# action

name: a4b:CreateBusinessReportSchedule
access_level: Write
description:
Grants permission to create a recurring schedule for usage reports to deliver to the specified S3 location with a specified daily or weekly interval


name: a4b:DeleteDeviceUsageData
access_level: Write
description:
Grants permission to delete the device's entire previous history of voice input data and associated response data


name: a4b:DisassociateSkillFromUsers
access_level: Write
description:
Grants permission to make a private skill unavailable for enrolled users and prevent them from enabling it on their devices


name: a4b:GetInvitationConfiguration
access_level: Read
description:
Grants permission to retrieve the configured values for the user enrollment invitation email template


name: a4b:ListDeviceEvents
access_level: List
description:
Grants permission to list the device event history, including device connection status, for up to 30 days


name: a4b:PutConferencePreference
access_level: Write
description:
Grants permission to set the conference preferences on a specific conference provider at the account level


name: a4b:PutInvitationConfiguration
access_level: Write
description:
Grants permission to configure the email template for the user enrollment invitation with the specified attributes


name: a4b:RegisterAVSDevice
access_level: Write
description:
Grants permission to register an Alexa-enabled device built by an Original Equipment Manufacturer (OEM) using Alexa Voice Service (AVS)


name: a4b:SearchAddressBooks
access_level: List
description:
Grants permission to search address books and list the ones that meet a set of filter and sort criteria


name: a4b:SearchNetworkProfiles
access_level: List
description:
Grants permission to search network profiles and list the ones that meet a set of filter and sort criteria


name: a4b:SendAnnouncement
access_level: Write
description:
Grants permission to trigger an asynchronous flow to send text, SSML, or audio announcements to rooms that are identified by a search or filter


name: a4b:StartDeviceSync
access_level: Write
description:
Grants permission to restore the device and its account to its known, default settings by clearing all information and settings set by its previous users


name: a4b:UpdateBusinessReportSchedule
access_level: Write
description:
Grants permission to update the configuration of the report delivery schedule with the specified schedule ARN


name: acm:ExportCertificate
access_level: Read
description:
Grants permission to export a private certificate issued by a private certificate authority (CA) for use anywhere


name: acm:UpdateCertificateOptions
access_level: Write
description:
Grants permission to update a certificate configuration. Use this to specify whether to opt in to or out of certificate transparency logging


name: acm-pca:GetCertificate
access_level: Read
description:
Retrieves an ACM Private CA certificate and certificate chain for the certificate authority specified by an ARN.


name: acm-pca:GetCertificateAuthorityCsr
access_level: Read
description:
Retrieves an ACM Private CA certificate signing request (CSR) for the certificate-authority specified by an ARN.


name: acm-pca:ImportCertificateAuthorityCertificate
access_level: Write
description:
Imports an SSL/TLS certificate into ACM Private CA for use as the CA certificate of an ACM Private CA.


name: acm-pca:ListCertificateAuthorities
access_level: List
description:
Retrieves a list of the ACM Private CA certificate authority ARNs, and a summary of the status of each CA in the calling account.


name: airflow:CreateCliToken
access_level: Write
description:
Grants permission to create a short-lived token that allows a user to invoke Airflow CLI via an endpoint on the Apache Airflow Webserver


name: airflow:CreateWebLoginToken
access_level: Write
description:
Grants permission to create a short-lived token that allows a user to log into Apache Airflow web UI


name: amplifybackend:CloneBackend
access_level: Write
description:
Grants permission to clone an existing Amplify Admin backend environment into a new Amplify Admin backend enviroment


name: amplifybackend:CreateBackendAPI
access_level: Write
description:
Grants permission to create an API for an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:CreateBackendAuth
access_level: Write
description:
Grants permission to create an auth resource for an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:DeleteBackend
access_level: Write
description:
Grants permission to delete an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:DeleteBackendAPI
access_level: Write
description:
Grants permission to delete an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:DeleteBackendAuth
access_level: Write
description:
Grants permission to delete an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GenerateBackendAPIModels
access_level: Write
description:
Grants permission to generate models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GetBackend
access_level: Read
description:
Grants permission to retrieve an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GetBackendAPI
access_level: Read
description:
Grants permission to retrieve an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GetBackendAPIModels
access_level: Read
description:
Grants permission to retrieve models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GetBackendAuth
access_level: Read
description:
Grants permission to retrieve an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:GetBackendJob
access_level: Read
description:
Grants permission to retrieve a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:ImportBackendAuth
access_level: Write
description:
Grants permission to import an existing auth resource of an Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:ListBackendJobs
access_level: List
description:
Grants permission to retrieve the jobs of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:UpdateBackendAPI
access_level: Write
description:
Grants permission to update an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:UpdateBackendAuth
access_level: Write
description:
Grants permission to update an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: amplifybackend:UpdateBackendJob
access_level: Write
description:
Grants permission to update a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName


name: apigateway:AddCertificateToDomain
access_level: Permissions management
description:
Grants permission to add certificates for mutual TLS authentication to a domain name. This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS


name: apigateway:RemoveCertificateFromDomain
access_level: Permissions management
description:
Grants permission to remove certificates for mutual TLS authentication from a domain name. This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS


name: apigateway:SetWebACL
access_level: Permissions management
description:
Grants permission set a WAF access control list (ACL). This is an additional authorization control for managing the Stage resource due to the sensitive nature of WebAcl's


name: apigateway:UpdateRestApiPolicy
access_level: Permissions management
description:
Grants permission to manage the IAM resource policy for an API. This is an additional authorization control for managing an API due to the sensitive nature of the resource policy


name: appflow:DescribeConnectorEntity
access_level: Read
description:
Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow


name: appflow:DescribeConnectorFields
access_level: Read
description:
Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow (Console Only)


name: appflow:DescribeFlowExecution
access_level: Read
description:
Grants permission to describe all flow executions for a flow configured in Amazon AppFlow (Console Only)


name: appflow:ListConnectorFields
access_level: Read
description:
Grants permission to list all objects for a login profile configured in Amazon AppFlow (Console Only)


name: appflow:StartFlow
access_level: Write
description:
Grants permission to activate (for scheduled and event-triggered flows) or run (for on-demand flows) a flow configured in Amazon AppFlow


name: application-autoscaling:DescribeScalingActivities
access_level: Read
description:
Provides descriptive information for scaling activities with a specified service namespace for the previous six weeks.


name: application-autoscaling:RegisterScalableTarget
access_level: Write
description:
Registers or updates a scalable target. A scalable target is a resource that can be scaled out or in with Application Auto Scaling.


name: application-cost-profiler:DeleteReportDefinition
access_level: Write
description:
Grants permission to delete the configuration with specific Application Cost Profiler Report thereby effectively disabling report generation


name: application-cost-profiler:ListReportDefinitions
access_level: Read
description:
Grants permission to get a list of the different Application Cost Profiler Report configurations they have created


name: appmesh:StreamAggregatedResources
access_level: Read
description:
Grants permission to receive streamed resources for an App Mesh endpoint (VirtualNode/VirtualGateway)


name: appmesh:UpdateGatewayRoute
access_level: Write
description:
Grants permission to update an existing gateway route for a specified service mesh and virtual gateway


name: apprunner:AssociateCustomDomain
access_level: Write
description:
Grants permission to associate your own domain name with the AWS App Runner subdomain URL of your App Runner service


name: apprunner:DescribeAutoScalingConfiguration
access_level: Read
description:
Grants permission to retrieve descriptions of an AWS App Runner automatic scaling configuration resource


name: apprunner:DescribeCustomDomains
access_level: Read
description:
Grants permission to retrieve descriptions of custom domain names associated with an AWS App Runner service


name: apprunner:DescribeOperation
access_level: Read
description:
Grants permission to retrieve description of an operation that occurred on an AWS App Runner service


name: apprunner:ListAutoScalingConfigurations
access_level: List
description:
Grants permission to retrieve a list of AWS App Runner automatic scaling configurations in your AWS account


name: appstream:BatchAssociateUserStack
access_level: Write
description:
Grants permission to associate the specified users with the specified stacks. Users in a user pool cannot be assigned to stacks with fleets that are joined to an Active Directory domain


name: appstream:CopyImage
access_level: Write
description:
Grants permission to copy the specified image within the same Region or to a new Region within the same AWS account


name: appstream:CreateDirectoryConfig
access_level: Write
description:
Grants permission to create a Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains


name: appstream:CreateFleet
access_level: Write
description:
Grants permission to create a fleet. A fleet is a group of streaming instances from which applications are launched and streamed to users


name: appstream:CreateImageBuilder
access_level: Write
description:
Grants permission to create an image builder. An image builder is a virtual machine that is used to create an image


name: appstream:CreateStack
access_level: Write
description:
Grants permission to create a stack to start streaming applications to users. A stack consists of an associated fleet, user access policies, and storage configurations


name: appstream:CreateStreamingURL
access_level: Write
description:
Grants permission to create a temporary URL to start an AppStream 2.0 streaming session for the specified user. A streaming URL enables application streaming to be tested without user setup


name: appstream:DeleteDirectoryConfig
access_level: Write
description:
Grants permission to delete the specified Directory Config object from AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains


name: appstream:DeleteStack
access_level: Write
description:
Grants permission to delete the specified stack. After the stack is deleted, the application streaming environment provided by the stack is no longer available to users. Also, any reservations made for application streaming sessions for the stack are released


name: appstream:DescribeDirectoryConfigs
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified Directory Config objects for AppStream 2.0, if the names for these objects are provided. Otherwise, all Directory Config objects in the account are described. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains


name: appstream:DescribeFleets
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified fleets, if the fleet names are provided. Otherwise, all fleets in the account are described


name: appstream:DescribeImageBuilders
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified image builders, if the image builder names are provided. Otherwise, all image builders in the account are described


name: appstream:DescribeImagePermissions
access_level: Read
description:
Grants permission to retrieve a list that describes the permissions for shared AWS account IDs on a private image that you own


name: appstream:DescribeImages
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified images, if the image names or image ARNs are provided. Otherwise, all images in the account are described


name: appstream:DescribeSessions
access_level: Read
description:
Grants permission to retrieve a list that describes the streaming sessions for the specified stack and fleet. If a user ID is provided for the stack and fleet, only the streaming sessions for that user are described


name: appstream:DescribeStacks
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified stacks, if the stack names are provided. Otherwise, all stacks in the account are described


name: appstream:DisableUser
access_level: Write
description:
Grants permission to disable the specified user in the user pool. This action does not delete the user


name: appstream:ListTagsForResource
access_level: Read
description:
Grants permission to retrieve a list of all tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks


name: appstream:Stream
access_level: Write
description:
Grants permission to federated users to sign in by using their existing credentials and stream applications from the specified stack


name: appstream:TagResource
access_level: Tagging
description:
Grants permission to add or overwrite one or more tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks


name: appstream:UpdateDirectoryConfig
access_level: Write
description:
Grants permission to update the specified Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains


name: appstream:UpdateFleet
access_level: Write
description:
Grants permission to update the specified fleet. All attributes except the fleet name can be updated when the fleet is in the STOPPED state


name: appsync:CreateApiKey
access_level: Write
description:
Grants permission to create a unique key that you can distribute to clients who are executing your API


name: appsync:CreateResolver
access_level: Write
description:
Grants permission to create a resolver. A resolver converts incoming requests into a format that a data source can understand, and converts the data source's responses into GraphQL


name: appsync:DeleteGraphqlApi
access_level: Write
description:
Grants permission to delete a GraphQL Api. This will also clean up every AppSync resource below that API


name: appsync:StartSchemaCreation
access_level: Write
description:
Grants permission to add a new schema to your GraphQL API. This operation is asynchronous - GetSchemaCreationStatus can show when it has completed


name: aps:RemoteWrite
access_level: Write
description:
Grants permission to perform a remote write operation to initiate the streaming of metrics to AMP workspace


name: artifact:AcceptAgreement
access_level: Write
description:
Grants permission to accept an AWS agreement that has not yet been accepted by the customer account.


name: artifact:DownloadAgreement
access_level: Read
description:
Grants permission to download an AWS agreement that has not yet been accepted or a customer agreement that has been accepted by the customer account.


name: artifact:TerminateAgreement
access_level: Write
description:
Grants permission to terminate a customer agreement that was previously accepted by the customer account.


name: auditmanager:RegisterOrganizationAdminAccount
access_level: Write
description:
Grants permission to register an account within the organization as the delegated administrator for AWS Audit Manager


name: autoscaling:CompleteLifecycleAction
access_level: Write
description:
Grants permission to complete the lifecycle action for the specified token or instance with the specified result


name: autoscaling:DescribeAutoScalingGroups
access_level: List
description:
Grants permission to describe one or more Auto Scaling groups. If a list of names is not provided, the call describes all Auto Scaling groups


name: autoscaling:DescribeAutoScalingInstances
access_level: List
description:
Grants permission to describe one or more Auto Scaling instances. If a list is not provided, the call describes all instances


name: autoscaling:DescribeLaunchConfigurations
access_level: List
description:
Grants permission to describe one or more launch configurations. If you omit the list of names, then the call describes all launch configurations


name: autoscaling:DescribeNotificationConfigurations
access_level: List
description:
Grants permission to describe the notification actions associated with the specified Auto Scaling group


name: autoscaling:DescribeScalingProcessTypes
access_level: List
description:
Grants permission to describe the scaling process types for use with ResumeProcesses and SuspendProcesses


name: autoscaling:DisableMetricsCollection
access_level: Write
description:
Grants permission to disable monitoring of the specified metrics for the specified Auto Scaling group


name: autoscaling:EnableMetricsCollection
access_level: Write
description:
Grants permission to enable monitoring of the specified metrics for the specified Auto Scaling group


name: autoscaling:PutNotificationConfiguration
access_level: Write
description:
Grants permission to configure an Auto Scaling group to send notifications when specified events take place


name: autoscaling:PutWarmPool
access_level: Write
description:
Grants permission to create or update the warm pool associated with the specified Auto Scaling group


name: autoscaling:RecordLifecycleActionHeartbeat
access_level: Write
description:
Grants permission to record a heartbeat for the lifecycle action associated with the specified token or instance


name: autoscaling:ResumeProcesses
access_level: Write
description:
Grants permission to resume the specified suspended Auto Scaling processes, or all suspended process, for the specified Auto Scaling group


name: autoscaling:SuspendProcesses
access_level: Write
description:
Grants permission to suspend the specified Auto Scaling processes, or all processes, for the specified Auto Scaling group


name: aws-marketplace:AssociateProductsWithPrivateMarketplace
access_level: Write
description:
Adds new approved products to the Private Marketplace. Also allows to approve a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:CreatePrivateMarketplace
access_level: Write
description:
Creates a Private Marketplace for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.


name: aws-marketplace:CreatePrivateMarketplaceRequests
access_level: Write
description:
Creates a new request for a product or products to be associated with the Private Marketplace. This action can be performed by any account in an in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:DescribePrivateMarketplaceRequests
access_level: List
description:
Describes requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:DescribePrivateMarketplaceStatus
access_level: Read
description:
Describes the status of the Private Marketplace for administrative purposes. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:DisassociateProductsFromPrivateMarketplace
access_level: Write
description:
Removes approved products from the Private Marketplace. Also allows to decline a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:ListPrivateMarketplaceRequests
access_level: List
description:
Queryable list for requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:AcceptAgreementApprovalRequest
access_level: Write
description:
Allows users to approve an incoming subscription request (for providers who provide products that require subscription verification).


name: aws-marketplace:CancelAgreementRequest
access_level: Write
description:
Allows users to cancel pending subscription requests for products that require subscription verification.


name: aws-marketplace:GetAgreementApprovalRequest
access_level: Read
description:
Allows users to view the details of their incoming subscription requests (for providers who provide products that require subscription verification).


name: aws-marketplace:GetAgreementRequest
access_level: Read
description:
Allows users to view the details of their subscription requests for data products that require subscription verification.


name: aws-marketplace:ListAgreementApprovalRequests
access_level: List
description:
Allows users to list their incoming subscription requests (for providers who provide products that require subscription verification).


name: aws-marketplace:ListAgreementRequests
access_level: List
description:
Allows users to list their subscription requests for products that require subscription verification.


name: aws-marketplace:RejectAgreementApprovalRequest
access_level: Write
description:
Allows users to decline an incoming subscription requests (for providers who provide products that require subscription verification).


name: aws-marketplace:Subscribe
access_level: Write
description:
Allows users to subscribe to AWS Marketplace products. Includes the ability to send a subscription request for products that require subscription verification. Includes the ability to enable auto-renewal for an existing subscription.


name: aws-marketplace:Unsubscribe
access_level: Write
description:
Allows users to remove subscriptions to AWS Marketplace products. Includes the ability to disable auto-renewal for an existing subscription.


name: aws-marketplace:UpdateAgreementApprovalRequest
access_level: Write
description:
Allows users to make changes to an incoming subscription request, including the ability to delete the prospective subscriber's information (for providers who provide products that require subscription verification).


name: aws-marketplace:RegisterUsage
access_level: Write
description:
Grants permission to to verify that the customer running your paid software is subscribed to your product on AWS Marketplace, enabling you to guard against unauthorized use. Meters software use per ECS task, per hour, with usage prorated to the second


name: aws-marketplace:GetEntitlements
access_level: Read
description:
Retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions


name: aws-marketplace:DescribeProcurementSystemConfiguration
access_level: Read
description:
Describes the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.


name: aws-marketplace:PutProcurementSystemConfiguration
access_level: Write
description:
Creates or updates the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.


name: aws-marketplace-management:viewSupport
access_level: List
description:
Allows access to the Customer Support Eligibility page inside the AWS Marketplace Management Portal.


name: budgets:CreateBudgetAction
access_level: Write
description:
Grants permissions to create and define a response that you can configure to execute once your budget has exceeded a specific budget threshold.


name: budgets:DescribeBudgetActionHistories
access_level: Read
description:
Grants permissions to retrieve a historical view of the budget actions statuses associated with a particular budget action. These status include statues such as 'Standby', 'Pending' and 'Executed'.


name: budgets:DescribeBudgetActionsForAccount
access_level: Read
description:
Grants permissions to retrieve the details of all of the budget actions associated with your account.


name: budgets:ExecuteBudgetAction
access_level: Write
description:
Grants permissions to initiate a pending budget action as well as reverse a previously executed budget action.


name: bugbust:ListProfilingGroups
access_level: Read
description:
Grants permission to view the profiling groups that were imported into an event for players to work on


name: bugbust:ListPullRequests
access_level: Read
description:
Grants permission to view the pull requests used by players to submit fixes to their claimed bugs in an event


name: ce:DescribeCostCategoryDefinition
access_level: Read
description:
Grants permission to retrieve descriptions such as the name, ARN, rules, definition, and effective dates of a Cost Category


name: chatbot:DeleteSlackWorkspaceAuthorization
access_level: Write
description:
Grants permission to delete the Slack workspace authorization with AWS Chatbot, associated with an AWS account


name: chatbot:DescribeSlackChannels
access_level: Read
description:
Grants permission to list all public Slack channels in the Slack workspace connected to the AWS Account onboarded with AWS Chatbot service


name: chatbot:DescribeSlackWorkspaces
access_level: Read
description:
Grants permission to list all authorized Slack workspaces connected to the AWS Account onboarded with AWS Chatbot service


name: chatbot:GetSlackOauthParameters
access_level: Read
description:
Grants permission to generate OAuth parameters to request Slack OAuth code to be used by the AWS Chatbot service


name: chatbot:RedeemSlackOauthCode
access_level: Write
description:
Grants permission to redeem previously generated parameters with Slack API, to acquire OAuth tokens to be used by the AWS Chatbot service


name: chime:AcceptDelegate
access_level: Write
description:
Grants permission to accept the delegate invitation to share management of an Amazon Chime account with another AWS Account


name: chime:AddOrUpdateGroups
access_level: Write
description:
Grants permission to add new or update existing Active Directory or Okta user groups associated with your Amazon Chime Enterprise account


name: chime:AssociateSigninDelegateGroupsWithAccount
access_level: Write
description:
Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account.


name: chime:BatchUnsuspendUser
access_level: Write
description:
Grants permission to remove the suspension from up to 50 previously suspended users for the specified Amazon Chime EnterpriseLWA account


name: chime:BatchUpdatePhoneNumber
access_level: Write
description:
Grants permission to update phone number details within the UpdatePhoneNumberRequestItem object for up to 50 phone numbers


name: chime:BatchUpdateUser
access_level: Write
description:
Grants permission to update user details within the UpdateUserRequestItem object for up to 20 users for the specified Amazon Chime account


name: chime:Connect
access_level: Write
description:
Grants permission to establish a web socket connection for app instance user to the messaging session endpoint


name: chime:CreateApiKey
access_level: Write
description:
Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration


name: chime:CreateMeeting
access_level: Write
description:
Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with no initial attendees


name: chime:CreateMeetingWithAttendees
access_level: Write
description:
Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with a set of attendees


name: chime:CreateSipMediaApplication
access_level: Write
description:
Grants permission to create an Amazon Chime SIP media application under the administrator's AWS account


name: chime:CreateSipMediaApplicationCall
access_level: Write
description:
Grants permission to create outbound call for Amazon Chime SIP media application under the administrator's AWS account


name: chime:CreateVoiceConnectorGroup
access_level: Write
description:
Grants permission to create a Amazon Chime Voice Connector Group under the administrator's AWS account


name: chime:DeleteApiKey
access_level: Write
description:
Grants permission to delete the specified SCIM access key associated with your Amazon Chime account and Okta configuration


name: chime:DeleteGroups
access_level: Write
description:
Grants permission to delete Active Directory or Okta user groups from your Amazon Chime Enterprise account


name: chime:DeleteSipMediaApplication
access_level: Write
description:
Grants permission to delete Amazon Chime SIP media application under the administrator's AWS account


name: chime:DeleteVoiceConnectorEmergencyCallingConfiguration
access_level: Write
description:
Grants permission to delete emergency calling configuration for the specified Amazon Chime Voice Connector


name: chime:DeleteVoiceConnectorTerminationCredentials
access_level: Write
description:
Grants permission to delete SIP termination credentials for the specified Amazon Chime Voice Connector


name: chime:DescribeChannelMembershipForAppInstanceUser
access_level: Read
description:
Grants permission to get the details of a channel based on the membership of the specified AppInstanceUser


name: chime:DisassociatePhoneNumberFromUser
access_level: Write
description:
Grants permission to disassociate the primary provisioned number from the specified Amazon Chime user


name: chime:DisassociatePhoneNumbersFromVoiceConnector
access_level: Write
description:
Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector


name: chime:DisassociatePhoneNumbersFromVoiceConnectorGroup
access_level: Write
description:
Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector Group


name: chime:DisassociateSigninDelegateGroupsFromAccount
access_level: Write
description:
Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account.


