only permission to list Amazon Managed Workflows for Apache Airflow (MWAA) resources in your AWS account. Why |
AWS Amplify (2)¶
| Permission | What it does |
|---|---|
amplify:GetApp |
Read-only permission to read settings and metadata for AWS Amplify resources in your AWS account. Why |
amplify:ListApps |
Read-only permission to list AWS Amplify resources in your AWS account. Why |
Amazon OpenSearch Serverless (3)¶
| Permission | What it does |
|---|---|
aoss:GetSecurityPolicy |
Read-only permission to read settings and metadata for Amazon OpenSearch Serverless resources in your AWS account. Why |
aoss:ListCollections |
Read-only permission to list Amazon OpenSearch Serverless resources in your AWS account. Why |
aoss:ListSecurityPolicies |
Read-only permission to list Amazon OpenSearch Serverless resources in your AWS account. Why |
Amazon API Gateway (1)¶
| Permission | What it does |
|---|---|
apigateway:GET |
Read-only access to read configuration for Amazon API Gateway resources (APIs, stages, methods, and related settings). Why |
AWS AppConfig (2)¶
| Permission | What it does |
|---|---|
appconfig:ListApplications appconfig:ListConfigurationProfiles |
Read-only permission to list AWS AppConfig resources in your AWS account. Why |
Amazon AppFlow (1)¶
| Permission | What it does |
|---|---|
appflow:ListFlows |
Read-only permission to list Amazon AppFlow resources in your AWS account. Why |
AWS App Mesh (4)¶
| Permission | What it does |
|---|---|
appmesh:DescribeMesh appmesh:DescribeVirtualGateway |
Read-only permission to view configuration details for AWS App Mesh resources in your AWS account. Why |
appmesh:ListMeshes appmesh:ListVirtualGateways |
Read-only permission to list AWS App Mesh resources in your AWS account. Why |
AWS App Runner (1)¶
| Permission | What it does |
|---|---|
apprunner:ListServices |
Read-only permission to list AWS App Runner resources in your AWS account. Why |
Amazon Athena (2)¶
| Permission | What it does |
|---|---|
athena:GetWorkGroup |
Read-only permission to read settings and metadata for Amazon Athena resources in your AWS account. Why |
athena:ListWorkGroups |
Read-only permission to list Amazon Athena resources in your AWS account. Why |
AWS Audit Manager (9)¶
| Permission | What it does |
|---|---|
auditmanager:GetAssessment |
Read-only permission to read settings and metadata for AWS Audit Manager resources in your AWS account. Why |
auditmanager:GetAssessmentFramework |
Read-only permission to read settings and metadata for AWS Audit Manager resources in your AWS account. Why |
auditmanager:GetEvidence auditmanager:GetEvidenceByEvidenceFolder |
Read-only permission to read settings and metadata for AWS Audit Manager resources in your AWS account. Why |
auditmanager:GetEvidenceFolder auditmanager:GetEvidenceFoldersByAssessment |
Read-only permission to read settings and metadata for AWS Audit Manager resources in your AWS account. Why |
auditmanager:GetSettings |
Read-only permission to read settings and metadata for AWS Audit Manager resources in your AWS account. Why |
auditmanager:ListAssessmentFrameworks |
Read-only permission to list AWS Audit Manager resources in your AWS account. Why |
auditmanager:ListAssessments |
Read-only permission to list AWS Audit Manager resources in your AWS account. Why |
Amazon EC2 Auto Scaling (3)¶
| Permission | What it does |
|---|---|
autoscaling:DescribeAutoScalingGroups autoscaling:DescribeNotificationConfigurations |
Read-only permission to view configuration details for Amazon EC2 Auto Scaling resources in your AWS account. Why |
autoscaling:DescribeLaunchConfigurations |
Read-only permission to view configuration details for Amazon EC2 Auto Scaling resources in your AWS account. Why |
AWS Backup (14)¶
| Permission | What it does |
|---|---|
backup:DescribeBackupJob |
Read-only permission to view configuration details for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:DescribeBackupVault |
Read-only permission to view configuration details for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:DescribeRecoveryPoint |
Read-only permission to view configuration details for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:DescribeRegionSettings |
Read-only permission to view configuration details for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:GetBackupPlan |
Read-only permission to read settings and metadata for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:GetBackupSelection |
Read-only permission to read settings and metadata for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:GetBackupVaultAccessPolicy backup:GetBackupVaultNotifications |
Read-only permission to read settings and metadata for AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListBackupJobs |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListBackupPlans |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListBackupSelections |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListBackupVaults |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListRecoveryPointsByBackupVault |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
backup:ListTags |
Read-only permission to list AWS Backup vaults, plans, and jobs in your AWS account. Why |