name: chime:GetAccountWithOpenIdConfig
access_level: Read
description:
Grants permission to get the account details and OpenIdConfig attributes for your Amazon Chime account


name: chime:GetCDRBucket
access_level: Read
description:
Grants permission to get details of a Call Detail Record S3 bucket associated with your Amazon Chime account


name: chime:GetEventsConfiguration
access_level: Read
description:
Grants permission to retrieve details for an events configuration for a bot to receive outgoing events


name: chime:GetProxySession
access_level: Read
description:
Grants permission to get details of the specified proxy session for the specified Amazon Chime Voice Connector


name: chime:GetSipMediaApplication
access_level: Read
description:
Grants permission to get details of Amazon Chime SIP media application under the administrator's AWS account


name: chime:GetSipMediaApplicationLoggingConfiguration
access_level: Read
description:
Grants permission to get logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account


name: chime:GetUserByEmail
access_level: Read
description:
Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account


name: chime:GetVoiceConnectorEmergencyCallingConfiguration
access_level: Read
description:
Grants permission to get details of the emergency calling configuration for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorLoggingConfiguration
access_level: Read
description:
Grants permission to get details of the logging configuration for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorOrigination
access_level: Read
description:
Grants permission to get details of the origination settings for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorProxy
access_level: Read
description:
Grants permission to get details of the proxy configuration for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorStreamingConfiguration
access_level: Read
description:
Grants permission to get details of the streaming configuration for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorTermination
access_level: Read
description:
Grants permission to get details of the termination settings for the specified Amazon Chime Voice Connector


name: chime:GetVoiceConnectorTerminationHealth
access_level: Read
description:
Grants permission to get details of the termination health for the specified Amazon Chime Voice Connector


name: chime:InviteDelegate
access_level: Write
description:
Grants permission to send an invitation to accept a request for AWS account delegation for an Amazon Chime account


name: chime:ListApiKeys
access_level: List
description:
Grants permission to list the SCIM access keys defined for your Amazon Chime account and Okta configuration


name: chime:ListBots
access_level: List
description:
Grants permission to list the bots associated with the administrator's Amazon Chime Enterprise account


name: chime:ListDirectories
access_level: List
description:
Grants permission to list active Active Directories hosted in the Directory Service of your AWS account


name: chime:ListGroups
access_level: List
description:
Grants permission to list Active Directory or Okta user groups associated with your Amazon Chime Enterprise account


name: chime:ListSipMediaApplications
access_level: List
description:
Grants permission to list all Amazon Chime SIP media applications under the administrator's AWS account


name: chime:ListVoiceConnectorGroups
access_level: List
description:
Grants permission to list the Amazon Chime Voice Connector Groups under the administrator's AWS account


name: chime:ListVoiceConnectorTerminationCredentials
access_level: List
description:
Grants permission to list the SIP termination credentials for the specified Amazon Chime Voice Connector


name: chime:LogoutUser
access_level: Write
description:
Grants permission to log out the specified user from all of the devices they are currently logged into


name: chime:PutEventsConfiguration
access_level: Write
description:
Grants permission to update details for an events configuration for a bot to receive outgoing events


name: chime:PutSipMediaApplicationLoggingConfiguration
access_level: Write
description:
Grants permission to update logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account


name: chime:PutVoiceConnectorEmergencyCallingConfiguration
access_level: Write
description:
Grants permission to add emergency calling configuration for the specified Amazon Chime Voice Connector


name: chime:ResetPersonalPIN
access_level: Write
description:
Grants permission to reset the personal meeting PIN for the specified user on an Amazon Chime account


name: chime:RestorePhoneNumber
access_level: Write
description:
Grants permission to restore the specified phone number from the deltion queue back to the phone number inventory


name: chime:RetrieveDataExports
access_level: List
description:
Grants permission to download the file containing links to all user attachments returned as part of the "Request attachments" action


name: chime:UpdateSipMediaApplication
access_level: Write
description:
Grants permission to update properties of Amazon Chime SIP media application under the administrator's AWS account


name: chime:UpdateSipMediaApplicationCall
access_level: Write
description:
Grants permission to update an Amazon Chime SIP media application call under the administrator's AWS account


name: chime:UpdateSipRule
access_level: Write
description:
Grants permission to update properties of Amazon Chime SIP rule under the administrator's AWS account


name: chime:UpdateSupportedLicenses
access_level: Write
description:
Grants permission to update the supported license tiers available for users in your Amazon Chime account


name: chime:UpdateVoiceConnector
access_level: Write
description:
Grants permission to update Amazon Chime Voice Connector details for the specified Amazon Chime Voice Connector


name: chime:UpdateVoiceConnectorGroup
access_level: Write
description:
Grants permission to update Amazon Chime Voice Connector Group details for the specified Amazon Chime Voice Connector Group


name: cloud9:CreateEnvironmentEC2
access_level: Write
description:
Grants permission to create an AWS Cloud9 development environment, launches an Amazon Elastic Compute Cloud (Amazon EC2) instance, and then hosts the environment on the instance.


name: cloud9:DeleteEnvironment
access_level: Write
description:
Grants permission to delete an AWS Cloud9 development environment. If the environment is hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance, also terminates the instance.


name: cloud9:DescribeEnvironmentMemberships
access_level: Read
description:
Grants permission to get information about environment members for an AWS Cloud9 development environment.


name: cloud9:UpdateEnvironmentMembership
access_level: Write
description:
Grants permission to change the settings of an existing environment member for an AWS Cloud9 development environment.


name: clouddirectory:ApplySchema
access_level: Write
description:
Copies input published schema into Directory with same name and version as that of published schema.


name: clouddirectory:BatchRead
access_level: Read
description:
Performs all the read operations in a batch. Each individual operation inside BatchRead needs to be granted permissions explicitly.


name: clouddirectory:BatchWrite
access_level: Write
description:
Performs all the write operations in a batch. Each individual operation inside BatchWrite needs to be granted permissions explicitly.


name: clouddirectory:DeleteTypedLinkFacet
access_level: Write
description:
Deletes a given TypedLink Facet. All attributes and Rules associated with the facet will be deleted.


name: clouddirectory:ListManagedSchemaArns
access_level: List
description:
Lists the major version families of each managed schema. If a major version ARN is provided as SchemaArn, the minor version revisions in that family are listed instead.


name: clouddirectory:ListObjectParentPaths
access_level: Read
description:
Retrieves all available parent paths for any object type such as node, leaf node, policy node, and index node objects.


name: clouddirectory:UpdateLinkAttributes
access_level: Write
description:
Updates a given typed link’s attributes. Attributes to be updated must not contribute to the typed link’s identity, as defined by its IdentityAttributeOrder.


name: cloudformation:ContinueUpdateRollback
access_level: Write
description:
Grants permission to continue rolling back a stack that is in the UPDATE_ROLLBACK_FAILED state to the UPDATE_ROLLBACK_COMPLETE state


name: cloudformation:CreateStackInstances
access_level: Write
description:
Grants permission to create stack instances for the specified accounts, within the specified regions


name: cloudformation:CreateUploadBucket
access_level: Write
description:
Grants permission to upload templates to Amazon S3 buckets. Used only by the AWS CloudFormation console and is not documented in the API reference


name: cloudformation:DeleteChangeSet
access_level: Write
description:
Grants permission to delete the specified change set. Deleting change sets ensures that no one executes the wrong change set


name: cloudformation:DescribeStackInstance
access_level: Read
description:
Grants permission to return the stack instance that's associated with the specified stack set, AWS account, and region


name: cloudformation:DescribeStackResourceDrifts
access_level: Read
description:
Grants permission to return drift information for the resources that have been checked for drift in the specified stack


name: cloudformation:DetectStackDrift
access_level: Read
description:
Grants permission to detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters


name: cloudformation:DetectStackResourceDrift
access_level: Read
description:
Grants permission to return information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters


name: cloudformation:DetectStackSetDrift
access_level: Read
description:
Grants permission to enable users to detect drift on a stack set and the stack instances that belong to that stack set


name: cloudformation:ExecuteChangeSet
access_level: Write
description:
Grants permission to update a stack using the input information that was provided when the specified change set was created


name: cloudformation:ListChangeSets
access_level: List
description:
Grants permission to return the ID and status of each active change set for a stack. For example, AWS CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state


name: cloudformation:ListExports
access_level: List
description:
Grants permission to list all exported output values in the account and region in which you call this action


name: cloudformation:ListStackInstances
access_level: List
description:
Grants permission to return summary information about stack instances that are associated with the specified stack set


name: cloudformation:ListStacks
access_level: List
description:
Grants permission to return the summary information for stacks whose status matches the specified StackStatusFilter


name: cloudformation:SetTypeDefaultVersion
access_level: Write
description:
Grants permission to set which version of a CloudFormation type applies to CloudFormation operations


name: cloudformation:StopStackSetOperation
access_level: Write
description:
Grants permission to stop an in-progress operation on a stack set and its associated stack instances


name: cloudformation:UpdateStackInstances
access_level: Write
description:
Grants permission to update the parameter values for stack instances for the specified accounts, within the specified regions


name: cloudfront:CreateMonitoringSubscription
access_level: Write
description:
Grants permission to enable additional CloudWatch metrics for the specified CloudFront distribution. The additional metrics incur an additional cost


name: cloudfront:DeleteMonitoringSubscription
access_level: Write
description:
Grants permission to disable additional CloudWatch metrics for the specified CloudFront distribution


name: cloudfront:GetMonitoringSubscription
access_level: Read
description:
Grants permission to get information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution


name: cloudfront:ListDistributionsByCachePolicyId
access_level: List
description:
Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy


name: cloudfront:ListDistributionsByKeyGroup
access_level: List
description:
Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified key group


name: cloudfront:ListDistributionsByOriginRequestPolicyId
access_level: List
description:
Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy


name: cloudfront:ListDistributionsByRealtimeLogConfig
access_level: List
description:
Grants permission to get a list of distributions that have a cache behavior that’s associated with the specified real-time log configuration


name: cloudfront:ListDistributionsByWebACLId
access_level: List
description:
Grants permission to list the distributions associated with your AWS account with given AWS WAF web ACL


name: cloudfront:ListFieldLevelEncryptionConfigs
access_level: List
description:
Grants permission to list all field-level encryption configurations that have been created in CloudFront for this account


name: cloudfront:ListFieldLevelEncryptionProfiles
access_level: List
description:
Grants permission to list all field-level encryption profiles that have been created in CloudFront for this account


name: cloudfront:ListOriginRequestPolicies
access_level: List
description:
Grants permission to list all origin request policies that have been created in CloudFront for this account


name: cloudhsm:GetConfig
access_level: Read
description:
Gets the configuration files necessary to connect to all high availability partition groups the client is associated with


name: cloudsearch:DefineAnalysisScheme
access_level: Write
description:
Configures an analysis scheme that can be applied to a text or text-array field to define language-specific text processing options.


name: cloudsearch:DescribeServiceAccessPolicies
access_level: Read
description:
Gets information about the access policies that control access to the domain's document and search endpoints.


name: cloudtrail:CreateTrail
access_level: Write
description:
Grants permission to create a trail that specifies the settings for delivery of log data to an Amazon S3 bucket


name: cloudtrail:DescribeTrails
access_level: Read
description:
Grants permission to list settings for the trails associated with the current region for your account


name: cloudtrail:ListPublicKeys
access_level: Read
description:
Grants permission to list the public keys whose private keys were used to sign trail digest files within a specified time range


name: cloudtrail:LookupEvents
access_level: Read
description:
Grants permission to look up API activity events captured by CloudTrail that create, update, or delete resources in your account


name: cloudwatch:DescribeAlarmsForMetric
access_level: Read
description:
Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account


name: cloudwatch:GetInsightRuleReport
access_level: Read
description:
Grants permission to return the top-N report of unique contributors over a time range for a given insight rule


name: cloudwatch:GetMetricData
access_level: Read
description:
Grants permission to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data


name: cloudwatch:PutDashboard
access_level: Write
description:
Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists


name: cloudwatch:PutMetricAlarm
access_level: Write
description:
Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric


name: cloudwatch:PutMetricStream
access_level: Write
description:
Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists


name: codeartifact:AssociateWithDownstreamRepository
access_level: Write
description:
Grants permission to associate an existing repository as an upstream repository to another repository


name: codeartifact:CopyPackageVersions
access_level: Write
description:
Grants permission to copy package versions from one repository to another repository in the same domain.


name: codeartifact:GetAuthorizationToken
access_level: Read
description:
Grants permission to generate a temporary authentication token for accessing repositories in a domain


name: codebuild:CreateReport
access_level: Write
description:
Creates a report. A report is created when tests specified in the buildspec file for a report groups run during the build of a project.


name: codebuild:CreateWebhook
access_level: Write
description:
For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables AWS CodeBuild to start rebuilding the source code every time a code change is pushed to the repository.


name: codebuild:DeleteOAuthToken
access_level: Write
description:
Deletes an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.


name: codebuild:DeleteWebhook
access_level: Write
description:
For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops AWS CodeBuild from rebuilding the source code every time a code change is pushed to the repository.


name: codebuild:ImportSourceCredentials
access_level: Write
description:
Imports the source repository credentials for an AWS CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository.


name: codebuild:ListBuildBatchesForProject
access_level: List
description:
Gets a list of build batch IDs for the specified build project, with each build batch ID representing a single build batch.


name: codebuild:ListBuildsForProject
access_level: List
description:
Gets a list of build IDs for the specified build project, with each build ID representing a single build.


name: codebuild:ListProjects
access_level: List
description:
Gets a list of build project names, with each build project name representing a single build project.


name: codebuild:ListReportsForReportGroup
access_level: List
description:
Returns a list of report ARNs that belong to the specified report group. Each report ARN represents one report.


name: codebuild:ListRepositories
access_level: List
description:
Lists source code repositories from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.


name: codebuild:ListSharedProjects
access_level: List
description:
Returns a list of project ARNs that have been shared with the requester. Each project ARN represents one project.


name: codebuild:ListSharedReportGroups
access_level: List
description:
Returns a list of report group ARNs that have been shared with the requester. Each report group ARN represents one report group.


name: codebuild:PersistOAuthToken
access_level: Write
description:
Saves an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console.


name: codecommit:BatchAssociateApprovalRuleTemplateWithRepositories
access_level: Write
description:
Grants permission to associate an approval rule template with multiple repositories in a single operation


name: codecommit:BatchDescribeMergeConflicts
access_level: Read
description:
Grants permission to get information about multiple merge conflicts when attempting to merge two commits using either the three-way merge or the squash merge option


name: codecommit:BatchDisassociateApprovalRuleTemplateFromRepositories
access_level: Write
description:
Grants permission to remove the association between an approval rule template and multiple repositories in a single operation


name: codecommit:BatchGetCommits
access_level: Read
description:
Grants permission to get return information about one or more commits in an AWS CodeCommit repository.


name: codecommit:BatchGetPullRequests
access_level: Read
description:
Grants permission to return information about one or more pull requests in an AWS CodeCommit repository


name: codecommit:CreateApprovalRuleTemplate
access_level: Write
description:
Grants permission to create an approval rule template that will automatically create approval rules in pull requests that match the conditions defined in the template; does not grant permission to create approval rules for individual pull requests


name: codecommit:CreateBranch
access_level: Write
description:
Grants permission to create a branch in an AWS CodeCommit repository with this API; does not control Git create branch actions


name: codecommit:CreateCommit
access_level: Write
description:
Grants permission to add, copy, move or update single or multiple files in a branch in an AWS CodeCommit repository, and generate a commit for the changes in the specified branch.


name: codecommit:CreatePullRequestApprovalRule
access_level: Write
description:
Grants permission to create an approval rule specific to an individual pull request; does not grant permission to create approval rule templates


name: codecommit:CreateUnreferencedMergeCommit
access_level: Write
description:
Grants permission to create an unreferenced commit that contains the result of merging two commits using either the three-way or the squash merge option; does not control Git merge actions


name: codecommit:DeleteBranch
access_level: Write
description:
Grants permission to delete a branch in an AWS CodeCommit repository with this API; does not control Git delete branch actions


name: codecommit:DeleteCommentContent
access_level: Write
description:
Grants permission to delete the content of a comment made on a change, file, or commit in a repository


name: codecommit:DeletePullRequestApprovalRule
access_level: Write
description:
Grants permission to delete approval rule created for a pull request if the rule was not created by an approval rule template


name: codecommit:DescribeMergeConflicts
access_level: Read
description:
Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option


name: codecommit:EvaluatePullRequestApprovalRules
access_level: Read
description:
Grants permission to evaluate whether a pull request is mergable based on its current approval state and approval rule requirements


name: codecommit:GetBlob
access_level: Read
description:
Grants permission to view the encoded content of an individual file in an AWS CodeCommit repository from the AWS CodeCommit console


name: codecommit:GetBranch
access_level: Read
description:
Grants permission to get details about a branch in an AWS CodeCommit repository with this API; does not control Git branch actions


name: codecommit:GetCommit
access_level: Read
description:
Grants permission to return information about a commit, including commit message and committer information, with this API; does not control Git log actions


name: codecommit:GetCommitsFromMergeBase
access_level: Read
description:
Grants permission to get information about the difference between commits in the context of a potential merge


name: codecommit:GetDifferences
access_level: Read
description:
Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference


name: codecommit:GetMergeCommit
access_level: Read
description:
Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits. Not all merge options create merge commits. This permission does not control Git merge actions


name: codecommit:GetMergeConflicts
access_level: Read
description:
Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository


name: codecommit:GetMergeOptions
access_level: Read
description:
Grants permission to get information about merge options for pull requests that can be used to merge two commits; does not control Git merge actions


name: codecommit:GetReferences
access_level: Read
description:
Grants permission to get details about references in an AWS CodeCommit repository; does not control Git reference actions


name: codecommit:GetTree
access_level: Read
description:
Grants permission to view the contents of a specified tree in an AWS CodeCommit repository from the AWS CodeCommit console


name: codecommit:GetUploadArchiveStatus
access_level: Read
description:
Grants permission to get status information about an archive upload to a pipeline in AWS CodePipeline


name: codecommit:ListBranches
access_level: List
description:
Grants permission to list branches for an AWS CodeCommit repository with this API; does not control Git branch actions


name: codecommit:ListRepositories
access_level: List
description:
Grants permission to list information about AWS CodeCommit repositories in the current Region for your AWS account


name: codecommit:MergeBranchesByFastForward
access_level: Write
description:
Grants permission to merge two commits into the specified destination branch using the fast-forward merge option


name: codecommit:MergeBranchesBySquash
access_level: Write
description:
Grants permission to merge two commits into the specified destination branch using the squash merge option


name: codecommit:MergeBranchesByThreeWay
access_level: Write
description:
Grants permission to merge two commits into the specified destination branch using the three-way merge option


name: codecommit:MergePullRequestByFastForward
access_level: Write
description:
Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the fast-forward merge option


name: codecommit:MergePullRequestBySquash
access_level: Write
description:
Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the squash merge option


name: codecommit:MergePullRequestByThreeWay
access_level: Write
description:
Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the three-way merge option


name: codecommit:OverridePullRequestApprovalRules
access_level: Write
description:
Grants permission to override all approval rules for a pull request, including approval rules created by a template


name: codecommit:PostCommentReply
access_level: Write
description:
Grants permission to post a comment in reply to a comment on a comparison between commits or a pull request


name: codecommit:PutFile
access_level: Write
description:
Grants permission to add or update a file in a branch in an AWS CodeCommit repository, and generate a commit for the addition in the specified branch


name: codecommit:TestRepositoryTriggers
access_level: Write
description:
Grants permission to test the functionality of repository triggers by sending information to the trigger target


name: codecommit:UpdateApprovalRuleTemplateContent
access_level: Write
description:
Grants permission to update the content of approval rule templates; does not grant permission to update content of approval rules created specifically for pull requests


name: codecommit:UpdateComment
access_level: Write
description:
Grants permission to update the contents of a comment if the identity matches the identity used to create the comment


name: codecommit:UpdatePullRequestApprovalRuleContent
access_level: Write
description:
Grants permission to update the content for approval rules created for a specific pull requests; does not grant permission to update approval rule content for rules created with an approval rule template


name: codecommit:UploadArchive
access_level: Write
description:
Grants permission to the service role for AWS CodePipeline to upload repository changes into a pipeline


name: codedeploy:BatchGetDeploymentTargets
access_level: Read
description:
Returns an array of one or more targets associated with a deployment. This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25.


name: codedeploy:ContinueDeployment
access_level: Write
description:
Starts the process of rerouting traffic from instances in the original environment to instances in thereplacement environment without waiting for a specified wait time to elapse.


name: codedeploy:GetApplicationRevision
access_level: List
description:
Get information about a single application revision for an application associated with the IAM user.


name: codedeploy:GetDeployment
access_level: List
description:
Get information about a single deployment to a deployment group for an application associated with the IAM user.


name: codedeploy:ListDeployments
access_level: List
description:
Get information about all deployments to a deployment group associated with the IAM user, or to get all deployments associated with the IAM user.


name: codedeploy:ListTagsForResource
access_level: List
description:
Returns a list of tags for the resource identified by a specified ARN. Tags are used to organize and categorize your CodeDeploy resources.


name: codedeploy:SkipWaitTimeForInstanceTermination
access_level: Write
description:
In a blue/green deployment, overrides any specified wait time and starts terminating instances immediately after the traffic routing is complete.


name: codedeploy:TagResource
access_level: Tagging
description:
Associates the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter.


name: codedeploy:UntagResource
access_level: Tagging
description:
Disassociates a resource from a list of tags. The resource is identified by the ResourceArn input parameter. The tags are identfied by the list of keys in the TagKeys input parameter.


name: codeguru-profiler:ConfigureAgent
access_level: Write
description:
Grants permission for an agent to register with the orchestration service and retrieve profiling configuration information


name: codeguru-profiler:GetFindingsReportAccountSummary
access_level: Read
description:
Grants permission to get a summary of recent recommendations for each profiling group in the account


name: codeguru-profiler:ListProfileTimes
access_level: List
description:
Grants permission to list the start times of the available aggregated profiles for a specific profiling group


name: codeguru-profiler:PostAgentProfile
access_level: Write
description:
Grants permission to submit a profile collected by an agent belonging to a specific profiling group for aggregation


name: codeguru-profiler:PutPermission
access_level: Permissions management
description:
Grants permission to update the list of principals allowed for an action group in the resource policy associated with the specified Profiling Group.


name: codeguru-profiler:RemovePermission
access_level: Permissions management
description:
Grants permission to remove the permission of specified Action Group from the resource policy associated with the specified Profiling Group.


name: codepipeline:AcknowledgeJob
access_level: Write
description:
Grants permission to view information about a specified job and whether that job has been received by the job worker


name: codepipeline:AcknowledgeThirdPartyJob
access_level: Write
description:
Grants permission to confirm that a job worker has received the specified job (partner actions only)


name: codepipeline:CreateCustomActionType
access_level: Tagging
description:
Grants permission to create a custom action that you can use in the pipelines associated with your AWS account


name: codepipeline:DeregisterWebhookWithThirdParty
access_level: Write
description:
Grants permission to remove the registration of a webhook with the third party specified in its configuration


name: codepipeline:GetPipelineExecution
access_level: Read
description:
Grants permission to view information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline


name: codepipeline:GetPipelineState
access_level: Read
description:
Grants permission to view information about the current state of the stages and actions of a pipeline


name: codepipeline:PollForThirdPartyJobs
access_level: Write
description:
Grants permission to determine whether there are any third-party jobs for a job worker to act on (partner actions only)


name: codepipeline:PutApprovalResult
access_level: Write
description:
Grants permission to provide a response (Approved or Rejected) to a manual approval request in CodePipeline


name: codepipeline:PutJobFailureResult
access_level: Write
description:
Grants permission to represent the failure of a job as returned to the pipeline by a job worker (custom actions only)


name: codepipeline:PutJobSuccessResult
access_level: Write
description:
Grants permission to represent the success of a job as returned to the pipeline by a job worker (custom actions only)


name: codepipeline:PutThirdPartyJobFailureResult
access_level: Write
description:
Grants permission to represent the failure of a third-party job as returned to the pipeline by a job worker (partner actions only)


name: codepipeline:PutThirdPartyJobSuccessResult
access_level: Write
description:
Grants permission to represent the success of a third-party job as returned to the pipeline by a job worker (partner actions only)


name: codestar:DeleteProject
access_level: Permissions management
description:
Deletes a project, including project resources. Does not delete users associated with the project, but does delete the IAM roles that allowed access to the project.


name: codestar:DeleteUserProfile
access_level: Write
description:
Deletes a user profile in AWS CodeStar, including all personal preference data associated with that profile, such as display name and email address. It does not delete the history of that user, for example the history of commits made by that user.


name: codestar:DisassociateTeamMember
access_level: Permissions management
description:
Removes a user from a project. Removing a user from a project also removes the IAM policies from that user that allowed access to the project and its resources.


name: codestar-connections:GetIndividualAccessToken
access_level: Read
description:
Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection


name: codestar-connections:PassConnection
access_level: Read
description:
Grants permission to pass a Connection resource to an AWS service that accepts a Connection ARN as input, such as codepipeline:CreatePipeline


name: codestar-connections:RegisterAppCode
access_level: Read
description:
Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host


name: codestar-connections:UpdateConnectionInstallation
access_level: Write
description:
Grants permission to update a Connection resource with an installation of the CodeStar Connections App


name: cognito-identity:DeleteIdentities
access_level: Write
description:
Grants permission to delete identities from an identity pool. You can specify a list of 1-60 identities that you want to delete


name: cognito-identity:DeleteIdentityPool
access_level: Write
description:
Grants permission to delete a user pool. Once a pool is deleted, users will not be able to authenticate with the pool


name: cognito-identity:DescribeIdentity
access_level: Read
description:
Grants permission to return metadata related to the given identity, including when the identity was created and any associated linked logins


name: cognito-identity:DescribeIdentityPool
access_level: Read
description:
Grants permission to get details about a particular identity pool, including the pool name, ID description, creation date, and current number of users


name: cognito-identity:GetId
access_level: Write
description:
Grants permission to generate (or retrieve) a Cognito ID. Supplying multiple logins will create an implicit linked account


name: cognito-identity:GetOpenIdTokenForDeveloperIdentity
access_level: Read
description:
Grants permission to register (or retrieve) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process


name: cognito-identity:LookupDeveloperIdentity
access_level: Read
description:
Grants permission to retrieve the IdentityId associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifiers associated with an IdentityId for an existing identity


name: cognito-identity:MergeDeveloperIdentities
access_level: Write
description:
Grants permission to merge two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider


name: cognito-identity:SetIdentityPoolRoles
access_level: Write
description:
Grants permission to set the roles for an identity pool. These roles are used when making calls to GetCredentialsForIdentity action


name: cognito-identity:SetPrincipalTagAttributeMap
access_level: Write
description:
Grants permission to set the principal tags for an identity pool and provider. These tags are used when making calls to GetOpenIdToken action


name: cognito-idp:AdminLinkProviderForUser
access_level: Write
description:
Links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider.


name: cognito-idp:DescribeUserPoolClient
access_level: Read
description:
Client method for returning the configuration information and metadata of the specified user pool client.


name: cognito-idp:ForgotPassword
access_level: Write
description:
Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password.


name: cognito-idp:GetUICustomization
access_level: Read
description:
Gets the UI Customization information for a particular app client's app UI, if there is something set.


name: cognito-idp:SignUp
access_level: Write
description:
Registers the user in the specified user pool and creates a user name, password, and user attributes.


name: cognito-idp:VerifySoftwareToken
access_level: Write
description:
Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful.


name: cognito-sync:ListRecords
access_level: Read
description:
Gets paginated records, optionally changed after a particular sync count for a dataset and identity.


name: comprehend:BatchDetectEntities
access_level: Read
description:
Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given list of text documents


name: comprehend:BatchDetectKeyPhrases
access_level: Read
description:
Grants permission to detect the phrases in the list of text documents that are most indicative of the content


name: comprehend:BatchDetectSentiment
access_level: Read
description:
Grants permission to detect the sentiment of a text in the list of documents (Positive, Negative, Neutral, or Mixed)


name: comprehend:BatchDetectSyntax
access_level: Read
description:
Grants permission to detect syntactic information (like Part of Speech, Tokens) in a list of text documents


name: comprehend:ClassifyDocument
access_level: Read
description:
Grants permission to create a new document classification request to analyze a single document in real-time, using a previously created and trained custom model and an endpoint


name: comprehend:ContainsPiiEntities
access_level: Read
description:
Grants permission to classify the personally identifiable information within given documents at realtime


name: comprehend:CreateEndpoint
access_level: Write
description:
Grants permission to create a model-specific endpoint for synchronous inference for a previously trained custom model


name: comprehend:DeleteEndpoint
access_level: Write
description:
Grants permission to delete a model-specific endpoint for a previously-trained custom model. All endpoints must be deleted in order for the model to be deleted


name: comprehend:DescribeEndpoint
access_level: Read
description:
Grants permission to get the properties associated with a specific endpoint. Use this operation to get the status of an endpoint


name: comprehend:DescribeEntityRecognizer
access_level: Read
description:
Grants permission to provide details about an entity recognizer including status, S3 buckets containing training data, recognizer metadata, metrics, and so on


name: comprehend:DetectEntities
access_level: Read
description:
Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given text document


name: comprehend:DetectPiiEntities
access_level: Read
description:
Grants permission to detect the personally identifiable information entities ("Name", "SSN", "PIN", etc) within the given text document


name: comprehend:DetectSentiment
access_level: Read
description:
Grants permission to detect the sentiment of a text in a document (Positive, Negative, Neutral, or Mixed)


name: comprehend:ListEntityRecognizers
access_level: Read
description:
Grants permission to get a list of the properties of all entity recognizers that you created, including recognizers currently in training


name: comprehend:StartDominantLanguageDetectionJob
access_level: Write
description:
Grants permission to start an asynchronous dominant language detection job for a collection of documents


name: comprehend:StartTopicsDetectionJob
access_level: Write
description:
Grants permission to start an asynchronous job to detect the most common topics in the collection of documents and the phrases associated with each topic


name: comprehendmedical:DescribeEntitiesDetectionV2Job
access_level: Read
description:
Grants permission to describe the properties of a medical entity detection job that you have submitted


name: comprehendmedical:DetectEntitiesV2
access_level: Read
description:
Grants permission to detect the named medical entities, and their relationships and traits within the given text document


name: comprehendmedical:DetectPHI
access_level: Read
description:
Grants permission to detect the protected health information (PHI) entities within the given text document


name: comprehendmedical:InferICD10CM
access_level: Read
description:
Grants permission to detect the medical condition entities within the given text document and link them to ICD-10-CM codes


name: comprehendmedical:InferRxNorm
access_level: Read
description:
Grants permission to detect the medication entities within the given text document and link them to RxCUI concept identifiers from the National Library of Medicine RxNorm database


name: comprehendmedical:StartEntitiesDetectionV2Job
access_level: Write
description:
Grants permission to start an asynchronous medical entity detection job for a collection of documents


name: config:BatchGetAggregateResourceConfig
access_level: Read
description:
Grants permission to return the current configuration items for resources that are present in your AWS Config aggregator


name: config:DeleteAggregationAuthorization
access_level: Write
description:
Grants permission to delete the authorization granted to the specified configuration aggregator account in a specified region


name: config:DeleteConfigurationAggregator
access_level: Write
description:
Grants permission to delete the specified configuration aggregator and the aggregated data associated with the aggregator


name: config:DeleteConformancePack
access_level: Write
description:
Grants permission to delete the specified conformance pack and all the AWS Config rules and all evaluation results within that conformance pack


name: config:DeleteOrganizationConfigRule
access_level: Write
description:
Grants permission to delete the specified organization config rule and all of its evaluation results from all member accounts in that organization


name: config:DeleteOrganizationConformancePack
access_level: Write
description:
Grants permission to delete the specified organization conformance pack and all of its evaluation results from all member accounts in that organization


name: config:DeletePendingAggregationRequest
access_level: Write
description:
Grants permission to delete pending authorization requests for a specified aggregator account in a specified region


name: config:DeleteRemediationExceptions
access_level: Write
description:
Grants permission to delete one or more remediation exceptions for specific resource keys for a specific AWS Config Rule


name: config:DeliverConfigSnapshot
access_level: Read
description:
Grants permission to schedule delivery of a configuration snapshot to the Amazon S3 bucket in the specified delivery channel


name: config:DescribeAggregateComplianceByConfigRules
access_level: Read
description:
Grants permission to return a list of compliant and noncompliant rules with the number of resources for compliant and noncompliant rules


name: config:DescribeAggregateComplianceByConformancePacks
access_level: Read
description:
Grants permission to return a list of compliant and noncompliant conformance packs along with count of compliant, non-compliant and total rules within each conformance pack


name: config:DescribeAggregationAuthorizations
access_level: List
description:
Grants permission to return a list of authorizations granted to various aggregator accounts and regions


name: config:DescribeRemediationExecutionStatus
access_level: Read
description:
Grants permission to provide a detailed view of a Remediation Execution for a set of resources including state, timestamps and any error messages for steps that have failed


name: config:GetAggregateComplianceDetailsByConfigRule
access_level: Read
description:
Grants permission to return the evaluation results for the specified AWS Config rule for a specific resource in a rule


name: config:GetAggregateConfigRuleComplianceSummary
access_level: Read
description:
Grants permission to return the number of compliant and noncompliant rules for one or more accounts and regions in an aggregator


name: config:GetAggregateConformancePackComplianceSummary
access_level: Read
description:
Grants permission to return the number of compliant and noncompliant conformance packs for one or more accounts and regions in an aggregator


name: config:GetAggregateDiscoveredResourceCounts
access_level: Read
description:
Grants permission to return the resource counts across accounts and regions that are present in your AWS Config aggregator


name: config:GetAggregateResourceConfig
access_level: Read
description:
Grants permission to return configuration item that is aggregated for your specific resource in a specific source account and region


name: config:GetComplianceSummaryByConfigRule
access_level: Read
description:
Grants permission to return the number of AWS Config rules that are compliant and noncompliant, up to a maximum of 25 for each


name: config:GetComplianceSummaryByResourceType
access_level: Read
description:
Grants permission to return the number of resources that are compliant and the number that are noncompliant


name: config:GetConformancePackComplianceDetails
access_level: Read
description:
Grants permission to return compliance details of a conformance pack for all AWS resources that are monitered by conformance pack


name: config:GetDiscoveredResourceCounts
access_level: Read
description:
Grants permission to return the resource types, the number of each resource type, and the total number of resources that AWS Config is recording in this region for your AWS account


name: config:GetOrganizationConfigRuleDetailedStatus
access_level: Read
description:
Grants permission to return detailed status for each member account within an organization for a given organization config rule


name: config:GetOrganizationConformancePackDetailedStatus
access_level: Read
description:
Grants permission to return detailed status for each member account within an organization for a given organization conformance pack


name: config:ListAggregateDiscoveredResources
access_level: List
description:
Grants permission to accept a resource type and returns a list of resource identifiers that are aggregated for a specific resource type across accounts and regions


name: config:ListDiscoveredResources
access_level: List
description:
Grants permission to accept a resource type and returns a list of resource identifiers for the resources of that type


name: config:PutAggregationAuthorization
access_level: Write
description:
Grants permission to authorize the aggregator account and region to collect data from the source account and region


name: config:PutConfigRule
access_level: Write
description:
Grants permission to add or update an AWS Config rule for evaluating whether your AWS resources comply with your desired configurations


name: config:PutConfigurationAggregator
access_level: Write
description:
Grants permission to create and update the configuration aggregator with the selected source accounts and regions


name: config:PutConfigurationRecorder
access_level: Write
description:
Grants permission to create a new configuration recorder to record the selected resource configurations


name: config:PutDeliveryChannel
access_level: Write
description:
Grants permission to create a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic


name: config:PutOrganizationConfigRule
access_level: Write
description:
Grants permission to add or update organization config rule for your entire organization evaluating whether your AWS resources comply with your desired configurations


name: config:PutOrganizationConformancePack
access_level: Write
description:
Grants permission to add or update organization conformance pack for your entire organization evaluating whether your AWS resources comply with your desired configurations


name: config:PutRemediationConfigurations
access_level: Write
description:
Grants permission to add or update the remediation configuration with a specific AWS Config rule with the selected target or action


name: config:PutRemediationExceptions
access_level: Write
description:
Grants permission to add or update remediation exceptions for specific resources for a specific AWS Config rule


name: config:PutRetentionConfiguration
access_level: Write
description:
Grants permission to create and update the retention configuration with details about retention period (number of days) that AWS Config stores your historical information


name: config:SelectAggregateResourceConfig
access_level: Read
description:
Grants permission to accept a structured query language (SQL) SELECT command and an aggregator to query configuration state of AWS resources across multiple accounts and regions, performs the corresponding search, and returns resource configurations matching the properties


name: config:SelectResourceConfig
access_level: Read
description:
Grants permission to accept a structured query language (SQL) SELECT command, performs the corresponding search, and returns resource configurations matching the properties


name: config:StartConfigurationRecorder
access_level: Write
description:
Grants permission to start recording configurations of the AWS resources you have selected to record in your AWS account


name: config:StartRemediationExecution
access_level: Write
description:
Grants permission to run an on-demand remediation for the specified AWS Config rules against the last known remediation configuration


name: config:StopConfigurationRecorder
access_level: Write
description:
Grants permission to stop recording configurations of the AWS resources you have selected to record in your AWS account


name: connect:AssociateApprovedOrigin
access_level: Write
description:
Grants permissions to associate approved origin for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:AssociateBot
access_level: Write
description:
Grants permissions to associate a Lex bot for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:AssociateCustomerProfilesDomain
access_level: Write
description:
Grants permissions to associate a Customer Profiles domain for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:AssociateInstanceStorageConfig
access_level: Write
description:
Grants permissions to associate instance storage for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:AssociateLambdaFunction
access_level: Write
description:
Grants permissions to associate a Lambda function for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:AssociateSecurityKey
access_level: Write
description:
Grants permissions to associate a security key for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:CreateInstance
access_level: Write
description:
Grants permissions to create a new Amazon Connect instance. The associated required actions grant permissions to configure instance settings.


name: connect:DeleteInstance
access_level: Write
description:
Grants permissions to delete an Amazon Connect instance. When you remove an instance, the link to an existing AWS directory is also removed.


name: connect:DeleteIntegrationAssociation
access_level: Write
description:
Grants permissions to delete an AppIntegration association from an Amazon Connect instance. The association must not have any use cases associated with it.


name: connect:DescribeInstance
access_level: Read
description:
Grants permissions to view details of an Amazon Connect instance. This is required to create an instance.


name: connect:DescribeInstanceStorageConfig
access_level: Read
description:
Grants permissions to view the instance storage configuration for an existing Amazon Connect instance


name: connect:DisassociateApprovedOrigin
access_level: Write
description:
Grants permissions to disassociate approved origin for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:DisassociateBot
access_level: Write
description:
Grants permissions to disassociate a Lex bot for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:DisassociateCustomerProfilesDomain
access_level: Write
description:
Grants permissions to disassociate a Customer Profiles domain for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:DisassociateInstanceStorageConfig
access_level: Write
description:
Grants permissions to disassociate instance storage for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:DisassociateLambdaFunction
access_level: Write
description:
Grants permissions to disassociate a Lambda function for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:DisassociateSecurityKey
access_level: Write
description:
Grants permissions to disassociate the security key for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:GetFederationToken
access_level: Read
description:
Grants permissions to federate into an Amazon Connect instance when using SAML-based authentication for identity management


name: connect:GetFederationTokens
access_level: Write
description:
Grants permissions to federate into an Amazon Connect instance (Log in for emergency access functionality in the Amazon Connect console)


name: connect:ListIntegrationAssociations
access_level: List
description:
Grants permissions to list summary information about the AppIntegration associations for the specified Amazon Connect instance


name: connect:StopContact
access_level: Write
description:
Grants permissions to stop contacts that were initiated using the Amazon Connect API. If you use this operation on an active contact the contact ends, even if the agent is active on a call with a customer.


name: connect:UpdateContactFlowName
access_level: Write
description:
Grants permissions to update the name and description of a contact flow in an Amazon Connect instance


name: connect:UpdateInstanceAttribute
access_level: Write
description:
Grants permissions to update the attribute for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: connect:UpdateInstanceStorageConfig
access_level: Write
description:
Grants permissions to update the storage configuration for an existing Amazon Connect instance. The associated required actions grant permission to modify the settings for the instance.


name: controltower:DeregisterManagedAccount
access_level: Write
description:
Grants permission to deregister an account created through the account factory from AWS Control Tower.


name: controltower:DescribeManagedOrganizationalUnit
access_level: Read
description:
Grants permission to describe an AWS Organizations organizational unit managed by AWS Control Tower.


name: datapipeline:ActivatePipeline
access_level: Write
description:
Validates the specified pipeline and starts processing pipeline tasks. If the pipeline does not pass validation, activation fails.


name: datapipeline:SetStatus
access_level: Write
description:
Requests that the status of the specified physical or logical pipeline objects be updated in the specified pipeline.


name: datapipeline:SetTaskStatus
access_level: Write
description:
Task runners call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status.


name: datapipeline:ValidatePipelineDefinition
access_level: Read
description:
Validates the specified pipeline definition to ensure that it is well formed and can be run without error.


name: datasync:DescribeAgent
access_level: Read
description:
Grants permission to view metadata such as name, network interfaces, and the status (that is, whether the agent is running or not) about a sync agent


name: datasync:DescribeLocationFsxWindows
access_level: Read
description:
Grants permission to view metadata, such as the path information about an Amazon FSx Windows sync location


name: dax:ConditionCheckItem
access_level: Read
description:
The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key


name: dax:CreateParameterGroup
access_level: Write
description:
The CreateParameterGroup action creates collection of parameters that you apply to all of the nodes in a DAX cluster.


name: dax:Query
access_level: Read
description:
The Query action finds items based on primary key values. You can query any table or secondary index that has a composite primary key (a partition key and a sort key).


name: dax:Scan
access_level: Read
description:
The Scan action returns one or more items and item attributes by accessing every item in a table or a secondary index.


name: dax:UpdateItem
access_level: Write
description:
The UpdateItem action edits an existing item's attributes, or adds a new item to the table if it does not already exist.


name: deepcomposer:AssociateCoupon
access_level: Write
description:
Grants permission to associate a DeepComposer coupon (or DSN) with the account associated with the sender of the request


name: deepcomposer:CreateModel
access_level: Write
description:
Grants permission to start creating/training a generative-model that is able to perform inference against the user-provided piano-melody to create a multi-track midi composition


name: deeplens:AssociateServiceRoleToAccount
access_level: Permissions management
description:
Associates the user's account with IAM roles controlling various permissions needed by AWS DeepLens for proper functionality.


name: deeplens:CreateDeviceCertificates
access_level: Write
description:
Creates a certificate package that is used to successfully authenticate and Register an AWS DeepLens device.


name: deeplens:GetDeploymentStatus
access_level: Read
description:
Retrieves the the deployment status of a particular AWS DeepLens device, along with any associated metadata.


name: deepracer:AdminListAssociatedResources
access_level: Read
description:
Grants permission to list all deepracer users with their associated resources created under this account


name: deepracer:GetLatestUserSubmission
access_level: Read
description:
Grants permission to retrieve information about how the latest submitted DeepRacer model for a user performed on a leaderboard


name: deepracer:GetRankedUserSubmission
access_level: Read
description:
Grants permission to retrieve information about the performance of a user's DeepRacer model that got placed on a leaderboard


name: detective:CreateMembers
access_level: Write
description:
Grants permission to request the membership of one or more accounts in a behavior graph managed by this account


name: detective:ListInvitations
access_level: List
description:
Grants permission to retrieve details on the behavior graphs to which this account has been invited to join


name: detective:StartMonitoringMember
access_level: Write
description:
Grants permission to start data ingest for a member account that has a status of ACCEPTED_BUT_DISABLED.