Amazon Bedrock (5)¶
| Permission | What it does |
|---|---|
bedrock:GetCustomModel bedrock:GetModelCustomizationJob bedrock:GetModelInvocationLoggingConfiguration |
Read-only permission to read settings and metadata for Amazon Bedrock resources in your AWS account. Why |
bedrock:ListCustomModels bedrock:ListModelCustomizationJobs |
Read-only permission to list Amazon Bedrock resources in your AWS account. Why |
AWS CloudFormation (9)¶
| Permission | What it does |
|---|---|
cloudformation:DescribeStackEvents |
Read-only permission to view configuration details for AWS CloudFormation resources in your AWS account. Why |
cloudformation:DescribeStackResource |
Read-only permission to view configuration details for AWS CloudFormation resources in your AWS account. Why |
cloudformation:DescribeStackResources cloudformation:DescribeStacks |
Read-only permission to view configuration details for AWS CloudFormation resources in your AWS account. Why |
cloudformation:DescribeStackSet |
Read-only permission to view configuration details for AWS CloudFormation resources in your AWS account. Why |
cloudformation:GetTemplate |
Read-only permission to read settings and metadata for AWS CloudFormation resources in your AWS account. Why |
cloudformation:ListStackResources |
Read-only permission to list AWS CloudFormation resources in your AWS account. Why |
cloudformation:ListStackSets |
Read-only permission to list AWS CloudFormation resources in your AWS account. Why |
cloudformation:ListStacks |
Read-only permission to list AWS CloudFormation resources in your AWS account. Why |
Amazon CloudFront (9)¶
| Permission | What it does |
|---|---|
cloudfront:DescribeFunction |
Read-only permission to view configuration details for Amazon CloudFront resources in your AWS account. Why |
cloudfront:GetCachePolicy |
Read-only permission to read settings and metadata for Amazon CloudFront resources in your AWS account. Why |
cloudfront:GetDistribution |
Read-only permission to read settings and metadata for Amazon CloudFront resources in your AWS account. Why |
cloudfront:GetDistributionConfig |
Read-only permission to read settings and metadata for Amazon CloudFront resources in your AWS account. Why |
cloudfront:GetFunction |
Read-only permission to read settings and metadata for Amazon CloudFront resources in your AWS account. Why |
cloudfront:ListCachePolicies |
Read-only permission to list Amazon CloudFront resources in your AWS account. Why |
cloudfront:ListDistributions cloudfront:ListTagsForResource |
Read-only permission to list Amazon CloudFront resources in your AWS account. Why |
cloudfront:ListFunctions |
Read-only permission to list Amazon CloudFront resources in your AWS account. Why |
AWS CloudTrail (7)¶
| Permission | What it does |
|---|---|
cloudtrail:DescribeTrails |
Read-only permission to view configuration details for CloudTrail trails and logging settings in your AWS account. Why |
cloudtrail:GetChannel |
Read-only permission to read settings and metadata for CloudTrail trails and logging settings in your AWS account. Why |
cloudtrail:GetEventSelectors cloudtrail:GetInsightSelectors cloudtrail:GetTrailStatus |
Read-only permission to read settings and metadata for CloudTrail trails and logging settings in your AWS account. Why |
cloudtrail:ListChannels |
Read-only permission to list CloudTrail trails and logging settings in your AWS account. Why |
cloudtrail:ListTags |
Read-only permission to list CloudTrail trails and logging settings in your AWS account. Why |
Amazon CloudWatch (3)¶
| Permission | What it does |
|---|---|
cloudwatch:DescribeAlarms |
Read-only permission to view configuration details for CloudWatch alarms and metrics in your AWS account. Why |
cloudwatch:GetMetricStatistics |
Read-only permission to read settings and metadata for CloudWatch alarms and metrics in your AWS account. Why |
cloudwatch:ListTagsForResource |
Read-only permission to list CloudWatch alarms and metrics in your AWS account. Why |
AWS CodeArtifact (8)¶
| Permission | What it does |
|---|---|
codeartifact:DescribeDomain |
Read-only permission to view configuration details for AWS CodeArtifact resources in your AWS account. Why |
codeartifact:DescribeRepository |
Read-only permission to view configuration details for AWS CodeArtifact resources in your AWS account. Why |
codeartifact:GetDomainPermissionsPolicy |
Read-only permission to read settings and metadata for AWS CodeArtifact resources in your AWS account. Why |
codeartifact:GetRepositoryEndpoint codeartifact:GetRepositoryPermissionsPolicy |
Read-only permission to read settings and metadata for AWS CodeArtifact resources in your AWS account. Why |
codeartifact:ListDomains |
Read-only permission to list AWS CodeArtifact resources in your AWS account. Why |
codeartifact:ListRepositories |
Read-only permission to list AWS CodeArtifact resources in your AWS account. Why |
codeartifact:ListTagsForResource |
Read-only permission to list AWS CodeArtifact resources in your AWS account. Why |
AWS CodeBuild (2)¶
| Permission | What it does |
|---|---|
codebuild:BatchGetProjects |