name: devicefarm:GetAccountSettings
access_level: Read
description:
Grants permission to retrieve the number of unmetered iOS and/or unmetered Android devices purchased by the account


name: devicefarm:GetDevicePoolCompatibility
access_level: Read
description:
Grants permission to retrieve information about the compatibility of a test and/or app with a device pool


name: devicefarm:GetOfferingStatus
access_level: Read
description:
Grants permission to retrieve the current status and future status of all offerings purchased by an AWS account


name: devicefarm:GetVPCEConfiguration
access_level: Read
description:
Grants permission to retireve the information of an Amazon Virtual Private Cloud (VPC) endpoint configuration


name: devicefarm:ListOfferingTransactions
access_level: List
description:
Grants permission to list all of the historical purchases, renewals, and system renewal transactions for an AWS account


name: devicefarm:ListVPCEConfigurations
access_level: List
description:
Grants permission to list the information of Amazon Virtual Private Cloud (VPC) endpoint configurations


name: devops-guru:DescribeResourceCollectionHealth
access_level: Read
description:
Grants permission to view the health of operations for each AWS CloudFormation stack specified in DevOps Guru


name: devops-guru:DescribeServiceIntegration
access_level: Read
description:
Grants permission to view the integration status of services that can be integrated with DevOps Guru


name: devops-guru:UpdateResourceCollection
access_level: Write
description:
Grants permission to update the list of AWS CloudFormation stacks that are used to specify which AWS resources in your account are analyzed by DevOps Guru


name: directconnect:AllocateHostedConnection
access_level: Write
description:
Creates a new hosted connection between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.


name: directconnect:AssociateHostedConnection
access_level: Write
description:
Associates a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect.


name: directconnect:CreateDirectConnectGateway
access_level: Write
description:
Creates a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways.


name: directconnect:CreateDirectConnectGatewayAssociationProposal
access_level: Write
description:
Creates a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway.


name: directconnect:CreateInterconnect
access_level: Write
description:
Creates a new interconnect between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.


name: directconnect:CreateLag
access_level: Write
description:
Creates a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific AWS Direct Connect location.


name: directconnect:DeleteBGPPeer
access_level: Write
description:
Deletes the specified BGP peer on the specified virtual interface with the specified customer address and ASN.


name: directconnect:DeleteDirectConnectGatewayAssociationProposal
access_level: Write
description:
Deletes the association proposal request between the specified Direct Connect gateway and virtual private gateway.


name: directconnect:DescribeDirectConnectGatewayAssociationProposals
access_level: Read
description:
Describes one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway.


name: directconnect:DescribeHostedConnections
access_level: Read
description:
Lists the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG).


name: directconnect:StartBgpFailoverTest
access_level: Write
description:
Starts the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state. You can then send traffic to verify that there are no outages.


name: directconnect:TagResource
access_level: Tagging
description:
Adds the specified tags to the specified AWS Direct Connect resource. Each resource can have a maximum of 50 tags.


name: discovery:BatchDeleteImportData
access_level: Write
description:
Deletes one or more Migration Hub import tasks, each identified by their import ID. Each import task has a number of records, which can identify servers or applications.


name: discovery:CreateTags
access_level: Tagging
description:
Creates one or more tags for configuration items. Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items.


name: discovery:DeleteTags
access_level: Tagging
description:
Deletes the association between configuration items and one or more tags. This API accepts a list of multiple configuration items.


name: discovery:DescribeAgents
access_level: Read
description:
Lists agents or the Connector by ID or lists all agents/Connectors associated with your user account if you did not specify an ID.


name: discovery:DescribeConfigurations
access_level: Read
description:
Retrieves attributes for a list of configuration item IDs. All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output fields are specific to the asset type selected. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, and number of network cards.


name: discovery:DescribeContinuousExports
access_level: Read
description:
Lists exports as specified by ID. All continuous exports associated with your user account can be listed if you call DescribeContinuousExports as is without passing any parameters.


name: discovery:DescribeExportConfigurations
access_level: Read
description:
Retrieves the status of a given export process. You can retrieve status from a maximum of 100 processes.


name: discovery:DescribeImportTasks
access_level: List
description:
Returns an array of import tasks for your account, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more.


name: discovery:DescribeTags
access_level: Read
description:
Retrieves a list of configuration items that are tagged with a specific tag. Or retrieves a list of all tags assigned to a specific configuration item.


name: discovery:ExportConfigurations
access_level: Write
description:
Exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data. Data includes tags and tag associations, processes, connections, servers, and system performance.


name: discovery:ListConfigurations
access_level: List
description:
Retrieves a list of configuration items according to criteria you specify in a filter. The filter criteria identify relationship requirements.


name: discovery:StartExportTask
access_level: Write
description:
Export the configuration data about discovered configuration items and relationships to an S3 bucket in a specified format.


name: discovery:StartImportTask
access_level: Write
description:
Starts an import task. The Migration Hub import feature allows you to import details of your on-premises environment directly into AWS without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data including the ability to group your devices as applications and track their migration status.


name: dlm:CreateLifecyclePolicy
access_level: Write
description:
Create a data lifecycle policy to manage the scheduled creation and retention of Amazon EBS snapshots. You may have up to 100 policies.


name: dlm:DeleteLifecyclePolicy
access_level: Write
description:
Delete an existing data lifecycle policy. In addition, this action halts the creation and deletion of snapshots that the policy specified. Existing snapshots are not affected.


name: dms:AddTagsToResource
access_level: Tagging
description:
Grants permission to add metadata tags to DMS resources, including replication instances, endpoints, security groups, and migration tasks


name: dms:ApplyPendingMaintenanceAction
access_level: Write
description:
Grants permission to apply a pending maintenance action to a resource (for example, to a replication instance)


name: dms:DescribeApplicableIndividualAssessments
access_level: Read
description:
Grants permission to list individual assessments that you can specify for a new premigration assessment run


name: dms:DescribeConnections
access_level: Read
description:
Grants permission to describe the status of the connections that have been made between the replication instance and an endpoint


name: dms:DescribeEndpointSettings
access_level: Read
description:
Grants permission to return the possible endpoint settings available when you create an endpoint for a specific database engine


name: dms:DescribeEventCategories
access_level: Read
description:
Grants permission to list categories for all event source types, or, if specified, for a specified source type


name: dms:DescribeOrderableReplicationInstances
access_level: Read
description:
Grants permission to return information about the replication instance types that can be created in the specified region


name: dms:DescribeReplicationInstances
access_level: Read
description:
Grants permission to return information about replication instances for your account in the current region


name: dms:DescribeReplicationTaskAssessmentRuns
access_level: Read
description:
Grants permission to return a paginated list of premigration assessment runs based on filter settings


name: dms:DescribeReplicationTasks
access_level: Read
description:
Grants permission to return information about replication tasks for your account in the current region


name: dms:DescribeTableStatistics
access_level: Read
description:
Grants permission to return table statistics on the database migration task, including table name, rows inserted, rows updated, and rows deleted


name: dms:RebootReplicationInstance
access_level: Write
description:
Grants permission to reboot a replication instance. Rebooting results in a momentary outage, until the replication instance becomes available again


name: dms:StartReplicationTaskAssessment
access_level: Write
description:
Grants permission to start the replication task assessment for unsupported data types in the source database


name: dms:StartReplicationTaskAssessmentRun
access_level: Write
description:
Grants permission to start a new premigration assessment run for one or more individual assessments of a migration task


name: ds:AddIpRoutes
access_level: Write
description:
Adds a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services


name: ds:CreateLogSubscription
access_level: Write
description:
Creates a subscription to forward real time Directory Service domain controller security logs to the specified CloudWatch log group in your AWS account.


name: ds:CreateTrust
access_level: Write
description:
Initiates the creation of the AWS side of a trust relationship between a Microsoft AD in the AWS cloud and an external domain.


name: ds:DeleteTrust
access_level: Write
description:
Deletes an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain.


name: ds:DisableRadius
access_level: Write
description:
Disables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.


name: ds:EnableRadius
access_level: Write
description:
Enables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.


name: ds:RemoveRegion
access_level: Write
description:
Stops all replication and removes the domain controllers from the specified Region. You cannot remove the primary Region with this operation.


name: ds:ShareDirectory
access_level: Write
description:
Shares a specified directory in your AWS account (directory owner) with another AWS account (directory consumer). With this operation you can use your directory from any AWS account and from any Amazon VPC within an AWS Region.


name: ds:UpdateNumberOfDomainControllers
access_level: Write
description:
Adds or removes domain controllers to or from the directory. Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request.


name: ds:UpdateRadius
access_level: Write
description:
Updates the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector directory.


name: ds:UpdateTrust
access_level: Write
description:
Updates the trust that has been set up between your AWS Managed Microsoft AD directory and an on-premises Active Directory.


name: dynamodb:DescribeContributorInsights
access_level: Read
description:
Describes the contributor insights status and related details for a given table or global secondary index


name: dynamodb:DescribeLimits
access_level: Read
description:
Returns the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there


name: dynamodb:DescribeStream
access_level: Read
description:
Returns information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table


name: dynamodb:EnableKinesisStreamingDestination
access_level: Write
description:
Grants permission to start table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow


name: dynamodb:ListContributorInsights
access_level: List
description:
Lists the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint


name: dynamodb:PartiQLInsert
access_level: Write
description:
Grants permission to create a new item, if an item with same primary key does not exist in the table


name: dynamodb:Query
access_level: Read
description:
Uses the primary key of a table or a secondary index to directly access items from that table or index


name: dynamodb:Scan
access_level: Read
description:
Returns one or more items and item attributes by accessing every item in a table or a secondary index


name: dynamodb:UpdateTable
access_level: Write
description:
Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table


name: ebs:CompleteSnapshot
access_level: Write
description:
Grants permission to seal and complete the snapshot after all of the required blocks of data have been written to it.


name: ebs:ListChangedBlocks
access_level: Read
description:
Grants permission to list the blocks that are different between two Amazon Elastic Block Store (EBS) snapshots of the same volume/snapshot lineage


name: ec2:AcceptVpcEndpointConnections
access_level: Write
description:
Grants permission to accept one or more interface VPC endpoint connections to your VPC endpoint service


name: ec2:AdvertiseByoipCidr
access_level: Write
description:
Grants permission to advertise an IP address range that is provisioned for use in AWS through bring your own IP addresses (BYOIP)


name: ec2:ApplySecurityGroupsToClientVpnTargetNetwork
access_level: Write
description:
Grants permission to apply a security group to the association between a Client VPN endpoint and a target network


name: ec2:AssociateTransitGatewayMulticastDomain
access_level: Write
description:
Grants permission to associate an attachment and list of subnets with a transit gateway multicast domain


name: ec2:AttachClassicLinkVpc
access_level: Write
description:
Grants permission to link an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC's security groups


name: ec2:AttachVolume
access_level: Write
description:
Grants permission to attach an EBS volume to a running or stopped instance and expose it to the instance with the specified device name


name: ec2:CopyFpgaImage
access_level: Write
description:
Grants permission to copy a source Amazon FPGA image (AFI) to the current Region. Resource-level permissions specified for this action apply to the new AFI only. They do not apply to the source AFI


name: ec2:CopyImage
access_level: Write
description:
Grants permission to copy an Amazon Machine Image (AMI) from a source Region to the current Region. Resource-level permissions specified for this action apply to the new AMI only. They do not apply to the source AMI


name: ec2:CopySnapshot
access_level: Write
description:
Grants permission to copy a point-in-time snapshot of an EBS volume and store it in Amazon S3. Resource-level permissions specified for this action apply to the new snapshot only. They do not apply to the source snapshot


name: ec2:CreateCustomerGateway
access_level: Write
description:
Grants permission to create a customer gateway, which provides information to AWS about your customer gateway device


name: ec2:CreateImage
access_level: Write
description:
Grants permission to create an Amazon EBS-backed AMI from a stopped or running Amazon EBS-backed instance


name: ec2:CreateNetworkInterfacePermission
access_level: Permissions management
description:
Grants permission to create a permission for an AWS-authorized user to perform certain operations on a network interface


name: ec2:CreateReservedInstancesListing
access_level: Write
description:
Grants permission to create a listing for Standard Reserved Instances to be sold in the Reserved Instance Marketplace


name: ec2:CreateRestoreImageTask
access_level: Write
description:
Grants permission to start a task that restores an AMI from an S3 object previously created by using CreateStoreImageTask


name: ec2:CreateSnapshots
access_level: Write
description:
Grants permission to create crash-consistent snapshots of multiple EBS volumes and store them in Amazon S3


name: ec2:CreateTransitGatewayPeeringAttachment
access_level: Write
description:
Grants permission to request a transit gateway peering attachment between a requester and accepter transit gateway


name: ec2:CreateVpcEndpointServiceConfiguration
access_level: Write
description:
Grants permission to create a VPC endpoint service configuration to which service consumers (AWS accounts, IAM users, and IAM roles) can connect


name: ec2:CreateVpnConnection
access_level: Write
description:
Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway


name: ec2:CreateVpnConnectionRoute
access_level: Write
description:
Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway


name: ec2:DeleteVpnConnectionRoute
access_level: Write
description:
Grants permission to delete a static route for a VPN connection between a virtual private gateway and a customer gateway


name: ec2:DeprovisionByoipCidr
access_level: Write
description:
Grants permission to release an IP address range that was provisioned through bring your own IP addresses (BYOIP), and to delete the corresponding address pool


name: ec2:DeregisterInstanceEventNotificationAttributes
access_level: Write
description:
Grants permission to remove tags from the set of tags to include in notifications about scheduled events for your instances


name: ec2:DeregisterTransitGatewayMulticastGroupMembers
access_level: Write
description:
Grants permission to deregister one or more network interface members from a group IP address in a transit gateway multicast domain


name: ec2:DeregisterTransitGatewayMulticastGroupSources
access_level: Write
description:
Grants permission to deregister one or more network interface sources from a group IP address in a transit gateway multicast domain


name: ec2:DescribeByoipCidrs
access_level: List
description:
Grants permission to describe the IP address ranges that were provisioned through bring your own IP addresses (BYOIP)


name: ec2:DescribeClientVpnConnections
access_level: List
description:
Grants permission to describe active client connections and connections that have been terminated within the last 60 minutes for a Client VPN endpoint


name: ec2:DescribeCoipPools
access_level: List
description:
Grants permission to describe the specified customer-owned address pools or all of your customer-owned address pools


name: ec2:DescribeHostReservations
access_level: List
description:
Grants permission to describe the Dedicated Host Reservations that are associated with Dedicated Hosts in the AWS account


name: ec2:DescribeIdentityIdFormat
access_level: List
description:
Grants permission to describe the ID format settings for resources for an IAM user, IAM role, or root user


name: ec2:DescribeInstanceCreditSpecifications
access_level: List
description:
Grants permission to describe the credit option for CPU usage of one or more burstable performance instances


name: ec2:DescribeInstanceEventNotificationAttributes
access_level: List
description:
Grants permission to describe the set of tags to include in notifications about scheduled events for your instances


name: ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
access_level: List
description:
Grants permission to describe the associations between virtual interface groups and local gateway route tables


name: ec2:DescribePrincipalIdFormat
access_level: List
description:
Grants permission to describe the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference


name: ec2:DescribeReservedInstancesListings
access_level: List
description:
Grants permission to describe your account's Reserved Instance listings in the Reserved Instance Marketplace


name: ec2:DescribeSecurityGroupReferences
access_level: List
description:
Grants permission to describe the VPCs on the other side of a VPC peering connection that are referencing specified VPC security groups


name: ec2:DescribeVpcEndpointConnectionNotifications
access_level: List
description:
Grants permission to describe the connection notifications for VPC endpoints and VPC endpoint services


name: ec2:DescribeVpcEndpointServicePermissions
access_level: List
description:
Grants permission to describe the principals (service consumers) that are permitted to discover your VPC endpoint service


name: ec2:DescribeVpcEndpointServices
access_level: List
description:
Grants permission to describe all supported AWS services that can be specified when creating a VPC endpoint


name: ec2:DisableFastSnapshotRestores
access_level: Write
description:
Grants permission to disable fast snapshot restores for one or more snapshots in specified Availability Zones


name: ec2:DisableTransitGatewayRouteTablePropagation
access_level: Write
description:
Grants permission to disable a resource attachment from propagating routes to the specified propagation route table


name: ec2:DisableVgwRoutePropagation
access_level: Write
description:
Grants permission to disable a virtual private gateway from propagating routes to a specified route table of a VPC


name: ec2:EnableFastSnapshotRestores
access_level: Write
description:
Grants permission to enable fast snapshot restores for one or more snapshots in specified Availability Zones


name: ec2:ExportClientVpnClientConfiguration
access_level: List
description:
Grants permission to download the contents of the Client VPN endpoint configuration file for a Client VPN endpoint


name: ec2:GetAssociatedIpv6PoolCidrs
access_level: Read
description:
Grants permission to get information about the IPv6 CIDR block associations for a specified IPv6 address pool


name: ec2:GetDefaultCreditSpecification
access_level: Read
description:
Grants permission to get the default credit option for CPU usage of a burstable performance instance family


name: ec2:GetEbsDefaultKmsKeyId
access_level: Read
description:
Grants permission to get the ID of the default customer master key (CMK) for EBS encryption by default


name: ec2:GetFlowLogsIntegrationTemplate
access_level: Read
description:
Grants permission to generate a CloudFormation template to streamline the integration of VPC flow logs with Amazon Athena


name: ec2:GetHostReservationPurchasePreview
access_level: Read
description:
Grants permission to preview a reservation purchase with configurations that match those of a Dedicated Host


name: ec2:GetLaunchTemplateData
access_level: Read
description:
Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version


name: ec2:GetManagedPrefixListAssociations
access_level: Read
description:
Grants permission to get information about the resources that are associated with the specified managed prefix list


name: ec2:GetReservedInstancesExchangeQuote
access_level: Read
description:
Grants permission to return a quote and exchange information for exchanging one or more Convertible Reserved Instances for a new Convertible Reserved Instance


name: ec2:GetSerialConsoleAccessStatus
access_level: Read
description:
Grants permission to retrieve the access status of your account to the EC2 serial console of all instances


name: ec2:GetTransitGatewayRouteTablePropagations
access_level: List
description:
Grants permission to get information about the route table propagations for a transit gateway route table


name: ec2:ImportImage
access_level: Write
description:
Grants permission to import single or multi-volume disk images or EBS snapshots into an Amazon Machine Image (AMI)


name: ec2:ImportKeyPair
access_level: Write
description:
Grants permission to import a public key from an RSA key pair that was created with a third-party tool


name: ec2:ModifyAvailabilityZoneGroup
access_level: Write
description:
Grants permission to modify the opt-in status of the Local Zone and Wavelength Zone group for your account


name: ec2:ModifyCapacityReservation
access_level: Write
description:
Grants permission to modify a Capacity Reservation's capacity and the conditions under which it is to be released


name: ec2:ModifyDefaultCreditSpecification
access_level: Write
description:
Grants permission to change the account level default credit option for CPU usage of burstable performance instances


name: ec2:ModifyEbsDefaultKmsKeyId
access_level: Write
description:
Grants permission to change the default customer master key (CMK) for EBS encryption by default for your account


name: ec2:ModifyVpcPeeringConnectionOptions
access_level: Write
description:
Grants permission to modify the VPC peering connection options on one side of a VPC peering connection


name: ec2:MoveAddressToVpc
access_level: Write
description:
Grants permission to move an Elastic IP address from the EC2-Classic platform to the EC2-VPC platform


name: ec2:ProvisionByoipCidr
access_level: Write
description:
Grants permission to provision an address range for use in AWS through bring your own IP addresses (BYOIP), and to create a corresponding address pool


name: ec2:PurchaseHostReservation
access_level: Write
description:
Grants permission to purchase a reservation with configurations that match those of a Dedicated Host


name: ec2:RegisterInstanceEventNotificationAttributes
access_level: Write
description:
Grants permission to add tags to the set of tags to include in notifications about scheduled events for your instances


name: ec2:RegisterTransitGatewayMulticastGroupMembers
access_level: Write
description:
Grants permission to register one or more network interfaces as a member of a group IP address in a transit gateway multicast domain


name: ec2:RegisterTransitGatewayMulticastGroupSources
access_level: Write
description:
Grants permission to register one or more network interfaces as a source of a group IP address in a transit gateway multicast domain


name: ec2:RejectTransitGatewayMulticastDomainAssociations
access_level: Write
description:
Grants permission to reject requests to associate cross-account subnets with a transit gateway multicast domain


name: ec2:ResetEbsDefaultKmsKeyId
access_level: Write
description:
Grants permission to reset the default customer master key (CMK) for EBS encryption for your account to use the AWS-managed CMK for EBS


name: ec2:RestoreAddressToClassic
access_level: Write
description:
Grants permission to restore an Elastic IP address that was previously moved to the EC2-VPC platform back to the EC2-Classic platform


name: ec2:RestoreManagedPrefixListVersion
access_level: Write
description:
Grants permission to restore the entries from a previous version of a managed prefix list to a new version of the prefix list


name: ec2:WithdrawByoipCidr
access_level: Write
description:
Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP)


name: ec2-instance-connect:SendSerialConsoleSSHPublicKey
access_level: Write
description:
Grants access to push an SSH public key to the specified EC2 instance to be used for serial console SSH


name: ec2messages:FailMessage
access_level: Write
description:
Grants permission to fail a message, signifying the message could not be processed successfully, ensuring it cannot be replied to or delivered again


name: ec2messages:GetEndpoint
access_level: Read
description:
Grants permission to route traffic to the correct endpoint based on the given destination for the messages


name: ecr:BatchCheckLayerAvailability
access_level: Read
description:
Grants permission to check the availability of multiple image layers in a specified registry and repository


name: ecr:CompleteLayerUpload
access_level: Write
description:
Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed


name: ecr:DescribeImages
access_level: Read
description:
Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date


name: ecr:SetRepositoryPolicy
access_level: Permissions management
description:
Grants permission to apply a repository policy on a specified repository to control access permissions


name: ecs:CreateCapacityProvider
access_level: Write
description:
Grants permission to create a new capacity provider. Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling


name: ecs:CreateService
access_level: Write
description:
Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation


name: ecs:DeleteAccountSetting
access_level: Write
description:
Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are disabled for new resources that are created


name: ecs:DescribeTaskDefinition
access_level: Read
description:
Grants permission to describe a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family


name: ecs:ListAttributes
access_level: List
description:
Grants permission to lists the attributes for Amazon ECS resources within a specified target type and cluster


name: ecs:ListTaskDefinitionFamilies
access_level: List
description:
Grants permission to get a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions)


name: ecs:Poll
access_level: Write
description:
Grants permission to an agent to connect with the Amazon ECS service to report status and get commands


name: ecs:PutAccountSetting
access_level: Write
description:
Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account. You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging


name: ecs:PutAccountSettingDefault
access_level: Write
description:
Grants permission to modify the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set. Enabling this setting is required to use new Amazon ECS features such as resource tagging


name: ecs:PutClusterCapacityProviders
access_level: Write
description:
Grants permission to modify the available capacity providers and the default capacity provider strategy for a cluster


name: ecs:RegisterTaskDefinition
access_level: Write
description:
Grants permission to register a new task definition from the supplied family and containerDefinitions


name: ecs:StartTask
access_level: Write
description:
Grants permission to start a new task from the specified task definition on the specified container instance or instances


name: eks:DescribeAddonVersions
access_level: Read
description:
Grants permission to retrieve descriptive version information about the add-ons that Amazon EKS Add-ons supports


name: eks:DescribeFargateProfile
access_level: Read
description:
Grants permission to retrieve descriptive information about an AWS Fargate profile associated with a cluster


name: eks:DescribeUpdate
access_level: Read
description:
Grants permission to retrieve a given update for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region)


name: eks:ListAddons
access_level: List
description:
Grants permission to list the Amazon EKS add-ons in your AWS account (in the specified or default region) for a given cluster


name: eks:ListClusters
access_level: List
description:
Grants permission to list the Amazon EKS clusters in your AWS account (in the specified or default region)


name: eks:ListFargateProfiles
access_level: List
description:
Grants permission to list the AWS Fargate profiles in your AWS account (in the specified or default region) associated with a given cluster


name: eks:ListIdentityProviderConfigs
access_level: List
description:
Grants permission to list the Idp configs in your AWS account (in the specified or default region) associated with a given cluster


name: eks:ListNodegroups
access_level: List
description:
Grants permission to list the Amazon EKS nodegroups in your AWS account (in the specified or default region) attached to given cluster


name: eks:ListUpdates
access_level: List
description:
Grants permission to list the updates for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region)


name: eks:UpdateNodegroupConfig
access_level: Write
description:
Grants permission to update Amazon EKS nodegroup configurations (eg: min/max/desired capacity or labels)


name: elastic-inference:DescribeAcceleratorOfferings
access_level: List
description:
Grants permission to describe the locations in which a given accelerator type or set of types is present in a given region


name: elastic-inference:DescribeAcceleratorTypes
access_level: List
description:
Grants permission to describe the accelerator types available in a given region, as well as their characteristics, such as memory and throughput


name: elastic-inference:DescribeAccelerators
access_level: List
description:
Grants permission to describe information over a provided set of accelerators belonging to an account


name: elasticache:CompleteMigration
access_level: Write
description:
Grants permission to complete an online migration of data from hosted Redis on Amazon EC2 to ElastiCache


name: elasticache:DecreaseReplicaCount
access_level: Write
description:
Grants permission to decrease the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group


name: elasticache:DeleteUser
access_level: Write
description:
Grants permission to delete an existing user and thus remove it from all user groups and replication groups where it was assigned


name: elasticache:DescribeEngineDefaultParameters
access_level: List
description:
Grants permission to retrieve the default engine and system parameter information for the specified cache engine


name: elasticache:DescribeEvents
access_level: List
description:
Grants permission to list events related to clusters, cache security groups, and cache parameter groups


name: elasticache:FailoverGlobalReplicationGroup
access_level: Write
description:
Grants permission to failover the primary region to a selected secondary region of a global replication group


name: elasticache:IncreaseReplicaCount
access_level: Write
description:
Grants permission to increase the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group


name: elasticache:ListAllowedNodeTypeModifications
access_level: List
description:
Grants permission to list available node type that can be used to scale a particular Redis cluster or replication group


name: elasticache:ModifyReplicationGroupShardConfiguration
access_level: Write
description:
Grants permission to add shards, remove shards, or rebalance the keyspaces among existing shards of a replication group


name: elasticache:RebalanceSlotsInGlobalReplicationGroup
access_level: Write
description:
Grants permission to perform a key space rebalance operation to redistribute slots and ensure uniform key distribution across existing shards in a global replication group


name: elasticache:RebootCacheCluster
access_level: Write
description:
Grants permission to reboot some, or all, of the cache nodes within a provisioned cache cluster or replication group (cluster mode disabled)


name: elasticache:StartMigration
access_level: Write
description:
Grants permission to start a migration of data from hosted Redis on Amazon EC2 to ElastiCache for Redis


name: elasticbeanstalk:AbortEnvironmentUpdate
access_level: Write
description:
Grants permission to cancel in-progress environment configuration update or application version deployment.


name: elasticbeanstalk:ComposeEnvironments
access_level: Write
description:
Grants permission to create or update a group of environments, each running a separate component of a single application.


name: elasticbeanstalk:DescribeApplicationVersions
access_level: List
description:
Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket.


name: elasticbeanstalk:RebuildEnvironment
access_level: Write
description:
Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart.


name: elasticbeanstalk:RestartAppServer
access_level: Write
description:
Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance.


name: elasticbeanstalk:UpdateApplicationResourceLifecycle
access_level: Write
description:
Grants permission to update the application version lifecycle policy associated with the application.


name: elasticbeanstalk:UpdateConfigurationTemplate
access_level: Write
description:
Grants permission to update a configuration template with specified properties or configuration option values.


name: elasticbeanstalk:ValidateConfigurationSettings
access_level: Read
description:
Grants permission to check the validity of a set of configuration settings for a configuration template or an environment.


name: elasticfilesystem:CreateTags
access_level: Tagging
description:
Grants permission to create or overwrite tags associated with a file system; deprecated, see TagResource


name: elasticfilesystem:DescribeFileSystems
access_level: List
description:
Grants permission to view the description of an Amazon EFS file system specified by file system CreationToken or FileSystemId; or to view the description of all file systems owned by the caller's AWS account in the AWS region of the endpoint that is being called


name: elasticfilesystem:DescribeMountTargets
access_level: Read
description:
Grants permission to view the descriptions of all mount targets, or a specific mount target, for a file system


name: elasticfilesystem:PutBackupPolicy
access_level: Write
description:
Grants permission to enable or disable automatic backups with AWS Backup by creating a new BackupPolicy object


name: elasticfilesystem:PutFileSystemPolicy
access_level: Write
description:
Grants permission to apply a resource-level policy that defines the actions allowed or denied from given actors for the specified file system


name: elasticfilesystem:UpdateFileSystem
access_level: Write
description:
Grants permission to update the throughput mode or the amount of provisioned throughput of an existing file system


name: elasticloadbalancing:AddTags
access_level: Tagging
description:
Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags


name: elasticloadbalancing:ConfigureHealthCheck
access_level: Write
description:
Specifies the health check settings to use when evaluating the health state of your back-end instances


name: elasticloadbalancing:CreateAppCookieStickinessPolicy
access_level: Write
description:
Generates a stickiness policy with sticky session lifetimes that follow that of an application-generated cookie


name: elasticloadbalancing:CreateLBCookieStickinessPolicy
access_level: Write
description:
Generates a stickiness policy with sticky session lifetimes controlled by the lifetime of the browser (user-agent) or a specified expiration period


name: elasticloadbalancing:DeleteLoadBalancerPolicy
access_level: Write
description:
Deletes the specified policy from the specified load balancer. This policy must not be enabled for any listeners


name: elasticloadbalancing:DescribeLoadBalancers
access_level: List
description:
Describes the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers


name: elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer
access_level: Write
description:
Removes the specified Availability Zones from the set of Availability Zones for the specified load balancer


name: elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer
access_level: Write
description:
Adds the specified Availability Zones to the set of Availability Zones for the specified load balancer


name: elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer
access_level: Write
description:
Replaces the set of policies associated with the specified port on which the back-end server is listening with a new set of policies


name: elasticloadbalancing:SetLoadBalancerPoliciesOfListener
access_level: Write
description:
Replaces the current set of policies for the specified load balancer port with the specified set of policies


name: elasticloadbalancing:ModifyTargetGroup
access_level: Write
description:
Modifies the health checks used when evaluating the health state of the targets in the specified target group


name: elasticmapreduce:DescribeCluster
access_level: Read
description:
Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on.


name: elasticmapreduce:DescribeEditor
access_level: Read
description:
Grants permission to view information about a notebook, including status, user, role, tags, location, and more.


name: elasticmapreduce:DescribeJobFlows
access_level: Read
description:
This API is deprecated and will eventually be removed. We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead.


name: elasticmapreduce:GetBlockPublicAccessConfiguration
access_level: Read
description:
Grants permission to retrieve the EMR block public access configuration for the AWS account in the Region.


name: elasticmapreduce:ListSecurityConfigurations
access_level: List
description:
Grants permission to list available security configurations in this account by name, along with creation dates and times.


name: elasticmapreduce:ModifyCluster
access_level: Write
description:
Grants permission to change cluster settings such as number of steps that can be executed concurrently for a cluster.


name: elasticmapreduce:OpenEditorInConsole
access_level: Write
description:
Grants permission to launch the Jupyter notebook editor for an EMR notebook from within the console.


name: elasticmapreduce:PutAutoScalingPolicy
access_level: Write
description:
Grants permission to create or update an automatic scaling policy for a core instance group or task instance group.


name: elasticmapreduce:PutBlockPublicAccessConfiguration
access_level: Permissions management
description:
Grants permission to create or update the EMR block public access configuration for the AWS account in the Region.


name: elastictranscoder:ListJobsByStatus
access_level: List
description:
Get information about all of the jobs associated with the current AWS account that have a specified status


name: elastictranscoder:UpdatePipelineStatus
access_level: Write
description:
Pause or reactivate a pipeline, so the pipeline stops or restarts processing jobs, update the status for the pipeline.


name: elemental-activations:CompleteAccountRegistration
access_level: Read
description:
Grants permission to complete the process of registering customer account for AWS Elemental Appliances and Software Purchases


name: elemental-activations:CompleteFileUpload
access_level: Read
description:
Grants permission to complete the process of uploading a Software file for AWS Elemental Appliances and Software Purchases


name: elemental-activations:DownloadSoftware
access_level: Read
description:
Grants permission to download the Software files for AWS Elemental Appliances and Software Purchases


name: elemental-activations:StartAccountRegistration
access_level: Read
description:
Grants permission to start the process of registering customer account for AWS Elemental Appliances and Software Purchases


name: elemental-activations:StartFileUpload
access_level: Read
description:
Grants permission to start the process of uploading a Software file for AWS Elemental Appliances and Software Purchases


name: es:AcceptInboundConnection
access_level: Write
description:
Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request


name: es:CreateElasticsearchServiceRole
access_level: Write
description:
Grants permission to create the service-linked role required for Amazon OpenSearch domains that use VPC access


name: es:CreateOutboundConnection
access_level: Write
description:
Grants permission to create a new cross-cluster search connection from a source domain to a destination domain


name: es:DeleteElasticsearchServiceRole
access_level: Write
description:
Grants permission to delete the service-linked role required for Amazon OpenSearch domains that use VPC access


name: es:DeleteInboundConnection
access_level: Write
description:
Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection


name: es:DeleteOutboundConnection
access_level: Write
description:
Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection


name: es:DeletePackage
access_level: Write
description:
Grants permission to delete a package from Amazon ES. The package must not be associated with any Amazon ES domain


name: es:DescribeDataPrepperPipeline
access_level: Read
description:
Grants permission to view a description of the pipeline configuration for the specified DataPrepper pipeline


name: es:DescribeDomain
access_level: Read
description:
Grants permission to view a description of the domain configuration for the specified Amazon OpenSearch domain, including the domain ID, domain service endpoint, and domain ARN


name: es:DescribeDomainConfig
access_level: Read
description:
Grants permission to view a description of the configuration options and status of an Amazon OpenSearch domain


name: es:DescribeDomains
access_level: List
description:
Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domain


name: es:DescribeElasticsearchDomains
access_level: List
description:
Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domains


name: es:DescribeElasticsearchInstanceTypeLimits
access_level: List
description:
Grants permission to view the instance count, storage, and master node limits for a given OpenSearch version and instance type


name: es:GetCompatibleElasticsearchVersions
access_level: List
description:
Grants permission to fetch list of compatible elastic search versions to which Amazon OpenSearch domain can be upgraded


name: es:GetCompatibleVersions
access_level: List
description:
Grants permission to fetch list of compatible OpenSearch versions to which Amazon OpenSearch domain can be upgraded


name: es:ListElasticsearchInstanceTypes
access_level: List
description:
Grants permission to list all OpenSearch instance types that are supported for a given OpenSearch version


name: es:RejectInboundConnection
access_level: Write
description:
Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request


name: es:UpdateDataPrepperPipeline
access_level: Write
description:
Grants permission to modify the configuration of a DataPrepper pipeline (currently limited to updating desired capacity)


name: es:UpdateDomainConfig
access_level: Write
description:
Grants permission to modify the configuration of an Amazon OpenSearch domain, such as the instance type or number of instances


name: events:PutPermission
access_level: Permissions management
description:
Grants permission to use the PutPermission action to grants permission to another AWS account to put events to your default event bus


name: events:RemovePermission
access_level: Permissions management
description:
Grants permission to revoke the permission of another AWS account to put events to your default event bus


name: firehose:PutRecordBatch
access_level: Write
description:
Grants permissions to write multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records


name: fis:InjectApiInternalError
access_level: Write
description:
Grants permission to inject an API internal error on the provided AWS service from an FIS Experiment


name: fis:InjectApiThrottleError
access_level: Write
description:
Grants permission to inject an API throttle error on the provided AWS service from an FIS Experiment


name: fis:InjectApiUnavailableError
access_level: Write
description:
Grants permission to inject an API unavailable error on the provided AWS service from an FIS Experiment


name: fms:AssociateAdminAccount
access_level: Write
description:
Grants permission to set the AWS Firewall Manager administrator account and enables the service in all organization accounts


name: fms:DeleteNotificationChannel
access_level: Write
description:
Grants permission to delete an AWS Firewall Manager association with the IAM role and the Amazon Simple Notification Service (SNS) topic that is used to notify the FM administrator about major FM events and errors across the organization


name: fms:DisassociateAdminAccount
access_level: Write
description:
Grants permission to disassociate the account that has been set as the AWS Firewall Manager administrator account and and disables the service in all organization accounts


name: fms:GetAdminAccount
access_level: Read
description:
Grants permission to retrieve the AWS Organizations master account that is associated with AWS Firewall Manager as the AWS Firewall Manager administrator


name: fms:GetComplianceDetail
access_level: Read
description:
Grants permission to retrieve detailed compliance information about the specified member account. Details include resources that are in and out of compliance with the specified policy


name: fms:GetNotificationChannel
access_level: Read
description:
Grants permission to retrieve information about the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs


name: fms:GetProtectionStatus
access_level: Read
description:
Grants permission to retrieve policy-level attack summary information in the event of a potential DDoS attack


name: fms:GetViolationDetails
access_level: Read
description:
Grants permission to retrieve violations for a resource based on the specified AWS Firewall Manager policy and AWS account


name: fms:ListComplianceStatus
access_level: List
description:
Grants permission to retrieve an array of PolicyComplianceStatus objects in the response. Use PolicyComplianceStatus to get a summary of which member accounts are protected by the specified policy


name: fms:PutNotificationChannel
access_level: Write
description:
Grants permission to designate the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manager (FM) could use to notify the FM administrator about major FM events and errors across the organization


name: frauddetector:DeleteDetector
access_level: Write
description:
Grants permission to delete the detector. Before deleting a detector, you must first delete all detector versions and rule versions associated with the detector


name: frauddetector:DeleteDetectorVersion
access_level: Write
description:
Grants permission to delete the detector version. You cannot delete detector versions that are in ACTIVE status


name: frauddetector:DeleteEntityType
access_level: Write
description:
Grants permission to delete an entity type. You cannot delete an entity type that is included in an event type


name: frauddetector:DeleteEventType
access_level: Write
description:
Grants permission to delete an event type. You cannot delete an event type that is used in a detector or a model


name: frauddetector:DeleteExternalModel
access_level: Write
description:
Grants permission to remove a SageMaker model from Amazon Fraud Detector. You can remove an Amazon SageMaker model if it is not associated with a detector version


name: frauddetector:DeleteLabel
access_level: Write
description:
Grants permission to delete a label. You cannot delete labels that are included in an event type in Amazon Fraud Detector. You cannot delete a label assigned to an event ID. You must first delete the relevant event ID


name: frauddetector:DeleteModel
access_level: Write
description:
Grants permission to delete a model. You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version


name: frauddetector:DeleteModelVersion
access_level: Write
description:
Grants permission to delete a model version. You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version


name: frauddetector:DeleteRule
access_level: Write
description:
Grants permission to delete the rule. You cannot delete a rule if it is used by an ACTIVE or INACTIVE detector version


name: frauddetector:DeleteVariable
access_level: Write
description:
Grants permission to delete a variable. You cannot delete variables that are included in an event type in Amazon Fraud Detector


name: frauddetector:DescribeModelVersions
access_level: Read
description:
Grants permission to get all of the model versions for the specified model type or for the specified model type and model ID. You can also get details for a single, specified model version


name: frauddetector:GetBatchPredictionJobs
access_level: List
description:
Grants permission to get all batch prediction jobs or a specific job if you specify a job ID. This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 1 and 50. To get the next page results, provide the pagination token from the GetBatchPredictionJobsResponse as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetDetectors
access_level: List
description:
Grants permission to get all detectors or a single detector if a detectorId is specified. This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetDetectorsResponse as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetEntityTypes
access_level: List
description:
Grants permission to get all entity types or a specific entity type if a name is specified. This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEntityTypesResponse as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetEventPrediction
access_level: Read
description:
Grants permission to evaluate an event against a detector version. If a version ID is not provided, the detector’s (ACTIVE) version is used


name: frauddetector:GetEventTypes
access_level: List
description:
Grants permission to get all event types or a specific event type if name is provided. This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEventTypesResponse as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetExternalModels
access_level: List
description:
Grants permission to get the details for one or more Amazon SageMaker models that have been imported into the service. This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetExternalModelsResult as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetKMSEncryptionKey
access_level: Read
description:
Grants permission to get the encryption key if a Key Management Service (KMS) customer master key (CMK) has been specified to be used to encrypt content in Amazon Fraud Detector


name: frauddetector:GetLabels
access_level: List
description:
Grants permission to get all labels or a specific label if name is provided. This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 10 and 50. To get the next page results, provide the pagination token from the GetGetLabelsResponse as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetModels
access_level: List
description:
Grants permission to get one or more models. Gets all models for the AWS account if no model type and no model id provided. Gets all models for the AWS account and model type, if the model type is specified but model id is not provided. Gets a specific model if (model type, model id) tuple is specified


name: frauddetector:GetOutcomes
access_level: List
description:
Grants permission to get one or more outcomes. This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 100 records per page. If you provide a maxResults, the value must be between 50 and 100. To get the next page results, provide the pagination token from the GetOutcomesResult as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:GetRules
access_level: List
description:
Grants permission to get all rules for a detector (paginated) if ruleId and ruleVersion are not specified. Gets all rules for the detector and the ruleId if present (paginated). Gets a specific rule if both the ruleId and the ruleVersion are specified


name: frauddetector:GetVariables
access_level: List
description:
Grants permission to get all of the variables or the specific variable. This is a paginated API. Providing null maxSizePerPage results in retrieving maximum of 100 records per page. If you provide maxSizePerPage the value must be between 50 and 100. To get the next page result, a provide a pagination token from GetVariablesResult as part of your request. Null pagination token fetches the records from the beginning


name: frauddetector:ListTagsForResource
access_level: List
description:
Grants permission to list all tags associated with the resource. This is a paginated API. To get the next page results, provide the pagination token from the response as part of your request. A null pagination token fetches the records from the beginning


name: frauddetector:PutEntityType
access_level: Write
description:
Grants permission to create or update an entity type. An entity represents who is performing the event. As part of a fraud prediction, you pass the entity ID to indicate the specific entity who performed the event. An entity type classifies the entity. Example classifications include customer, merchant, or account


name: frauddetector:PutEventType
access_level: Write
description:
Grants permission to create or update an event type. An event is a business activity that is evaluated for fraud risk. With Amazon Fraud Detector, you generate fraud predictions for events. An event type defines the structure for an event sent to Amazon Fraud Detector. This includes the variables sent as part of the event, the entity performing the event (such as a customer), and the labels that classify the event. Example event types include online payment transactions, account registrations, and authentications


name: frauddetector:PutExternalModel
access_level: Write
description:
Grants permission to create or update an Amazon SageMaker model endpoint. You can also use this action to update the configuration of the model endpoint, including the IAM role and/or the mapped variables


name: frauddetector:PutKMSEncryptionKey
access_level: Write
description:
Grants permission to specify the Key Management Service (KMS) customer master key (CMK) to be used to encrypt content in Amazon Fraud Detector


name: frauddetector:PutLabel
access_level: Write
description:
Grants permission to create or update label. A label classifies an event as fraudulent or legitimate. Labels are associated with event types and used to train supervised machine learning models in Amazon Fraud Detector


name: frauddetector:UpdateDetectorVersion
access_level: Write
description:
Grants permission to update a detector version. The detector version attributes that you can update include models, external model endpoints, rules, rule execution mode, and description. You can only update a DRAFT detector version


name: frauddetector:UpdateDetectorVersionMetadata
access_level: Write
description:
Grants permission to update the detector version's description. You can update the metadata for any detector version (DRAFT, ACTIVE, or INACTIVE)


name: frauddetector:UpdateDetectorVersionStatus
access_level: Write
description:
Grants permission to update the detector version’s status. You can perform the following promotions or demotions using UpdateDetectorVersionStatus: DRAFT to ACTIVE, ACTIVE to INACTIVE, and INACTIVE to ACTIVE


name: frauddetector:UpdateModelVersion
access_level: Write
description:
Grants permission to update a model version. Updating a model version retrains an existing model version using updated training data and produces a new minor version of the model. You can update the training data set location and data access role attributes using this action. This action creates and trains a new minor version of the model, for example version 1.01, 1.02, 1.03


name: frauddetector:UpdateRuleVersion
access_level: Write
description:
Grants permission to update a rule version resulting in a new rule version. Updates a rule version resulting in a new rule version (version 1, 2, 3 ...)


name: fsx:AssociateFileGateway
access_level: Write
description:
Grants permission to associate a File Gateway instance with an Amazon FSx for Windows File Server file system


name: fsx:DeleteBackup
access_level: Write
description:
Grants permission to delete a backup, deleting its contents. After deletion, the backup no longer exists, and its data is no longer available.