Read-only permission to read details for AWS CodeBuild resources in your AWS account. Why |
codebuild:ListProjects |
Read-only permission to list AWS CodeBuild resources in your AWS account. Why |
AWS CodeDeploy (2)¶
| Permission | What it does |
|---|---|
codedeploy:GetDeploymentConfig |
Read-only permission to read settings and metadata for AWS CodeDeploy resources in your AWS account. Why |
codedeploy:ListDeploymentConfigs |
Read-only permission to list AWS CodeDeploy resources in your AWS account. Why |
AWS CodePipeline (3)¶
| Permission | What it does |
|---|---|
codepipeline:GetPipeline |
Read-only permission to read settings and metadata for AWS CodePipeline resources in your AWS account. Why |
codepipeline:ListPipelines codepipeline:ListTagsForResource |
Read-only permission to list AWS CodePipeline resources in your AWS account. Why |
Amazon Cognito Identity Pools (2)¶
| Permission | What it does |
|---|---|
cognito-identity:DescribeIdentityPool |
Read-only permission to view configuration details for Amazon Cognito Identity Pools resources in your AWS account. Why |
cognito-identity:ListIdentityPools |
Read-only permission to list Amazon Cognito Identity Pools resources in your AWS account. Why |
Amazon Cognito User Pools (2)¶
| Permission | What it does |
|---|---|
cognito-idp:DescribeUserPool |
Read-only permission to view configuration details for Amazon Cognito User Pools resources in your AWS account. Why |
cognito-idp:ListUserPools |
Read-only permission to list Amazon Cognito User Pools resources in your AWS account. Why |
Amazon Comprehend (2)¶
| Permission | What it does |
|---|---|
comprehend:ListFlywheels |
Read-only permission to list Amazon Comprehend resources in your AWS account. Why |
comprehend:ListSentimentDetectionJobs |
List Amazon Comprehend sentiment analysis jobs in your account. Why |
AWS Compute Optimizer (1)¶
| Permission | What it does |
|---|---|
compute-optimizer:GetRecommendationSummaries |
Read-only permission to read settings and metadata for AWS Compute Optimizer resources in your AWS account. Why |
AWS Config (6)¶
| Permission | What it does |
|---|---|
config:DescribeConfigRules config:DescribeDeliveryChannels |
Read-only permission to view configuration details for AWS Config rules and recorders in your AWS account. Why |
config:DescribeConfigurationRecorderStatus config:DescribeConfigurationRecorders |
Read-only permission to view configuration details for AWS Config rules and recorders in your AWS account. Why |
config:GetComplianceDetailsByConfigRule config:GetDiscoveredResourceCounts |
Read-only permission to read settings and metadata for AWS Config rules and recorders in your AWS account. Why |
Amazon Connect (3)¶
| Permission | What it does |
|---|---|
connect:DescribeInstanceStorageConfig |
Read-only permission to view configuration details for Amazon Connect resources in your AWS account. Why |
connect:ListInstanceStorageConfigs |
Read-only permission to list Amazon Connect resources in your AWS account. Why |
connect:ListInstances |
Read-only permission to list Amazon Connect resources in your AWS account. Why |
AWS Glue DataBrew (1)¶
| Permission | What it does |
|---|---|
databrew:ListJobs |
Read-only permission to list AWS Glue DataBrew resources in your AWS account. Why |
Amazon DynamoDB Accelerator (DAX) (3)¶
| Permission | What it does |
|---|---|
dax:DescribeClusters |
Read-only permission to view configuration details for Amazon DynamoDB Accelerator (DAX) resources in your AWS account. Why |
dax:DescribeSubnetGroups |
Read-only permission to view configuration details for Amazon DynamoDB Accelerator (DAX) resources in your AWS account. Why |
dax:ListTags |
Read-only permission to list Amazon DynamoDB Accelerator (DAX) resources in your AWS account. Why |
Amazon DevOps Guru (1)¶
| Permission | What it does |
|---|---|
devops-guru:ListNotificationChannels |
Read-only permission to list Amazon DevOps Guru resources in your AWS account. Why |
Amazon Data Lifecycle Manager (2)¶
| Permission | What it does |
|---|---|
dlm:GetLifecyclePolicies dlm:GetLifecyclePolicy |
Read-only permission to read settings and metadata for Amazon Data Lifecycle Manager resources in your AWS account. Why |
AWS Database Migration Service (1)¶
| Permission | What it does |
|---|---|
dms:DescribeReplicationInstances |
Read-only permission to view configuration details for AWS Database Migration Service resources in your AWS account. Why |
Amazon DocumentDB (elastic clusters) (3)¶
| Permission | What it does |
|---|---|
docdb-elastic:GetCluster |
Read-only permission to read settings and metadata for Amazon DocumentDB (elastic clusters) resources in your AWS account. Why |
docdb-elastic:ListClusters |
Read-only permission to list Amazon DocumentDB (elastic clusters) resources in your AWS account. Why |
docdb-elastic:ListTagsForResource |
Read-only permission to list Amazon DocumentDB (elastic clusters) resources in your AWS account. Why |
Amazon DynamoDB (7)¶
| Permission | What it does |
|---|---|
dynamodb:DescribeBackup |
Read-only permission to view configuration details for DynamoDB tables in your AWS account. Why |
dynamodb:DescribeContinuousBackups dynamodb:DescribeKinesisStreamingDestination dynamodb:DescribeTable |
Read-only permission to view configuration details for DynamoDB tables in your AWS account. Why |
dynamodb:ListBackups |
Read-only permission to list DynamoDB tables in your AWS account. Why |
dynamodb:ListTables dynamodb:ListTagsOfResource |
Read-only permission to list DynamoDB tables in your AWS account. Why |
Amazon EC2 (39)¶
| Permission | What it does |
|---|---|
ec2:DescribeAccountAttributes ec2:DescribeEgressOnlyInternetGateways ec2:DescribeFlowLogs ec2:DescribeImages ec2:DescribeInternetGateways ec2:DescribeVpcEndpointServicePermissions ec2:DescribeVpcEndpointServices ec2:DescribeVpcEndpoints ec2:DescribeVpcPeeringConnections ec2:DescribeVpnConnections ec2:DescribeVpnGateways |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeAddresses |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeInstanceAttribute ec2:DescribeInstanceCreditSpecifications ec2:DescribeInstanceStatus ec2:DescribeInstances |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeInstanceTypeOfferings |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeKeyPairs |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeLaunchTemplateVersions |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeLaunchTemplates |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeManagedPrefixLists |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeNatGateways |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeNetworkAcls |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeNetworkInterfaces |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeRegions |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeReservedInstances ec2:DescribeReservedInstancesModifications |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeRouteTables |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeSecurityGroupRules |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeSecurityGroups |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeSnapshotAttribute ec2:DescribeSnapshots |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeSubnets |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeVolumeAttribute ec2:DescribeVolumes |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:DescribeVpcs |
Read-only permission to view configuration details for EC2 compute and networking resources in your AWS account. Why |
ec2:GetEbsDefaultKmsKeyId ec2:GetEbsEncryptionByDefault |
Read-only permission to read settings and metadata for EC2 compute and networking resources in your AWS account. Why |
ec2:GetLaunchTemplateData |
Read-only permission to read settings and metadata for EC2 compute and networking resources in your AWS account. Why |
Amazon ECR (container registry) (2)¶
| Permission | What it does |
|---|---|
ecr:DescribeRepositories |
Read-only permission to view configuration details for Amazon ECR (container registry) resources in your AWS account. Why |
ecr:GetRepositoryPolicy |
Read-only permission to read settings and metadata for Amazon ECR (container registry) resources in your AWS account. Why |
Amazon ECS (5)¶
| Permission | What it does |
|---|---|
ecs:DescribeClusters |
Read-only permission to view configuration details for ECS clusters and services in your AWS account. Why |
ecs:DescribeServices |
Read-only permission to view configuration details for ECS clusters and services in your AWS account. Why |
ecs:ListClusters ecs:ListTagsForResource |
Read-only permission to list ECS clusters and services in your AWS account. Why |
ecs:ListServices |
Read-only permission to list ECS clusters and services in your AWS account. Why |
Amazon EKS (2)¶
| Permission | What it does |
|---|---|
eks:DescribeCluster |
Read-only permission to view configuration details for EKS Kubernetes clusters in your AWS account. Why |
eks:ListClusters |
Read-only permission to list EKS Kubernetes clusters in your AWS account. Why |
Amazon ElastiCache (5)¶
| Permission | What it does |
|---|---|
elasticache:DescribeCacheClusters |
Read-only permission to view configuration details for Amazon ElastiCache resources in your AWS account. Why |
elasticache:DescribeCacheSubnetGroups elasticache:DescribeReplicationGroups elasticache:DescribeReservedCacheNodes |
Read-only permission to view configuration details for Amazon ElastiCache resources in your AWS account. Why |
elasticache:ListTagsForResource |
Read-only permission to list Amazon ElastiCache resources in your AWS account. Why |
Amazon EFS (1)¶
| Permission | What it does |
|---|---|
elasticfilesystem:DescribeFileSystems |
Read-only permission to view configuration details for Amazon EFS resources in your AWS account. Why |
Elastic Load Balancing (ALB/NLB/CLB) (9)¶
| Permission | What it does |
|---|---|
elasticloadbalancing:DescribeInstanceHealth elasticloadbalancing:DescribeListeners elasticloadbalancing:DescribeLoadBalancerPolicies elasticloadbalancing:DescribeTargetGroupAttributes |
Read-only permission to view configuration details for load balancers and target groups in your AWS account. Why |
elasticloadbalancing:DescribeLoadBalancerAttributes |
Read-only permission to view configuration details for load balancers and target groups in your AWS account. Why |