name: fsx:DeleteFileSystem
access_level: Write
description:
Grants permission to delete a file system, deleting its contents and any existing automatic backups of the file system


name: fsx:DescribeAssociatedFileGateways
access_level: Read
description:
Grants permission to describe the File Gateway instances associated with an Amazon FSx for Windows File Server file system


name: fsx:DescribeBackups
access_level: Read
description:
Grants permission to return the descriptions of all backups owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DescribeDataRepositoryTasks
access_level: Read
description:
Grants permission to return the descriptions of all data repository task owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DescribeFileSystemAliases
access_level: Read
description:
Grants permission to return the description of all DNS aliases owned by your Amazon FSx for Windows File Server file system


name: fsx:DescribeFileSystems
access_level: Read
description:
Grants permission to return the descriptions of all file systems owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DisassociateFileGateway
access_level: Write
description:
Grants permission to disassociate a File Gateway instance from an Amazon FSx for Windows File Server file system


name: fsx:DisassociateFileSystemAliases
access_level: Write
description:
Grants permission to disassociate file system aliases with an Amazon FSx for Windows File Server file system


name: gamelift:CreateGameServerGroup
access_level: Write
description:
Grants permission to create a new game server group, set up a corresponding Auto Scaling group, and launche instances to host game servers


name: gamelift:CreateVpcPeeringAuthorization
access_level: Write
description:
Grants permission to allow GameLift to create or delete a peering connection between a GameLift fleet VPC and a VPC on another AWS account


name: gamelift:CreateVpcPeeringConnection
access_level: Write
description:
Grants permission to establish a peering connection between your GameLift fleet VPC and a VPC on another account


name: gamelift:DeleteGameServerGroup
access_level: Write
description:
Grants permission to permanently delete a game server group and terminate FleetIQ activity for the corresponding Auto Scaling group


name: gamelift:DescribeGameSessionDetails
access_level: Read
description:
Grants permission to retrieve properties for game sessions in a fleet, including the protection policy


name: gamelift:StartFleetActions
access_level: Write
description:
Grants permission to resume auto-scaling activity on a fleet after it was suspended with StopFleetActions()


name: gamelift:StartMatchBackfill
access_level: Write
description:
Grants permission to request FlexMatch matchmaking to fill available player slots in an existing game session


name: gamelift:StartMatchmaking
access_level: Write
description:
Grants permission to request FlexMatch matchmaking for one or a group of players and initiate game session placement


name: geo:BatchEvaluateGeofences
access_level: Write
description:
Grants permission to evaluate device positions against the position of geofences in a given geofence collection


name: geo:ListDevicePositions
access_level: List
description:
Grants permission to retrieve a list of devices and their latest positions from the given tracker resource


name: geo:ListTrackerConsumers
access_level: Read
description:
Grants permission to retrieve a list of geofence collections currently associated to the given tracker resource


name: geo:PutGeofence
access_level: Write
description:
Grants permission to add a new geofence or update an existing geofence to a given geofence-collection


name: geo:TagResource
access_level: Tagging
description:
Grants permission to adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource


name: globalaccelerator:AddCustomRoutingEndpoints
access_level: Write
description:
Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group.


name: globalaccelerator:AdvertiseByoipCidr
access_level: Write
description:
Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP).


name: globalaccelerator:AllowCustomRoutingTraffic
access_level: Write
description:
Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.


name: globalaccelerator:CreateCustomRoutingEndpointGroup
access_level: Write
description:
Grants permission to create an endpoint group for the specified listener for a custom routing accelerator.


name: globalaccelerator:CreateCustomRoutingListener
access_level: Write
description:
Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator.


name: globalaccelerator:DenyCustomRoutingTraffic
access_level: Write
description:
Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.


name: globalaccelerator:DeprovisionByoipCidr
access_level: Write
description:
Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP).


name: globalaccelerator:ListCustomRoutingEndpointGroups
access_level: List
description:
Grants permission to list the endpoint groups that are associated with a listener for a custom routing accelerator.


name: globalaccelerator:ListCustomRoutingPortMappingsByDestination
access_level: List
description:
Grants permission to list the port mappings for a specific endpoint IP address (a destination address) in a subnet


name: globalaccelerator:ProvisionByoipCidr
access_level: Write
description:
Grants permission to provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP).


name: globalaccelerator:RemoveCustomRoutingEndpoints
access_level: Write
description:
Grants permission to remove virtual private cloud (VPC) subnet endpoints from a custom routing accelerator endpoint group.


name: greengrass:AssociateRoleToGroup
access_level: Write
description:
Grants permission to associate a role with a group. The role's permissions must allow Greengrass core Lambda functions and connectors to perform actions in other AWS services


name: greengrass:AssociateServiceRoleToAccount
access_level: Permissions management
description:
Grants permission to associate a role with your account. AWS IoT Greengrass uses this role to access your Lambda functions and AWS IoT resources


name: greengrass:CreateCoreDefinitionVersion
access_level: Write
description:
Grants permission to create a version of an existing core definition. Greengrass groups must each contain exactly one Greengrass core


name: greengrass:CreateFunctionDefinition
access_level: Write
description:
Grants permission to create a Lambda function definition to be used in a group that contains a list of Lambda functions and their configurations


name: greengrass:CreateResourceDefinition
access_level: Write
description:
Grants permission to create a resource definition that contains a list of resources to be used in a group


name: greengrass:CreateSoftwareUpdateJob
access_level: Write
description:
Grants permission to create an AWS IoT job that will trigger your Greengrass cores to update the software they are running


name: greengrass:DeleteCoreDefinition
access_level: Write
description:
Grants permission to delete a core definition. Deleting a definition that is currently in use in a deployment affects future deployments


name: greengrass:DeleteDeviceDefinition
access_level: Write
description:
Grants permission to delete a device definition. Deleting a definition that is currently in use in a deployment affects future deployments


name: greengrass:DeleteFunctionDefinition
access_level: Write
description:
Grants permission to delete a Lambda function definition. Deleting a definition that is currently in use in a deployment affects future deployments


name: greengrass:DeleteLoggerDefinition
access_level: Write
description:
Grants permission to delete a logger definition. Deleting a definition that is currently in use in a deployment affects future deployments


name: greengrass:DeleteSubscriptionDefinition
access_level: Write
description:
Grants permission to delete a subscription definition. Deleting a definition that is currently in use in a deployment affects future deployments


name: greengrass:DisassociateServiceRoleFromAccount
access_level: Write
description:
Grants permission to disassociate the service role from an account. Without a service role, deployments will not work


name: greengrass:GetFunctionDefinition
access_level: Read
description:
Grants permission to retrieve information about a Lambda function definition, such as its creation time and latest version


name: greengrass:GetFunctionDefinitionVersion
access_level: Read
description:
Grants permission to retrieve information about a Lambda function definition version, such as which Lambda functions are included in the version and their configurations


name: greengrass:GetResourceDefinition
access_level: Read
description:
Grants permission to retrieve information about a resource definition, such as its creation time and latest version


name: greengrass:GetResourceDefinitionVersion
access_level: Read
description:
Grants permission to retrieve information about a resource definition version, such as which resources are included in the version


name: greengrass:ListBulkDeploymentDetailedReports
access_level: Read
description:
Grants permission to retrieve a paginated list of the deployments that have been started in a bulk deployment operation and their current deployment status


name: greengrass:UpdateConnectivityInfo
access_level: Write
description:
Grants permission to update the connectivity information for a Greengrass core. Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it


name: greengrass:DeleteCoreDevice
access_level: Write
description:
Grants permission to delete a AWS IoT Greengrass core device, which is an AWS IoT thing. This operation removes the core device from the list of core devices. This operation doesn't delete the AWS IoT thing


name: greengrass:ListEffectiveDeployments
access_level: List
description:
Grants permission to retrieves a paginated list of deployment jobs that AWS IoT Greengrass sends to AWS IoT Greengrass core devices


name: greengrass:ListInstalledComponents
access_level: List
description:
Grants permission to retrieve a paginated list of the components that a AWS IoT Greengrass core device runs


name: greengrass:ResolveComponentCandidates
access_level: List
description:
Grants permission to list components that meet the component, version, and platform requirements of a deployment


name: groundtruthlabeling:RunFilterOrSampleDatasetJob
access_level: Write
description:
Grants permission to filter records from a manifest file using S3 select. Get sample entries based on random sampling


name: guardduty:CreateFilter
access_level: Write
description:
Grants permission to create GuardDuty filters. A filters defines finding attributes and conditions used to filter findings


name: guardduty:CreateMembers
access_level: Write
description:
Grants permission to create GuardDuty member accounts, where the account used to create a member becomes the GuardDuty administrator account


name: guardduty:CreateThreatIntelSet
access_level: Write
description:
Grants permission to create GuardDuty ThreatIntelSets, where a ThreatIntelSet consists of known malicious IP addresses used by GuardDuty to generate findings


name: guardduty:DescribeOrganizationConfiguration
access_level: Read
description:
Grants permission to retrieve details about the delegated administrator associated with a GuardDuty detector


name: guardduty:GetInvitationsCount
access_level: Read
description:
Grants permission to retrieve the count of all GuardDuty invitations sent to a specified account, which does not include the accepted invitation


name: guardduty:GetMasterAccount
access_level: Read
description:
Grants permission to retrieve details of the GuardDuty master account associated with a member account


name: guardduty:GetUsageStatistics
access_level: Read
description:
Grants permission to list Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID


name: guardduty:InviteMembers
access_level: Write
description:
Grants permission to invite other AWS accounts to enable GuardDuty and become GuardDuty member accounts


name: guardduty:ListInvitations
access_level: List
description:
Grants permission to retrieve a lists of all of the GuardDuty membership invitations that were sent to an AWS account


name: guardduty:StartMonitoringMembers
access_level: Write
description:
Grants permission to a GuardDuty administrator account to monitor findings from GuardDuty member accounts


name: guardduty:UpdateOrganizationConfiguration
access_level: Write
description:
Grants permission to update the delegated administrator configuration associated with a GuardDuty detector


name: health:DescribeAffectedEntitiesForOrganization
access_level: Read
description:
Gets a list of entities that have been affected by the specified events and accounts in organization.


name: health:DescribeEventAggregates
access_level: Read
description:
Returns the number of events of each event type (issue, scheduled change, and account notification).


name: health:DescribeEventDetailsForOrganization
access_level: Read
description:
Returns detailed information about one or more specified events for provided accounts in organization.


name: healthlake:DescribeFHIRDatastore
access_level: Read
description:
Grants permission to get the properties associated with the FHIR datastore, including the datastore ID, datastore ARN, datastore name, datastore status, created at, datastore type version, and datastore endpoint


name: healthlake:DescribeFHIRExportJob
access_level: Read
description:
Grants permission to display the properties of a FHIR export job, including the ID, ARN, name, and the status of the datastore


name: healthlake:DescribeFHIRImportJob
access_level: Read
description:
Grants permission to display the properties of a FHIR import job, including the ID, ARN, name, and the status of the datastore


name: healthlake:ListFHIRDatastores
access_level: List
description:
Grants permission to list all FHIR datastores that are in the user’s account, regardless of datastore status


name: honeycode:ListDomains
access_level: List
description:
Grants permission to list all Amazon Honeycode domains and their verification status for your AWS Account


name: iam:AddClientIDToOpenIDConnectProvider
access_level: Write
description:
Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource


name: iam:CreateOpenIDConnectProvider
access_level: Write
description:
Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC)


name: iam:CreateSAMLProvider
access_level: Write
description:
Grants permission to create an IAM resource that describes an identity provider (IdP) that supports SAML 2.0


name: iam:CreateServiceLinkedRole
access_level: Write
description:
Grants permission to create an IAM role that allows an AWS service to perform actions on your behalf


name: iam:DeactivateMFADevice
access_level: Write
description:
Grants permission to deactivate the specified MFA device and remove its association with the IAM user for which it was originally enabled


name: iam:DeletePolicy
access_level: Permissions management
description:
Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached


name: iam:DeleteServiceLinkedRole
access_level: Write
description:
Grants permission to delete an IAM role that is linked to a specific AWS service, if the service is no longer using it


name: iam:GetAccountAuthorizationDetails
access_level: Read
description:
Grants permission to retrieve information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another


name: iam:GetContextKeysForCustomPolicy
access_level: Read
description:
Grants permission to retrieve a list of all of the context keys that are referenced in the specified policy


name: iam:GetContextKeysForPrincipalPolicy
access_level: Read
description:
Grants permission to retrieve a list of all context keys that are referenced in all IAM policies that are attached to the specified IAM identity (user, group, or role)


name: iam:GetInstanceProfile
access_level: Read
description:
Grants permission to retrieve information about the specified instance profile, including the instance profile's path, GUID, ARN, and role


name: iam:GetOpenIDConnectProvider
access_level: Read
description:
Grants permission to retrieve information about the specified OpenID Connect (OIDC) provider resource in IAM


name: iam:GetPolicy
access_level: Read
description:
Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached


name: iam:GetPolicyVersion
access_level: Read
description:
Grants permission to retrieve information about a version of the specified managed policy, including the policy document


name: iam:GetRole
access_level: Read
description:
Grants permission to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy


name: iam:GetRolePolicy
access_level: Read
description:
Grants permission to retrieve an inline policy document that is embedded with the specified IAM role


name: iam:GetSAMLProvider
access_level: Read
description:
Grants permission to retrieve the SAML provider metadocument that was uploaded when the IAM SAML provider resource was created or updated


name: iam:GetServiceLastAccessedDetailsWithEntities
access_level: Read
description:
Grants permission to retrieve information about the entities from the service last accessed data report


name: iam:GetUser
access_level: Read
description:
Grants permission to retrieve information about the specified IAM user, including the user's creation date, path, unique ID, and ARN


name: iam:ListAccessKeys
access_level: List
description:
Grants permission to list information about the access key IDs that are associated with the specified IAM user


name: iam:ListGroupPolicies
access_level: List
description:
Grants permission to list the names of the inline policies that are embedded in the specified IAM group


name: iam:ListOpenIDConnectProviders
access_level: List
description:
Grants permission to list information about the IAM OpenID Connect (OIDC) provider resource objects that are defined in the AWS account


name: iam:ListPoliciesGrantingServiceAccess
access_level: List
description:
Grants permission to list information about the policies that grant an entity access to a specific service


name: iam:ListPolicyVersions
access_level: List
description:
Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version


name: iam:ListRolePolicies
access_level: List
description:
Grants permission to list the names of the inline policies that are embedded in the specified IAM role


name: iam:ListSSHPublicKeys
access_level: List
description:
Grants permission to list information about the SSH public keys that are associated with the specified IAM user


name: iam:ListServiceSpecificCredentials
access_level: List
description:
Grants permission to list the service-specific credentials that are associated with the specified IAM user


name: iam:ListSigningCertificates
access_level: List
description:
Grants permission to list information about the signing certificates that are associated with the specified IAM user


name: iam:ListUserPolicies
access_level: List
description:
Grants permission to list the names of the inline policies that are embedded in the specified IAM user


name: iam:PutGroupPolicy
access_level: Permissions management
description:
Grants permission to create or update an inline policy document that is embedded in the specified IAM group


name: iam:PutRolePolicy
access_level: Permissions management
description:
Grants permission to create or update an inline policy document that is embedded in the specified IAM role


name: iam:PutUserPolicy
access_level: Permissions management
description:
Grants permission to create or update an inline policy document that is embedded in the specified IAM user


name: iam:RemoveClientIDFromOpenIDConnectProvider
access_level: Write
description:
Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource


name: iam:SimulateCustomPolicy
access_level: Read
description:
Grants permission to simulate whether an identity-based policy or resource-based policy provides permissions for specific API operations and resources


name: iam:SimulatePrincipalPolicy
access_level: Read
description:
Grants permission to simulate whether an identity-based policy that is attached to a specified IAM entity (user or role) provides permissions for specific API operations and resources


name: iam:UpdateOpenIDConnectProviderThumbprint
access_level: Write
description:
Grants permission to update the entire list of server certificate thumbprints that are associated with an OpenID Connect (OIDC) provider resource


name: iam:UpdateServiceSpecificCredential
access_level: Write
description:
Grants permission to update the status of a service-specific credential to active or inactive for an IAM user


name: iam:UpdateSigningCertificate
access_level: Write
description:
Grants permission to update the status of the specified user signing certificate to active or disabled


name: iam:UploadSigningCertificate
access_level: Write
description:
Grants permission to upload an X.509 signing certificate and associate it with the specified IAM user


name: identitystore:DescribeGroup
access_level: Read
description:
Grants permission to retrieves information about group from the directory that AWS Identity Store provides by default


name: identitystore:DescribeUser
access_level: Read
description:
Grants permission to retrieves information about user from the directory that AWS Identity Store provides by default


name: importexport:CancelJob
access_level: Write
description:
This action cancels a specified job. Only the job owner can cancel it. The action fails if the job has already started or is complete.


name: importexport:GetShippingLabel
access_level: Read
description:
This action generates a pre-paid shipping label that you will use to ship your device to AWS for processing.


name: importexport:GetStatus
access_level: Read
description:
This action returns information about a job, including where the job is in the processing pipeline, the status of the results, and the signature value associated with the job.


name: importexport:UpdateJob
access_level: Write
description:
You use this action to change the parameters specified in the original manifest file by supplying a new manifest file.


name: inspector:AddAttributesToFindings
access_level: Write
description:
Grants permission to assign attributes (key and value pairs) to the findings that are specified by the ARNs of the findings


name: inspector:CreateAssessmentTarget
access_level: Write
description:
Grants permission to create a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup


name: inspector:CreateAssessmentTemplate
access_level: Write
description:
Grants permission to create an assessment template for the assessment target that is specified by the ARN of the assessment target


name: inspector:CreateExclusionsPreview
access_level: Write
description:
Grants permission to start the generation of an exclusions preview for the specified assessment template


name: inspector:CreateResourceGroup
access_level: Write
description:
Grants permission to create a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target


name: inspector:DeleteAssessmentTarget
access_level: Write
description:
Grants permission to delete the assessment target that is specified by the ARN of the assessment target


name: inspector:DeleteAssessmentTemplate
access_level: Write
description:
Grants permission to delete the assessment template that is specified by the ARN of the assessment template


name: inspector:DescribeAssessmentRuns
access_level: Read
description:
Grants permission to describe the assessment runs that are specified by the ARNs of the assessment runs


name: inspector:DescribeAssessmentTargets
access_level: Read
description:
Grants permission to describe the assessment targets that are specified by the ARNs of the assessment targets


name: inspector:DescribeAssessmentTemplates
access_level: Read
description:
Grants permission to describe the assessment templates that are specified by the ARNs of the assessment templates


name: inspector:DescribeResourceGroups
access_level: Read
description:
Grants permission to describe the resource groups that are specified by the ARNs of the resource groups


name: inspector:DescribeRulesPackages
access_level: Read
description:
Grants permission to describe the rules packages that are specified by the ARNs of the rules packages


name: inspector:GetAssessmentReport
access_level: Read
description:
Grants permission to produce an assessment report that includes detailed and comprehensive results of a specified assessment run


name: inspector:GetExclusionsPreview
access_level: Read
description:
Grants permission to retrieve the exclusions preview (a list of ExclusionPreview objects) specified by the preview token


name: inspector:GetTelemetryMetadata
access_level: Read
description:
Grants permission to get information about the data that is collected for the specified assessment run


name: inspector:ListAssessmentRunAgents
access_level: List
description:
Grants permission to list the agents of the assessment runs that are specified by the ARNs of the assessment runs


name: inspector:ListAssessmentRuns
access_level: List
description:
Grants permission to list the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates


name: inspector:ListAssessmentTemplates
access_level: List
description:
Grants permission to list the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets


name: inspector:ListEventSubscriptions
access_level: List
description:
Grants permission to list all the event subscriptions for the assessment template that is specified by the ARN of the assessment template


name: inspector:ListFindings
access_level: List
description:
Grants permission to list findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs


name: inspector:PreviewAgents
access_level: Read
description:
Grants permission to preview the agents installed on the EC2 instances that are part of the specified assessment target


name: inspector:RegisterCrossAccountAccessRole
access_level: Write
description:
Grants permission to register the IAM role that Amazon Inspector uses to list your EC2 instances at the start of the assessment run or when you call the PreviewAgents action


name: inspector:RemoveAttributesFromFindings
access_level: Write
description:
Grants permission to remove entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists


name: inspector:SetTagsForResource
access_level: Tagging
description:
Grants permission to set tags (key and value pairs) to the assessment template that is specified by the ARN of the assessment template


name: inspector:SubscribeToEvent
access_level: Write
description:
Grants permission to enable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic


name: inspector:UnsubscribeFromEvent
access_level: Write
description:
Grants permission to disable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic


name: inspector:UpdateAssessmentTarget
access_level: Write
description:
Grants permission to update the assessment target that is specified by the ARN of the assessment target


name: iot:AttachPrincipalPolicy
access_level: Permissions management
description:
Grants permission to attach the specified policy to the specified principal (certificate or other credential)


name: iot:AttachSecurityProfile
access_level: Write
description:
Grants permission to associate a Device Defender security profile with a thing group or with this account


name: iot:CancelAuditTask
access_level: Write
description:
Grants permission to cancel an audit that is in progress. The audit can be either scheduled or on-demand


name: iot:CreateDimension
access_level: Write
description:
Grants permission to define a dimension that can be used to to limit the scope of a metric used in a security profile


name: iot:CreateKeysAndCertificate
access_level: Write
description:
Grants permission to create a 2048 bit RSA key pair and issues an X.509 certificate using the issued public key


name: iot:CreateMitigationAction
access_level: Write
description:
Grants permission to define an action that can be applied to audit findings by using StartAuditMitigationActionsTask


name: iot:DescribeAuditFinding
access_level: Read
description:
Grants permission to get information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and when the audit that returned the finding was started


name: iot:DescribeAuditMitigationActionsTask
access_level: Read
description:
Grants permission to get information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings


name: iot:DetachSecurityProfile
access_level: Write
description:
Grants permission to disassociate a Device Defender security profile from a thing group or from this account


name: iot:GetPolicy
access_level: Read
description:
Grants permission to get information about the specified policy with the policy document of the default version


name: iot:ListActiveViolations
access_level: List
description:
Grants permission to list the active violations for a given Device Defender security profile or Thing


name: iot:ListAuditFindings
access_level: List
description:
Grants permission to list the findings (results) of a Device Defender audit or of the audits performed during a specified time period


name: iot:ListAuditTasks
access_level: List
description:
Grants permission to list the Device Defender audits that have been performed during a given time period


name: iot:ListDetectMitigationActionsExecutions
access_level: List
description:
Grants permission to lists mitigation actions executions for a Device Defender ML Detect Security Profile


name: iot:ListPrincipalPolicies
access_level: List
description:
Grants permission to list the policies attached to the specified principal. If you use an Amazon Cognito identity, the ID needs to be in Amazon Cognito Identity format


name: iot:ListViolationEvents
access_level: List
description:
Grants permission to list the Device Defender security profile violations discovered during the given time period


name: iot:RegisterCertificateWithoutCA
access_level: Write
description:
Grants permission to register a device certificate with AWS IoT without a registered CA (certificate authority)


name: iot:SetDefaultAuthorizer
access_level: Permissions management
description:
Grants permission to set the default authorizer. This will be used if a websocket connection is made without specifying an authorizer


name: iot:SetDefaultPolicyVersion
access_level: Permissions management
description:
Grants permission to set the specified version of the specified policy as the policy's default (operative) version


name: iot:UpdateScheduledAudit
access_level: Write
description:
Grants permission to update a scheduled audit, including what checks are performed and how often the audit takes place


name: iot-device-tester:CheckVersion
access_level: Read
description:
Grants permission for IoT Device Tester to check if a given set of product, test suite and device tester version are compatible


name: iot-device-tester:LatestIdt
access_level: Read
description:
Grants permission for IoT Device Tester to get information on latest version of device tester available


name: iotanalytics:TagResource
access_level: Tagging
description:
Adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource.