elasticloadbalancing:DescribeLoadBalancers |
Read-only permission to view configuration details for load balancers and target groups in your AWS account. Why |
elasticloadbalancing:DescribeTags |
Read-only permission to view configuration details for load balancers and target groups in your AWS account. Why |
elasticloadbalancing:DescribeTargetGroups elasticloadbalancing:DescribeTargetHealth |
Read-only permission to view configuration details for load balancers and target groups in your AWS account. Why |
Amazon EMR (4)¶
| Permission | What it does |
|---|---|
elasticmapreduce:DescribeCluster elasticmapreduce:DescribeSecurityConfiguration |
Read-only permission to view configuration details for Amazon EMR resources in your AWS account. Why |
elasticmapreduce:ListClusters elasticmapreduce:ListInstanceGroups |
Read-only permission to list Amazon EMR resources in your AWS account. Why |
Amazon OpenSearch Service (1)¶
| Permission | What it does |
|---|---|
es:ListDomainNames |
Read-only permission to list Amazon OpenSearch Service resources in your AWS account. Why |
Amazon EventBridge (2)¶
| Permission | What it does |
|---|---|
events:ListEventBuses events:ListRules |
Read-only permission to list Amazon EventBridge resources in your AWS account. Why |
Amazon FinSpace (1)¶
| Permission | What it does |
|---|---|
finspace:ListEnvironments |
Read-only permission to list Amazon FinSpace resources in your AWS account. Why |
Amazon Kinesis Data Firehose (2)¶
| Permission | What it does |
|---|---|
firehose:DescribeDeliveryStream |
Read-only permission to view configuration details for Amazon Kinesis Data Firehose resources in your AWS account. Why |
firehose:ListDeliveryStreams |
Read-only permission to list Amazon Kinesis Data Firehose resources in your AWS account. Why |
Amazon Forecast (2)¶
| Permission | What it does |
|---|---|
forecast:ListDatasets forecast:ListForecastExportJobs |
Read-only permission to list Amazon Forecast resources in your AWS account. Why |
Amazon Fraud Detector (1)¶
| Permission | What it does |
|---|---|
frauddetector:GetDetectors |
Read-only permission to read settings and metadata for Amazon Fraud Detector resources in your AWS account. Why |
Amazon FSx (1)¶
| Permission | What it does |
|---|---|
fsx:DescribeFileSystems |
Read-only permission to view configuration details for Amazon FSx resources in your AWS account. Why |
Amazon S3 Glacier (1)¶
| Permission | What it does |
|---|---|
glacier:ListVaults |
Read-only permission to list Amazon S3 Glacier resources in your AWS account. Why |
AWS Glue (2)¶
| Permission | What it does |
|---|---|
glue:GetDataCatalogEncryptionSettings glue:GetSecurityConfigurations |
Read-only permission to read settings and metadata for AWS Glue resources in your AWS account. Why |
Amazon GuardDuty (7)¶
| Permission | What it does |
|---|---|
guardduty:DescribePublishingDestination |
Read-only permission to view configuration details for GuardDuty threat detection settings in your AWS account. Why |
guardduty:GetDetector guardduty:GetFindings guardduty:GetMasterAccount |
Read-only permission to read settings and metadata for GuardDuty threat detection settings in your AWS account. Why |
guardduty:ListDetectors guardduty:ListFindings guardduty:ListPublishingDestinations |
Read-only permission to list GuardDuty threat detection settings in your AWS account. Why |
Amazon HealthLake (1)¶
| Permission | What it does |
|---|---|
healthlake:ListFHIRDatastores |
Read-only permission to list Amazon HealthLake resources in your AWS account. Why |
AWS IAM (31)¶
| Permission | What it does |
|---|---|
iam:GenerateCredentialReport |
Request generation of the IAM credential report (password age, access key rotation, MFA status). Why |
iam:GetAccountPasswordPolicy iam:GetAccountSummary iam:GetUserPolicy |
Read-only permission to read settings and metadata for IAM users, roles, groups, and policies in your AWS account. Why |
iam:GetCredentialReport |
Download the IAM credential report after it has been generated. Why |
iam:GetGroup iam:GetGroupPolicy |
Read-only permission to read settings and metadata for IAM users, roles, groups, and policies in your AWS account. Why |
iam:GetLoginProfile iam:GetUser |
Read-only permission to read settings and metadata for IAM users, roles, groups, and policies in your AWS account. Why |
iam:GetPolicy iam:GetPolicyVersion |
Read-only permission to read settings and metadata for IAM users, roles, groups, and policies in your AWS account. Why |
iam:GetRole iam:GetRolePolicy |
Read-only permission to read settings and metadata for IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListAccountAliases |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListAttachedGroupPolicies iam:ListGroupPolicies iam:ListGroups |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListAttachedRolePolicies iam:ListInstanceProfilesForRole iam:ListRolePolicies iam:ListRoles |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListAttachedUserPolicies iam:ListGroupsForUser iam:ListMFADevices iam:ListUserPolicies iam:ListUsers |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListEntitiesForPolicy |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListPolicies |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
iam:ListSSHPublicKeys iam:ListServerCertificates iam:ListVirtualMFADevices |
Read-only permission to list IAM users, roles, groups, and policies in your AWS account. Why |
EC2 Image Builder (5)¶
| Permission | What it does |
|---|---|
imagebuilder:ListComponents imagebuilder:ListContainerRecipes imagebuilder:ListImagePipelines imagebuilder:ListImageRecipes imagebuilder:ListInfrastructureConfigurations |
Read-only permission to list EC2 Image Builder resources in your AWS account. Why |
AWS IoT SiteWise (1)¶
| Permission | What it does |
|---|---|
iotsitewise:DescribeDefaultEncryptionConfiguration |
Read-only permission to view configuration details for AWS IoT SiteWise resources in your AWS account. Why |
Amazon MSK (Kafka) (1)¶
| Permission | What it does |
|---|---|
kafka:ListClusters |
Read-only permission to list Amazon MSK (Kafka) resources in your AWS account. Why |
Amazon Kendra (1)¶
| Permission | What it does |
|---|---|
kendra:ListIndices |
Read-only permission to list Amazon Kendra resources in your AWS account. Why |
Amazon Kinesis Data Streams (2)¶
| Permission | What it does |
|---|---|
kinesis:DescribeStream |
Read-only permission to view configuration details for Amazon Kinesis Data Streams resources in your AWS account. Why |
kinesis:ListStreams |
Read-only permission to list Amazon Kinesis Data Streams resources in your AWS account. Why |
Amazon Kinesis Video Streams (1)¶
| Permission | What it does |
|---|---|
kinesisvideo:ListStreams |
Read-only permission to list Amazon Kinesis Video Streams resources in your AWS account. Why |
AWS KMS (7)¶
| Permission | What it does |
|---|---|
kms:DescribeKey |
Read-only permission to view configuration details for KMS encryption keys in your AWS account. Why |
kms:GetKeyPolicy kms:GetKeyRotationStatus |
Read-only permission to read settings and metadata for KMS encryption keys in your AWS account. Why |
kms:ListAliases kms:ListKeys kms:ListResourceTags |
Read-only permission to list KMS encryption keys in your AWS account. Why |
kms:ListGrants |
Read-only permission to list KMS encryption keys in your AWS account. Why |
AWS Lambda (6)¶
| Permission | What it does |
|---|---|
lambda:GetFunction lambda:GetFunctionUrlConfig lambda:GetPolicy |
Read-only permission to read settings and metadata for Lambda functions in your AWS account. Why |
lambda:GetFunctionCodeSigningConfig lambda:GetFunctionConfiguration |
Read-only permission to read settings and metadata for Lambda functions in your AWS account. Why |
lambda:ListFunctions |
Read-only permission to list Lambda functions in your AWS account. Why |
Amazon Lex (1)¶
| Permission | What it does |
|---|---|
lex:ListBots |
Read-only permission to list Amazon Lex resources in your AWS account. Why |
Amazon CloudWatch Logs (4)¶
| Permission | What it does |
|---|---|
logs:DescribeLogGroups |
Read-only permission to view configuration details for CloudWatch Logs log groups in your AWS account. Why |
logs:DescribeMetricFilters |
Read-only permission to view configuration details for CloudWatch Logs log groups in your AWS account. Why |
logs:GetDataProtectionPolicy |
Read-only permission to read settings and metadata for CloudWatch Logs log groups in your AWS account. Why |
logs:ListTagsForResource |
Read-only permission to list CloudWatch Logs log groups in your AWS account. Why |
Amazon Lookout for Equipment (1)¶
| Permission | What it does |
|---|---|
lookoutequipment:ListDatasets |
Read-only permission to list Amazon Lookout for Equipment resources in your AWS account. Why |
Amazon Managed Blockchain (3)¶
| Permission | What it does |
|---|---|
managedblockchain:GetMember |
Read-only permission to read settings and metadata for Amazon Managed Blockchain resources in your AWS account. Why |
managedblockchain:ListMembers managedblockchain:ListNetworks |
Read-only permission to list Amazon Managed Blockchain resources in your AWS account. Why |
Amazon MemoryDB (1)¶
| Permission | What it does |
|---|---|
memorydb:DescribeClusters |
Read-only permission to view configuration details for Amazon MemoryDB resources in your AWS account. Why |
Amazon MQ (2)¶
| Permission | What it does |
|---|---|
mq:DescribeBroker |
Read-only permission to view configuration details for Amazon MQ resources in your AWS account. Why |
mq:ListBrokers |
Read-only permission to list Amazon MQ resources in your AWS account. Why |
AWS Organizations (3)¶
| Permission | What it does |
|---|---|
organizations:DescribeOrganization |
Read-only permission to view configuration details for AWS Organizations account structure in your AWS account. Why |
organizations:ListAccounts organizations:ListHandshakesForAccount |
Read-only permission to list AWS Organizations account structure in your AWS account. Why |
Amazon Connect Customer Profiles (1)¶
| Permission | What it does |
|---|---|
profile:ListDomains |
Read-only permission to list Amazon Connect Customer Profiles resources in your AWS account. Why |
AWS Proton (1)¶
| Permission | What it does |
|---|---|
proton:ListEnvironmentTemplates |
Read-only permission to list AWS Proton resources in your AWS account. Why |
Amazon RDS (15)¶