name: iotdeviceadvisor:TagResource
access_level: Tagging
description:
Grants permission to add to or modify the tags of the given resource. Tags are metadata which can be used to manage a resource


name: iotevents:CreateAlarmModel
access_level: Write
description:
Grants permission to create an alarm model to monitor an AWS IoT Events input attribute or an AWS IoT SiteWise asset property


name: iotevents:TagResource
access_level: Tagging
description:
Grants permission to adds to or modifies the tags of the given resource.Tags are metadata which can be used to manage a resource


name: iotthingsgraph:AssociateEntityToThing
access_level: Write
description:
Associates a device with a concrete thing that is in the user's registry. A thing can be associated with only one device at a time. If you associate a thing with a new device id, its previous association will be removed.


name: iotthingsgraph:CreateFlowTemplate
access_level: Write
description:
Creates a workflow template. Workflows can be created only in the user's namespace. (The public namespace contains only entities.) The workflow can contain only entities in the specified namespace. The workflow is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.


name: iotthingsgraph:CreateSystemTemplate
access_level: Write
description:
Creates a system. The system is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.


name: iotthingsgraph:DeleteFlowTemplate
access_level: Write
description:
Deletes a workflow. Any new system or system instance that contains this workflow will fail to update or deploy. Existing system instances that contain the workflow will continue to run (since they use a snapshot of the workflow taken at the time of deploying the system instance).


name: iotthingsgraph:DeleteNamespace
access_level: Write
description:
Deletes the specified namespace. This action deletes all of the entities in the namespace. Delete the systems and flows in the namespace before performing this action.


name: iotthingsgraph:DeleteSystemInstance
access_level: Write
description:
Deletes a system instance. Only instances that have never been deployed, or that have been undeployed from the target can be deleted. Users can create a new system instance that has the same ID as a deleted system instance.


name: iotthingsgraph:DeleteSystemTemplate
access_level: Write
description:
Deletes a system. New system instances can't contain the system after its deletion. Existing system instances that contain the system will continue to work because they use a snapshot of the system that is taken when it is deployed.


name: iotthingsgraph:DeprecateFlowTemplate
access_level: Write
description:
Deprecates the specified workflow. This action marks the workflow for deletion. Deprecated flows can't be deployed, but existing system instances that use the flow will continue to run.


name: iotthingsgraph:DissociateEntityFromThing
access_level: Write
description:
Dissociates a device entity from a concrete thing. The action takes only the type of the entity that you need to dissociate because only one entity of a particular type can be associated with a thing.


name: iotthingsgraph:GetEntities
access_level: Read
description:
Gets descriptions of the specified entities. Uses the latest version of the user's namespace by default.


name: iotthingsgraph:GetFlowTemplate
access_level: Read
description:
Gets the latest version of the DefinitionDocument and FlowTemplateSummary for the specified workflow.


name: iotthingsgraph:GetFlowTemplateRevisions
access_level: Read
description:
Gets revisions of the specified workflow. Only the last 100 revisions are stored. If the workflow has been deprecated, this action will return revisions that occurred before the deprecation. This action won't work for workflows that have been deleted.


name: iotthingsgraph:GetSystemTemplateRevisions
access_level: Read
description:
Gets revisions made to the specified system template. Only the previous 100 revisions are stored. If the system has been deprecated, this action will return the revisions that occurred before its deprecation. This action won't work with systems that have been deleted.


name: iotthingsgraph:SearchEntities
access_level: Read
description:
Searches for entities of the specified type. You can search for entities in your namespace and the public namespace that you're tracking.


name: iotthingsgraph:SearchSystemTemplates
access_level: Read
description:
Searches for summary information about systems in the user's account. You can filter by the ID of a workflow to return only systems that use the specified workflow.


name: iotthingsgraph:SearchThings
access_level: Read
description:
Searches for things associated with the specified entity. You can search by both device and device model.


name: iotthingsgraph:UpdateFlowTemplate
access_level: Write
description:
Updates the specified workflow. All deployed systems and system instances that use the workflow will see the changes in the flow when it is redeployed. The workflow can contain only entities in the specified namespace.


name: iotthingsgraph:UpdateSystemTemplate
access_level: Write
description:
Updates the specified system. You don't need to run this action after updating a workflow. Any system instance that uses the system will see the changes in the system when it is redeployed.


name: iotwireless:AssociateWirelessGatewayWithThing
access_level: Write
description:
Grants permission to associate the wireless gateway with AWS IoT thing for a given wirelessGatewayId


name: iotwireless:GetServiceEndpoint
access_level: Read
description:
Grants permission to retrieve the customer account specific endpoint for CUPS protocol connection or LoRaWAN Network Server (LNS) protocol connection, and optionally server trust certificate in PEM format


name: iotwireless:ListWirelessGatewayTaskDefinitions
access_level: List
description:
Grants permission to list information of available WirelessGateway task definitions based on the AWS account


name: kafka:ListClusterOperations
access_level: List
description:
Grants permission to return a list of all the operations that have been performed on the specified MSK cluster


name: kafka-cluster:AlterCluster
access_level: Write
description:
Grants permission to alter various aspects of the cluster, equivalent to Apache Kafka's ALTER CLUSTER ACL


name: kafka-cluster:AlterClusterDynamicConfiguration
access_level: Write
description:
Grants permission to alter the dynamic configuration of a cluster, equivalent to Apache Kafka's ALTER_CONFIGS CLUSTER ACL


name: kafka-cluster:AlterTopicDynamicConfiguration
access_level: Write
description:
Grants permission to alter the dynamic configuration of topics on a cluster, equivalent to Apache Kafka's ALTER_CONFIGS TOPIC ACL


name: kafka-cluster:AlterTransactionalId
access_level: Write
description:
Grants permission to alter transactional IDs on a cluster, equivalent to Apache Kafka's WRITE TRANSACTIONAL_ID ACL


name: kafka-cluster:CreateTopic
access_level: Write
description:
Grants permission to create topics on a cluster, equivalent to Apache Kafka's CREATE CLUSTER/TOPIC ACL


name: kafka-cluster:DescribeCluster
access_level: List
description:
Grants permission to describe various aspects of the cluster, equivalent to Apache Kafka's DESCRIBE CLUSTER ACL


name: kafka-cluster:DescribeClusterDynamicConfiguration
access_level: List
description:
Grants permission to describe the dynamic configuration of a cluster, equivalent to Apache Kafka's DESCRIBE_CONFIGS CLUSTER ACL


name: kafka-cluster:DescribeTopicDynamicConfiguration
access_level: List
description:
Grants permission to describe the dynamic configuration of topics on a cluster, equivalent to Apache Kafka's DESCRIBE_CONFIGS TOPIC ACL


name: kafka-cluster:DescribeTransactionalId
access_level: List
description:
Grants permission to describe transactional IDs on a cluster, equivalent to Apache Kafka's DESCRIBE TRANSACTIONAL_ID ACL


name: kafka-cluster:ReadData
access_level: Read
description:
Grants permission to read data from topics on a cluster, equivalent to Apache Kafka's READ TOPIC ACL


name: kafka-cluster:WriteData
access_level: Write
description:
Grants permission to write data to topics on a cluster, equivalent to Apache Kafka's WRITE TOPIC ACL


name: kafka-cluster:WriteDataIdempotently
access_level: Write
description:
Grants permission to write data idempotently on a cluster, equivalent to Apache Kafka's IDEMPOTENT_WRITE CLUSTER ACL


name: kinesis:DecreaseStreamRetentionPeriod
access_level: Write
description:
Decreases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.


name: kinesis:IncreaseStreamRetentionPeriod
access_level: Write
description:
Increases the stream's retention period, which is the length of time data records are accessible after they are added to the stream.


name: kinesis:ListStreamConsumers
access_level: List
description:
Lists the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer.


name: kinesis:MergeShards
access_level: Write
description:
Merges two adjacent shards in a stream and combines them into a single shard to reduce the stream's capacity to ingest and transport data.


name: kinesis:PutRecords
access_level: Write
description:
Writes multiple data records from a producer into an Amazon Kinesis stream in a single call (also referred to as a PutRecords request).


name: kinesis:StartStreamEncryption
access_level: Write
description:
Grants permission to enable or update server-side encryption using an AWS KMS key for a specified stream.


name: kinesisanalytics:GetApplicationState
access_level: Read
description:
Grant permission to Kinesis Data Analytics console to display stream results for Kinesis Data Analytics SQL runtime applications.


name: kinesisanalytics:CreateApplicationPresignedUrl
access_level: Read
description:
Grants permission to create and return a URL that you can use to connect to an application's extension


name: kinesisvideo:GetDataEndpoint
access_level: Read
description:
Grants permission to get an endpoint for a specified stream for either reading or writing media data to Kinesis Video Streams


name: kinesisvideo:GetSignalingChannelEndpoint
access_level: Read
description:
Grants permission to get endpoints for a specified combination of protocol and role for a signaling channel


name: kinesisvideo:ListFragments
access_level: List
description:
Grants permission to list the fragments from archival storage based on the pagination token or selector type with range specified


name: kms:ConnectCustomKeyStore
access_level: Write
description:
Controls permission to connect or reconnect a custom key store to its associated AWS CloudHSM cluster


name: kms:CreateAlias
access_level: Write
description:
Controls permission to create an alias for a customer master key (CMK). Aliases are optional friendly names that you can associate with customer master keys


name: kms:CreateCustomKeyStore
access_level: Write
description:
Controls permission to create a custom key store that is associated with an AWS CloudHSM cluster that you own and manage


name: kms:CreateGrant
access_level: Permissions management
description:
Controls permission to add a grant to a customer master key. You can use grants to add permissions without changing the key policy or IAM policy


name: kms:CreateKey
access_level: Write
description:
Controls permission to create a customer master key that can be used to protect data keys and other sensitive information


name: kms:DeleteAlias
access_level: Write
description:
Controls permission to delete an alias. Aliases are optional friendly names that you can associate with customer master keys


name: kms:DeleteImportedKeyMaterial
access_level: Write
description:
Controls permission to delete cryptographic material that you imported into a customer master key. This action makes the key unusable


name: kms:DisableKey
access_level: Write
description:
Controls permission to disable a customer master key, which prevents it from being used in cryptographic operations


name: kms:EnableKey
access_level: Write
description:
Controls permission to change the state of a customer master key (CMK) to enabled. This allows the CMK to be used in cryptographic operations


name: kms:EnableKeyRotation
access_level: Write
description:
Controls permission to enable automatic rotation of the cryptographic material in a customer master key


name: kms:GenerateDataKey
access_level: Write
description:
Controls permission to use the customer master key to generate data keys. You can use the data keys to encrypt data outside of AWS KMS


name: kms:GenerateDataKeyPairWithoutPlaintext
access_level: Write
description:
Controls permission to use the customer master key to generate data key pairs. Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy


name: kms:GenerateDataKeyWithoutPlaintext
access_level: Write
description:
Controls permission to use the customer master key to generate a data key. Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key


name: kms:GetKeyRotationStatus
access_level: Read
description:
Controls permission to determine whether automatic key rotation is enabled on the customer master key


name: kms:GetParametersForImport
access_level: Read
description:
Controls permission to get data that is required to import cryptographic material into a customer managed key, including a public key and import token


name: kms:ListAliases
access_level: List
description:
Controls permission to view the aliases that are defined in the account. Aliases are optional friendly names that you can associate with customer master keys


name: kms:ListKeys
access_level: List
description:
Controls permission to view the key ID and Amazon Resource Name (ARN) of all customer master keys in the account


name: kms:ListRetirableGrants
access_level: List
description:
Controls permission to view grants in which the specified principal is the retiring principal. Other principals might be able to retire the grant and this principal might be able to retire other grants


name: kms:ReEncryptFrom
access_level: Write
description:
Controls permission to decrypt data as part of the process that decrypts and reencrypts the data within AWS KMS


name: kms:ReEncryptTo
access_level: Write
description:
Controls permission to encrypt data as part of the process that decrypts and reencrypts the data within AWS KMS


name: kms:RetireGrant
access_level: Permissions management
description:
Controls permission to retire a grant. The RetireGrant operation is typically called by the grant user after they complete the tasks that the grant allowed them to perform


name: kms:RevokeGrant
access_level: Permissions management
description:
Controls permission to revoke a grant, which denies permission for all operations that depend on the grant


name: kms:UpdateAlias
access_level: Write
description:
Controls permission to associate an alias with a different customer master key. An alias is an optional friendly name that you can associate with a customer master key


name: lakeformation:GetDataLakeSettings
access_level: Read
description:
Retrieves data lake settings such as the list of data lake administrators and database and table default permissions.


name: lakeformation:PutDataLakeSettings
access_level: Permissions management
description:
Overwrites data lake settings such as the list of data lake administrators and database and table default permissions.


name: lambda:AddLayerVersionPermission
access_level: Permissions management
description:
Grants permission to add permissions to the resource-based policy of a version of an AWS Lambda layer


name: lambda:AddPermission
access_level: Permissions management
description:
Grants permission to give an AWS service or another account permission to use an AWS Lambda function


name: lambda:DeleteFunctionEventInvokeConfig
access_level: Write
description:
Grants permission to delete the configuration for asynchronous invocation for an AWS Lambda function, version, or alias


name: lambda:GetFunctionConfiguration
access_level: Read
description:
Grants permission to view details about the version-specific settings of an AWS Lambda function or version


name: lambda:GetFunctionEventInvokeConfig
access_level: Read
description:
Grants permission to view the configuration for asynchronous invocation for a function, version, or alias


name: lambda:GetLayerVersion
access_level: Read
description:
Grants permission to view details about a version of an AWS Lambda layer. Note this action also supports GetLayerVersionByArn API


name: lambda:GetProvisionedConcurrencyConfig
access_level: Read
description:
Grants permission to view the provisioned concurrency configuration for an AWS Lambda function's alias or version


name: lambda:ListFunctions
access_level: List
description:
Grants permission to retrieve a list of AWS Lambda functions, with the version-specific configuration of each function


name: lambda:ListLayers
access_level: List
description:
Grants permission to retrieve a list of AWS Lambda layers, with details about the latest version of each layer


name: lambda:ListProvisionedConcurrencyConfigs
access_level: List
description:
Grants permission to retrieve a list of provisioned concurrency configurations for an AWS Lambda function


name: lambda:PutFunctionEventInvokeConfig
access_level: Write
description:
Grants permission to configures options for asynchronous invocation on an AWS Lambda function, version, or alias


name: lambda:PutProvisionedConcurrencyConfig
access_level: Write
description:
Grants permission to configure provisioned concurrency for an AWS Lambda function's alias or version


name: lambda:RemoveLayerVersionPermission
access_level: Permissions management
description:
Grants permission to remove a statement from the permissions policy for a version of an AWS Lambda layer


name: lambda:UpdateFunctionEventInvokeConfig
access_level: Write
description:
Grants permission to modify the configuration for asynchronous invocation for an AWS Lambda function, version, or alias


name: lex:GetBot
access_level: Read
description:
Returns information for a specific bot. In addition to the bot name, the bot version or alias is required.


name: lex:GetIntent
access_level: Read
description:
Returns information for a specific intent. In addition to the intent name, you must also specify the intent version.


name: lex:GetIntents
access_level: List
description:
Returns information for the $LATEST version of all intents, subject to filters provided by the client.


name: lex:GetSlotType
access_level: Read
description:
Returns information about a specific version of a slot type. In addition to specifying the slot type name, you must also specify the slot type version.


name: lex:GetSlotTypes
access_level: List
description:
Returns information for the $LATEST version of all slot types, subject to filters provided by the client.


name: lightsail:AttachCertificateToDistribution
access_level: Write
description:
Grants permission to attach an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:CreateContainerServiceRegistryLogin
access_level: Write
description:
Grants permission to create a temporary set of log in credentials that you can use to log in to the Docker process on your local machine


name: lightsail:CreateDomainEntry
access_level: Write
description:
Grants permission to create one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT)


name: lightsail:DeleteContainerImage
access_level: Write
description:
Grants permission to delete a container image that is registered to your Amazon Lightsail container service


name: lightsail:DeleteKnownHostKeys
access_level: Write
description:
Grants permission to delete the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance


name: lightsail:DetachCertificateFromDistribution
access_level: Write
description:
Grants permission to detach an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:DownloadDefaultKeyPair
access_level: Write
description:
Grants permission to download the default key pair used to authenticate and connect to instances in a specific AWS Region


name: lightsail:GetBlueprints
access_level: Read
description:
Grants permission to get a list of instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance


name: lightsail:GetBundles
access_level: Read
description:
Grants permission to get a list of instance bundles. You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance


name: lightsail:GetCloudFormationStackRecords
access_level: Read
description:
Grants permission to get information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots


name: lightsail:GetContainerAPIMetadata
access_level: Read
description:
Grants permission to view information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin


name: lightsail:GetContainerImages
access_level: Read
description:
Grants permission to view the container images that are registered to your Amazon Lightsail container service


name: lightsail:GetContainerServiceMetricData
access_level: Read
description:
Grants permission to view the data points of a specific metric of your Amazon Lightsail container service


name: lightsail:GetContainerServicePowers
access_level: Read
description:
Grants permission to view the list of powers that can be specified for your Amazon Lightsail container services


name: lightsail:GetDistributionBundles
access_level: Read
description:
Grants permission to view the list of bundles that can be applied to you Amazon Lightsail content delivery network (CDN) distributions


name: lightsail:GetDistributionLatestCacheReset
access_level: Read
description:
Grants permission to view the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:GetDistributionMetricData
access_level: Read
description:
Grants permission to view the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:GetDistributions
access_level: Read
description:
Grants permission to view information about one or more of your Amazon Lightsail content delivery network (CDN) distributions


name: lightsail:GetExportSnapshotRecords
access_level: Read
description:
Grants permission to get information about all records of exported Amazon Lightsail snapshots to Amazon EC2


name: lightsail:GetOperation
access_level: Read
description:
Grants permission to get information about an operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on


name: lightsail:GetOperations
access_level: Read
description:
Grants permission to get information about all operations. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on


name: lightsail:GetRelationalDatabaseBlueprints
access_level: Read
description:
Grants permission to get a list of relational database images, or blueprints. You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database


name: lightsail:GetRelationalDatabaseBundles
access_level: Read
description:
Grants permission to get a list of relational database bundles. You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database


name: lightsail:IsVpcPeered
access_level: Read
description:
Grants permission to get a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered


name: lightsail:PeerVpc
access_level: Write
description:
Grants permission to try to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC


name: lightsail:PutInstancePublicPorts
access_level: Write
description:
Grants permission to set the specified open ports for an instance, and closes all ports for every protocol not included in the request


name: lightsail:ResetDistributionCache
access_level: Write
description:
Grants permission to delete currently cached content from your Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:SendContactMethodVerification
access_level: Write
description:
Grants permission to send a verification request to an email contact method to ensure it's owned by the requester


name: lightsail:SetResourceAccessForBucket
access_level: Write
description:
Grants permission to set the Amazon Lightsail resources that can access the specified Amazon Lightsail bucket


name: lightsail:TestAlarm
access_level: Write
description:
Grants permission to test an alarm by displaying a banner on the Amazon Lightsail console or if a notification trigger is configured for the specified alarm, by sending a notification to the notification protocol


name: lightsail:UnpeerVpc
access_level: Write
description:
Grants permission to try to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC


name: lightsail:UpdateContainerService
access_level: Write
description:
Grants permission to update the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names


name: lightsail:UpdateDistribution
access_level: Write
description:
Grants permission to update an existing Amazon Lightsail content delivery network (CDN) distribution or its configuration


name: lightsail:UpdateDistributionBundle
access_level: Write
description:
Grants permission to update the bundle of your Amazon Lightsail content delivery network (CDN) distribution


name: lightsail:UpdateLoadBalancerAttribute
access_level: Write
description:
Grants permission to update a load balancer attribute, such as the health check path and session stickiness


name: logs:AssociateKmsKey
access_level: Write
description:
Grants permissions to associate the specified AWS Key Management Service (AWS KMS) customer master key (CMK) with the specified log group


name: logs:CreateExportTask
access_level: Write
description:
Grants permissions to create an ExportTask which allows you to efficiently export data from a Log Group to your Amazon S3 bucket


name: logs:DescribeDestinations
access_level: List
description:
Grants permissions to return all the destinations that are associated with the AWS account making the request


name: logs:DescribeExportTasks
access_level: List
description:
Grants permissions to return all the export tasks that are associated with the AWS account making the request


name: logs:DescribeLogGroups
access_level: List
description:
Grants permissions to return all the log groups that are associated with the AWS account making the request


name: logs:DescribeQueries
access_level: List
description:
Grants permissions to return a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account


name: logs:DescribeQueryDefinitions
access_level: List
description:
Grants permissions to return a paginated list of your saved CloudWatch Logs Insights query definitions


name: logs:DisassociateKmsKey
access_level: Write
description:
Grants permissions to disassociate the associated AWS Key Management Service (AWS KMS) customer master key (CMK) from the specified log group


name: logs:FilterLogEvents
access_level: Read
description:
Grants permissions to retrieve log events, optionally filtered by a filter pattern from the specified log group


name: logs:GetLogGroupFields
access_level: Read
description:
Grants permissions to return a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field


name: logs:PutMetricFilter
access_level: Write
description:
Grants permissions to create or update a metric filter and associates it with the specified log group


name: logs:PutResourcePolicy
access_level: Write
description:
Grants permissions to create or update a resource policy allowing other AWS services to put log events to this account


name: logs:PutSubscriptionFilter
access_level: Write
description:
Grants permissions to create or update a subscription filter and associates it with the specified log group


name: logs:TestMetricFilter
access_level: Read
description:
Grants permissions to test the filter pattern of a metric filter against a sample of log event messages


name: machinelearning:AddTags
access_level: Tagging
description:
Adds one or more tags to an object, up to a limit of 10. Each tag consists of a key and an optional value


name: machinelearning:DeleteTags
access_level: Tagging
description:
Deletes the specified tags associated with an ML object. After this operation is complete, you can't recover deleted tags


name: machinelearning:GetDataSource
access_level: Read
description:
Returns a DataSource that includes metadata and data file information, as well as the current status of the DataSource


name: machinelearning:GetMLModel
access_level: Read
description:
Returns an MLModel that includes detailed metadata, and data source information as well as the current status of the MLModel


name: macie:AssociateS3Resources
access_level: Write
description:
Enables the user to associate specified S3 resources with Amazon Macie for monitoring and data classification.