| Permission | What it does |
|---|---|
rds:DescribeCertificates rds:DescribeOrderableDBInstanceOptions |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBClusterSnapshotAttributes rds:DescribeDBClusterSnapshots |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBClusters |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBEngineVersions rds:DescribeDBParameterGroups rds:DescribeDBParameters rds:DescribeDBSnapshotAttributes rds:DescribeDBSnapshots |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBInstances |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBProxies |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribeDBSubnetGroups |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:DescribePendingMaintenanceActions |
Read-only permission to view configuration details for RDS and Aurora databases in your AWS account. Why |
rds:ListTagsForResource |
Read-only permission to list RDS and Aurora databases in your AWS account. Why |
Amazon Redshift Serverless (5)¶
| Permission | What it does |
|---|---|
redshift-serverless:GetNamespace |
Read-only permission to read settings and metadata for Amazon Redshift Serverless resources in your AWS account. Why |
redshift-serverless:GetWorkgroup |
Read-only permission to read settings and metadata for Amazon Redshift Serverless resources in your AWS account. Why |
redshift-serverless:ListNamespaces |
Read-only permission to list Amazon Redshift Serverless resources in your AWS account. Why |
redshift-serverless:ListTagsForResource |
Read-only permission to list Amazon Redshift Serverless resources in your AWS account. Why |
redshift-serverless:ListWorkgroups |
Read-only permission to list Amazon Redshift Serverless resources in your AWS account. Why |
Amazon Redshift (7)¶
| Permission | What it does |
|---|---|
redshift:DescribeClusterParameterGroups redshift:DescribeClusterParameters redshift:DescribeReservedNodes |
Read-only permission to view configuration details for Redshift data warehouses in your AWS account. Why |
redshift:DescribeClusterSubnetGroups |
Read-only permission to view configuration details for Redshift data warehouses in your AWS account. Why |
redshift:DescribeClusters redshift:DescribeLoggingStatus redshift:DescribeScheduledActions |
Read-only permission to view configuration details for Redshift data warehouses in your AWS account. Why |
Amazon Route 53 (6)¶
| Permission | What it does |
|---|---|
route53:GetDNSSEC route53:GetHostedZone |
Read-only permission to read settings and metadata for Route 53 DNS zones and records in your AWS account. Why |
route53:ListHostedZones route53:ListQueryLoggingConfigs route53:ListTagsForResource |
Read-only permission to list Route 53 DNS zones and records in your AWS account. Why |
route53:ListResourceRecordSets |
Read-only permission to list Route 53 DNS zones and records in your AWS account. Why |
Amazon Route 53 Domains (3)¶
| Permission | What it does |
|---|---|
route53domains:GetDomainDetail |
Read-only permission to read settings and metadata for Amazon Route 53 Domains resources in your AWS account. Why |
route53domains:ListDomains route53domains:ListTagsForDomain |
Read-only permission to list Amazon Route 53 Domains resources in your AWS account. Why |
Amazon S3 (22)¶
| Permission | What it does |
|---|---|
s3:GetAccelerateConfiguration |
Read-only permission to read settings and metadata for S3 buckets and bucket settings in your AWS account. Why |
s3:GetAccessPoint s3:GetAccessPointPolicy s3:GetAccessPointPolicyStatus |
Read-only permission to read settings and metadata for S3 buckets and bucket settings in your AWS account. Why |
s3:GetBucketAcl s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketObjectLockConfiguration s3:GetBucketOwnershipControls s3:GetBucketPolicy s3:GetBucketPolicyStatus s3:GetBucketPublicAccessBlock s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetEncryptionConfiguration s3:GetLifecycleConfiguration s3:GetReplicationConfiguration |
Read-only permission to read settings and metadata for S3 buckets and bucket settings in your AWS account. Why |
s3:GetBucketLocation |
Read-only permission to read settings and metadata for S3 buckets and bucket settings in your AWS account. Why |
s3:ListAccessPoints |
Read-only permission to list S3 buckets and bucket settings in your AWS account. Why |
s3:ListAllMyBuckets s3:ListBucket |
Read-only permission to list S3 buckets and bucket settings in your AWS account. Why |
Amazon SageMaker (5)¶
| Permission | What it does |
|---|---|
sagemaker:DescribeDomain |
Read-only permission to view configuration details for Amazon SageMaker resources in your AWS account. Why |
sagemaker:DescribeNotebookInstance |
Read-only permission to view configuration details for Amazon SageMaker resources in your AWS account. Why |
sagemaker:ListDomains sagemaker:ListTags |
Read-only permission to list Amazon SageMaker resources in your AWS account. Why |
sagemaker:ListNotebookInstances |
Read-only permission to list Amazon SageMaker resources in your AWS account. Why |
AWS Secrets Manager (2)¶
| Permission | What it does |
|---|---|
secretsmanager:DescribeSecret |
Read-only permission to view configuration details for Secrets Manager secrets in your AWS account. Why |
secretsmanager:ListSecrets |
Read-only permission to list Secrets Manager secrets in your AWS account. Why |
AWS Security Hub (2)¶
| Permission | What it does |
|---|---|
securityhub:DescribeHub |
Read-only permission to view configuration details for Security Hub findings and hub configuration in your AWS account. Why |
securityhub:GetFindings |
Read-only permission to read settings and metadata for Security Hub findings and hub configuration in your AWS account. Why |
AWS Service Quotas (1)¶
| Permission | What it does |
|---|---|
servicequotas:ListServiceQuotas |
Read-only permission to list AWS Service Quotas resources in your AWS account. Why |
Amazon SES (email) (3)¶
| Permission | What it does |
|---|---|
ses:DescribeActiveReceiptRuleSet |
Read-only permission to view configuration details for Amazon SES (email) resources in your AWS account. Why |
ses:GetIdentityDkimAttributes |
Read DKIM signing settings for your Amazon SES email identities. Why |
ses:ListIdentities |
Read-only permission to list Amazon SES (email) resources in your AWS account. Why |
AWS Shield (3)¶
| Permission | What it does |
|---|---|
shield:DescribeEmergencyContactSettings shield:DescribeSubscription |
Read-only permission to view configuration details for AWS Shield resources in your AWS account. Why |
shield:ListProtections |
Read-only permission to list AWS Shield resources in your AWS account. Why |
Amazon SNS (5)¶
| Permission | What it does |
|---|---|
sns:GetSubscriptionAttributes |
Read-only permission to read settings and metadata for SNS topics and subscriptions in your AWS account. Why |
sns:GetTopicAttributes |
Read-only permission to read settings and metadata for SNS topics and subscriptions in your AWS account. Why |
sns:ListSubscriptions |
Read-only permission to list SNS topics and subscriptions in your AWS account. Why |
sns:ListTagsForResource sns:ListTopics |
Read-only permission to list SNS topics and subscriptions in your AWS account. Why |
Amazon SQS (3)¶
| Permission | What it does |
|---|---|
sqs:GetQueueAttributes |
Read-only permission to read settings and metadata for SQS queues in your AWS account. Why |
sqs:ListQueueTags sqs:ListQueues |
Read-only permission to list SQS queues in your AWS account. Why |
AWS Systems Manager (5)¶
| Permission | What it does |
|---|---|
ssm:DescribeInstanceInformation ssm:DescribeParameters ssm:DescribeSessions |
Read-only permission to view configuration details for AWS Systems Manager resources in your AWS account. Why |
ssm:GetServiceSetting |
Read-only permission to read settings and metadata for AWS Systems Manager resources in your AWS account. Why |
ssm:ListAssociations |
Read-only permission to list AWS Systems Manager resources in your AWS account. Why |
AWS STS (1)¶
| Permission | What it does |
|---|---|
sts:GetCallerIdentity |
Confirm which AWS account and identity is being used — required for onboarding and credential validation. Why |
AWS Resource Groups Tagging API (2)¶
| Permission | What it does |
|---|---|
tag:GetResources tag:GetTagKeys |
Read-only permission to read settings and metadata for resource tags across your AWS environment in your AWS account. Why |
Amazon Timestream (2)¶
| Permission | What it does |
|---|---|
timestream:DescribeEndpoints |
Read-only permission to view configuration details for Amazon Timestream resources in your AWS account. Why |
timestream:ListDatabases |
List Amazon Timestream databases in your account. Why |
AWS Transfer Family (1)¶
| Permission | What it does |
|---|---|
transfer:ListServers |
Read-only permission to list AWS Transfer Family resources in your AWS account. Why |
Amazon Translate (1)¶
| Permission | What it does |
|---|---|
translate:ListTextTranslationJobs |
Read-only permission to list Amazon Translate resources in your AWS account. Why |
AWS WAF (Regional Classic) (1)¶
| Permission | What it does |
|---|---|
waf-regional:ListWebACLs |
Read-only permission to list AWS WAF (Regional Classic) resources in your AWS account. Why |
AWS WAF (Classic) (1)¶
| Permission | What it does |
|---|---|
waf:ListWebACLs |
Read-only permission to list AWS WAF (Classic) resources in your AWS account. Why |
AWS WAFv2 (4)¶
| Permission | What it does |
|---|---|
wafv2:GetLoggingConfiguration wafv2:GetWebACL |
Read-only permission to read settings and metadata for AWS WAF web ACLs in your AWS account. Why |
wafv2:ListResourcesForWebACL wafv2:ListWebACLs |
Read-only permission to list AWS WAF web ACLs in your AWS account. Why |
Amazon WorkSpaces (5)¶
| Permission | What it does |
|---|---|
workspaces:DescribeIpGroups workspaces:DescribeWorkspaceDirectories workspaces:DescribeWorkspacesConnectionStatus |
Read-only permission to view configuration details for Amazon WorkSpaces resources in your AWS account. Why |
workspaces:DescribeTags workspaces:DescribeWorkspaces |
Read-only permission to view configuration details for Amazon WorkSpaces resources in your AWS account. Why |
AWS X-Ray (1)¶
| Permission | What it does |
|---|---|
xray:GetEncryptionConfig |
Read-only permission to read settings and metadata for AWS X-Ray resources in your AWS account. Why |