name: macie2:DeleteMember
access_level: Write
description:
Grants permission to delete the association between an Amazon Macie administrator account and an account


name: macie2:DescribeBuckets
access_level: Read
description:
Grants permission to retrieve statistical data and other information about S3 buckets that Amazon Macie monitors and analyzes


name: macie2:DescribeClassificationJob
access_level: Read
description:
Grants permission to retrieve information about the status and settings for a sensitive data discovery job


name: macie2:DescribeOrganizationConfiguration
access_level: Read
description:
Grants permission to retrieve information about the Amazon Macie configuration settings for an AWS organization


name: macie2:DisableMacie
access_level: Write
description:
Grants permission to disable an Amazon Macie account, which also deletes Macie resources for the account


name: macie2:DisableOrganizationAdminAccount
access_level: Write
description:
Grants permission to disable an account as the delegated Amazon Macie administrator account for an AWS organization


name: macie2:DisassociateFromAdministratorAccount
access_level: Write
description:
Grants an Amazon Macie member account with permission to disassociate from its Macie administrator account


name: macie2:DisassociateFromMasterAccount
access_level: Write
description:
(Deprecated) Grants an Amazon Macie member account with permission to disassociate from its Macie administrator account


name: macie2:DisassociateMember
access_level: Write
description:
Grants an Amazon Macie administrator account with permission to disassociate from a Macie member account


name: macie2:EnableOrganizationAdminAccount
access_level: Write
description:
Grants permission to enable an account as the delegated Amazon Macie administrator account for an AWS organization


name: macie2:GetAdministratorAccount
access_level: Read
description:
Grants permission to retrieve information about the Amazon Macie administrator account for an account


name: macie2:GetBucketStatistics
access_level: Read
description:
Grants permission to retrieve aggregated statistical data for all the S3 buckets that Amazon Macie monitors and analyzes


name: macie2:GetFindingsPublicationConfiguration
access_level: Read
description:
Grants permission to retrieve the configuration settings for publishing findings to AWS Security Hub


name: macie2:GetInvitationsCount
access_level: Read
description:
Grants permission to retrieve the count of Amazon Macie membership invitations that were received by an account


name: macie2:GetMacieSession
access_level: Read
description:
Grants permission to retrieve information about the status and configuration settings for an Amazon Macie account


name: macie2:GetMasterAccount
access_level: Read
description:
(Deprecated) Grants permission to retrieve information about the Amazon Macie administrator account for an account


name: macie2:GetMember
access_level: Read
description:
Grants permission to retrieve information about an account that's associated with an Amazon Macie administrator account


name: macie2:ListClassificationJobs
access_level: List
description:
Grants permission to retrieve a subset of information about the status and settings for one or more sensitive data discovery jobs


name: macie2:ListInvitations
access_level: List
description:
Grants permission to retrieve information about all the Amazon Macie membership invitations that were received by an account


name: macie2:ListMembers
access_level: List
description:
Grants permission to retrieve information about the Amazon Macie member accounts that are associated with a Macie administrator account


name: macie2:ListOrganizationAdminAccounts
access_level: List
description:
Grants permission to retrieve information about the delegated, Amazon Macie administrator account for an AWS organization


name: macie2:SearchResources
access_level: Read
description:
Grants permission to retrieve statistical data and other information about AWS resources that Amazon Macie monitors and analyzes


name: macie2:UpdateMacieSession
access_level: Write
description:
Grants permission to suspend or re-enable an Amazon Macie account, or update the configuration settings for a Macie account


name: macie2:UpdateMemberSession
access_level: Write
description:
Grants an Amazon Macie administrator account with permission to suspend or re-enable a Macie member account


name: managedblockchain:CreateProposal
access_level: Write
description:
Grants permission to create a proposal that other blockchain network members can vote on to add or remove a member in an Amazon Managed Blockchain network


name: managedblockchain:DeleteMember
access_level: Write
description:
Grants permission to delete a member and all associated resources from an Amazon Managed Blockchain network


name: managedblockchain:GetMember
access_level: Read
description:
Grants permission to return detailed information about a member of an Amazon Managed Blockchain network


name: managedblockchain:GetNode
access_level: Read
description:
Grants permission to return detailed information about a node within a member of an Amazon Managed Blockchain network


name: managedblockchain:GetProposal
access_level: Read
description:
Grants permission to return detailed information about a proposal of an Amazon Managed Blockchain network


name: managedblockchain:ListInvitations
access_level: List
description:
Grants permission to list the invitations extended to the active AWS account from any Managed Blockchain network


name: managedblockchain:ListMembers
access_level: List
description:
Grants permission to list the members of an Amazon Managed Blockchain network and the properties of their memberships


name: managedblockchain:ListNetworks
access_level: List
description:
Grants permission to list the Amazon Managed Blockchain networks in which the current AWS account participates


name: managedblockchain:ListProposalVotes
access_level: Read
description:
Grants permission to list all votes for a proposal, including the value of the vote and the unique identifier of the member that cast the vote for the given Amazon Managed Blockchain network


name: managedblockchain:VoteOnProposal
access_level: Write
description:
Grants permission to cast a vote for a proposal on behalf of the blockchain network member specified


name: mechanicalturk:CreateAdditionalAssignmentsForHIT
access_level: Write
description:
The CreateAdditionalAssignmentsForHIT operation increases the maximum number of assignments of an existing HIT


name: mechanicalturk:CreateHITWithHITType
access_level: Write
description:
The CreateHITWithHITType operation creates a new Human Intelligence Task (HIT) using an existing HITTypeID generated by the CreateHITType operation


name: mechanicalturk:CreateQualificationType
access_level: Write
description:
The CreateQualificationType operation creates a new Qualification type, which is represented by a QualificationType data structure


name: mechanicalturk:DeleteQualificationType
access_level: Write
description:
The DeleteQualificationType disposes a Qualification type and disposes any HIT types that are associated with the Qualification type


name: mechanicalturk:GetAccountBalance
access_level: Read
description:
The GetAccountBalance operation retrieves the amount of money in your Amazon Mechanical Turk account


name: mechanicalturk:GetAssignment
access_level: Read
description:
The GetAssignment retrieves an assignment with an AssignmentStatus value of Submitted, Approved, or Rejected, using the assignment's ID


name: mechanicalturk:GetQualificationScore
access_level: Read
description:
The GetQualificationScore operation returns the value of a Worker's Qualification for a given Qualification type


name: mechanicalturk:ListBonusPayments
access_level: List
description:
The ListBonusPayments operation retrieves the amounts of bonuses you have paid to Workers for a given HIT or assignment


name: mechanicalturk:ListHITsForQualificationType
access_level: List
description:
The ListHITsForQualificationType operation returns the HITs that use the given QualififcationType for a QualificationRequirement


name: mechanicalturk:ListQualificationRequests
access_level: List
description:
The ListQualificationRequests operation retrieves requests for Qualifications of a particular Qualification type


name: mechanicalturk:ListQualificationTypes
access_level: List
description:
The ListQualificationTypes operation searches for Qualification types using the specified search query, and returns a list of Qualification types


name: mechanicalturk:ListReviewPolicyResultsForHIT
access_level: List
description:
The ListReviewPolicyResultsForHIT operation retrieves the computed results and the actions taken in the course of executing your Review Policies during a CreateHIT operation


name: mechanicalturk:ListReviewableHITs
access_level: List
description:
The ListReviewableHITs operation returns all of a Requester's HITs that have not been approved or rejected


name: mechanicalturk:ListWorkerBlocks
access_level: List
description:
The ListWorkersBlocks operation retrieves a list of Workers who are blocked from working on your HITs


name: mechanicalturk:ListWorkersWithQualificationType
access_level: List
description:
The ListWorkersWithQualificationType operation returns all of the Workers with a given Qualification type


name: mechanicalturk:NotifyWorkers
access_level: Write
description:
The NotifyWorkers operation sends an email to one or more Workers that you specify with the Worker ID


name: mechanicalturk:SendTestEventNotification
access_level: Write
description:
The SendTestEventNotification operation causes Amazon Mechanical Turk to send a notification message as if a HIT event occurred, according to the provided notification specification


name: mechanicalturk:UpdateExpirationForHIT
access_level: Write
description:
The UpdateExpirationForHIT operation allows you extend the expiration time of a HIT beyond is current expiration or expire a HIT immediately


name: mechanicalturk:UpdateNotificationSettings
access_level: Write
description:
The UpdateNotificationSettings operation creates, updates, disables or re-enables notifications for a HIT type


name: mechanicalturk:UpdateQualificationType
access_level: Write
description:
The UpdateQualificationType operation modifies the attributes of an existing Qualification type, which is represented by a QualificationType data structure


name: mediaconnect:DescribeFlow
access_level: Read
description:
Grants permission to display the details of a flow including the flow ARN, name, and Availability Zone, as well as details about the source, outputs, and entitlements


name: mediaconnect:ListOfferings
access_level: List
description:
Grants permission to display a list of all offerings that are available to the account in the current AWS Region


name: mediaconnect:ListReservations
access_level: List
description:
Grants permission to display a list of all reservations that have been purchased by the account in the current AWS Region


name: mediaconvert:AssociateCertificate
access_level: Write
description:
Grants permission to associate an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert.


name: mediaconvert:DescribeEndpoints
access_level: List
description:
Grants permission to subscribe to the AWS Elemental MediaConvert service, by sending a request for an account-specific endpoint. All transcoding requests must be sent to the endpoint that the service returns.


name: mediaconvert:DisassociateCertificate
access_level: Write
description:
Grants permission to remove an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource.


name: medialive:CreateTags
access_level: Tagging
description:
Grants permission to create tags for channels, inputs, input security groups, multiplexes, and reservations


name: medialive:DeleteTags
access_level: Tagging
description:
Grants permission to delete tags from channels, inputs, input security groups, multiplexes, and reservations


name: medialive:ListTagsForResource
access_level: List
description:
Grants permission to list tags for channels, inputs, input security groups, multiplexes, and reservations


name: mediapackage:RotateChannelCredentials
access_level: Write
description:
Grants permission to rotate credentials for the first IngestEndpoint of a Channel in AWS Elemental MediaPackage


name: mediastore:GetLifecyclePolicy
access_level: Read
description:
Grants permission to retrieve the lifecycle policy that is assigned to any container in the current account.


name: mediastore:GetMetricPolicy
access_level: Read
description:
Grants permission to retrieve the metric policy that is assigned to any container in the current account.


name: mediastore:PutLifecyclePolicy
access_level: Write
description:
Grants permission to add or modify the lifecycle policy that is assigned to any container in the current account.


name: mediastore:PutMetricPolicy
access_level: Write
description:
Grants permission to add or modify the metric policy that is assigned to any container in the current account.


name: memorydb:DescribeClusters
access_level: Read
description:
Grants permissions to retrieve information about all provisioned clusters if no cluster identifier is specified, or about a specific cluster if a cluster identifier is supplied


name: memorydb:ResetParameterGroup
access_level: Write
description:
Grants permissions to modify the parameters of a parameter group to the engine or system default value


name: mobiletargeting:CreateSegment
access_level: Write
description:
Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action.


name: mobiletargeting:GetJourneyExecutionActivityMetrics
access_level: Read
description:
Retrieves (queries) pre-aggregated data for a standard execution metric that applies to a journey activity.


name: mobiletargeting:GetRecommenderConfigurations
access_level: List
description:
Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account.


name: mobiletargeting:PhoneNumberValidate
access_level: Read
description:
Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider.


name: mobiletargeting:SendUsersMessages
access_level: Write
description:
Send an SMS message or push notification to all endpoints that are associated with a specific user ID.


name: mobiletargeting:UpdateGcmChannel
access_level: Write
description:
Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app.


name: mq:CreateConfiguration
access_level: Write
description:
Grants permission to create a new configuration for the specified configuration name. Amazon MQ uses the default configuration (the engine type and engine version)


name: nimble:CreateStudioComponent
access_level: Write
description:
Grants permission to create a studio component. A studio component designates a network resource to which a launch profile will provide access


name: nimble:GetLaunchProfileDetails
access_level: Read
description:
Grants permission to get a launch profile's details, which includes the summary of studio components and streaming images used by the launch profile


name: nimble:GetLaunchProfileInitialization
access_level: Read
description:
Grants permission to get a launch profile initialization. A launch profile initialization is a dereferenced version of a launch profile, including attached studio component connection information


name: nimble:PutStudioLogEvents
access_level: Write
description:
Grants permission to report metrics and logs for the Nimble Studio portal to monitor application health


name: opsworks:DescribeStackSummary
access_level: List
description:
Describes the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online


name: opsworks-cm:DeleteServer
access_level: Write
description:
Grants permission to delete the specified server with its corresponding CloudFormation stack and possibly the S3 bucket


name: opsworks-cm:DescribeBackups
access_level: List
description:
Grants permission to describe a single backup, all backups of a specified server or all backups of the user's account


name: opsworks-cm:DescribeNodeAssociationStatus
access_level: List
description:
Grants permission to describe the association status for the specified node token and the specified server


name: opsworks-cm:RestoreServer
access_level: Write
description:
Grants permission to apply a backup to specified server. Possibly swaps out the ec2-instance if specified


name: organizations:AcceptHandshake
access_level: Write
description:
Grants permission to send a response to the originator of a handshake agreeing to the action proposed by the handshake request.


name: organizations:CreateAccount
access_level: Write
description:
Grants permission to create an AWS account that is automatically a member of the organization with the credentials that made the request.


name: organizations:CreateOrganization
access_level: Write
description:
Grants permission to create an organization. The account with the credentials that calls the CreateOrganization operation automatically becomes the management account of the new organization.


name: organizations:CreatePolicy
access_level: Write
description:
Grants permission to create a policy that you can attach to a root, an organizational unit (OU), or an individual AWS account.


name: organizations:DeclineHandshake
access_level: Write
description:
Grants permission to decline a handshake request. This sets the handshake state to DECLINED and effectively deactivates the request.


name: organizations:DeregisterDelegatedAdministrator
access_level: Write
description:
Grants permission to deregister the specified member AWS account as a delegated administrator for the AWS service that is specified by ServicePrincipal.


name: organizations:DescribeOrganization
access_level: Read
description:
Grants permission to retrieves details about the organization that the calling credentials belong to.


name: organizations:DisableAWSServiceAccess
access_level: Write
description:
Grants permission to disable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.


name: organizations:EnableAWSServiceAccess
access_level: Write
description:
Grants permission to enable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.


name: organizations:EnableAllFeatures
access_level: Write
description:
Grants permission to start the process to enable all features in an organization, upgrading it from supporting only Consolidated Billing features.


name: organizations:InviteAccountToOrganization
access_level: Write
description:
Grants permission to send an invitation to another AWS account, asking it to join your organization as a member account.


name: organizations:ListAWSServiceAccessForOrganization
access_level: List
description:
Grants permission to retrieve the list of the AWS services for which you enabled integration with your organization.


name: organizations:ListAccountsForParent
access_level: List
description:
Grants permission to list the accounts in an organization that are contained by a root or organizational unit (OU).


name: organizations:ListCreateAccountStatus
access_level: List
description:
Grants permission to list the asynchronous account creation requests that are currently being tracked for the organization.


name: organizations:ListDelegatedAdministrators
access_level: List
description:
Grants permission to list the AWS accounts that are designated as delegated administrators in this organization.


name: organizations:ListDelegatedServicesForAccount
access_level: List
description:
Grants permission to list the AWS services for which the specified account is a delegated administrator in this organization.


name: organizations:ListOrganizationalUnitsForParent
access_level: List
description:
Grants permission to lists all of the organizational units (OUs) in a parent organizational unit or root.


name: organizations:ListParents
access_level: List
description:
Grants permission to list the root or organizational units (OUs) that serve as the immediate parent of a child OU or account.


name: organizations:ListPoliciesForTarget
access_level: List
description:
Grants permission to list all of the policies that are directly attached to a root, organizational unit (OU), or account.


name: organizations:RegisterDelegatedAdministrator
access_level: Write
description:
Grants permission to register the specified member account to administer the Organizations features of the AWS service that is specified by ServicePrincipal.


name: polly:DescribeVoices
access_level: List
description:
Grants permissions to describe the list of voices that are available for use when requesting speech synthesis


name: polly:GetLexicon
access_level: Read
description:
Grants permissions to retrieve the content of the specified pronunciation lexicon stored in an AWS Region


name: pricing:DescribeServices
access_level: Read
description:
Returns the service details for all (paginated) services (if serviceCode is not set) or service detail for a particular service (if given serviceCode).


name: proton:AcceptEnvironmentAccountConnection
access_level: Write
description:
Grants permission to reject an environment account connection request from another environment account.


name: quicksight:CreateIAMPolicyAssignment
access_level: Write
description:
Grants permission to create an assignment with one specified IAM Policy ARN that will be assigned to specified groups or users of QuickSight


name: quicksight:GenerateEmbedUrlForAnonymousUser
access_level: Write
description:
Grants permission to generate a URL used to embed a QuickSight Dashboard for a user not registered with QuickSight


name: quicksight:GenerateEmbedUrlForRegisteredUser
access_level: Write
description:
Grants permission to generate a URL used to embed a QuickSight Dashboard for a user registered with QuickSight


name: quicksight:GetAnonymousUserEmbedUrl
access_level: Read
description:
Grants permission to get a URL used to embed a QuickSight Dashboard for a user not registered with QuickSight


name: quicksight:GetGroupMapping
access_level: Read
description:
Grants permission to use Amazon QuickSight, in Enterprise edition, to identify and display the Microsoft Active Directory (Microsoft Active Directory) directory groups that are mapped to roles in Amazon QuickSight


name: quicksight:RegisterUser
access_level: Write
description:
Grants permission to create a QuickSight user, whose identity is associated with the IAM identity/role specified in the request


name: quicksight:SearchDirectoryGroups
access_level: List
description:
Grants permission to use Amazon QuickSight, in Enterprise edition, to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight


name: quicksight:Subscribe
access_level: Write
description:
Grants permission to subscribe to Amazon QuickSight, and also to allow the user to upgrade the subscription to Enterprise edition


name: quicksight:Unsubscribe
access_level: Write
description:
Grants permission to unsubscribe from Amazon QuickSight, which permanently deletes all users and their resources from Amazon QuickSight


name: ram:GetResourceShareAssociations
access_level: Read
description:
Grants permission to get a set of resource share associations from a provided list or with a specified status of the specified type


name: ram:GetResourceShareInvitations
access_level: Read
description:
Grants permission to get resource share invitations by the specified invitation arn or those for the resource share


name: ram:ListPendingInvitationResources
access_level: Read
description:
Grants permission to list the resources in a resource share that is shared with you but that the invitation is still pending for


name: ram:ListPrincipals
access_level: List
description:
Grants permission to list the principals that you have shared resources with or that have shared resources with you


name: ram:ListResources
access_level: List
description:
Grants permission to list the resources that you added to resource shares or the resources that are shared with you


name: rds:AddRoleToDBCluster
access_level: Write
description:
Grants permission to associate an Identity and Access Management (IAM) role from an Aurora DB cluster


name: rds:CreateDBClusterEndpoint
access_level: Write
description:
Grants permission to create a new custom endpoint and associates it with an Amazon Aurora DB cluster


name: rds:CreateDBSecurityGroup
access_level: Write
description:
Grants permission to create a new DB security group. DB security groups control access to a DB instance


name: rds:CrossRegionCommunication
access_level: Write
description:
Grants permission to access a resource in the remote Region when executing cross-Region operations, such as cross-Region snapshot copy or cross-Region read replica creation


name: rds:DeleteDBInstanceAutomatedBackup
access_level: Write
description:
Grants permission to deletes automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID


name: rds:DescribeDBClusterSnapshotAttributes
access_level: List
description:
Grants permission to return a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot


name: rds:DescribeDBSnapshotAttributes
access_level: List
description:
Grants permission to return a list of DB snapshot attribute names and values for a manual DB snapshot


name: rds:DescribeEngineDefaultClusterParameters
access_level: List
description:
Grants permission to return the default engine and system parameter information for the cluster database engine


name: rds:DescribeEngineDefaultParameters
access_level: List
description:
Grants permission to return the default engine and system parameter information for the specified database engine


name: rds:DescribeEventCategories
access_level: List
description:
Grants permission to display a list of categories for all event source types, or, if specified, for a specified source type


name: rds:DescribeEvents
access_level: List
description:
Grants permission to return events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days


name: rds:DescribePendingMaintenanceActions
access_level: List
description:
Grants permission to return a list of resources (for example, DB instances) that have at least one pending maintenance action


name: rds:DescribeReservedDBInstances
access_level: List
description:
Grants permission to return information about reserved DB instances for this account, or about a specified reserved DB instance


name: rds:DescribeSourceRegions
access_level: List
description:
Grants permission to return a list of the source AWS Regions where the current AWS Region can create a Read Replica or copy a DB snapshot from


name: rds:ModifyCertificates
access_level: Write
description:
Grants permission to modify the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances


name: rds:ModifyDBClusterSnapshotAttribute
access_level: Write
description:
Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot


name: rds:ModifyDBSnapshot
access_level: Write
description:
Grants permission to update a manual DB snapshot, which can be encrypted or not encrypted, with a new engine version


name: rds:ModifyDBSnapshotAttribute
access_level: Write
description:
Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot


name: rds:RemoveRoleFromDBCluster
access_level: Write
description:
Grants permission to disassociate an AWS Identity and Access Management (IAM) role from an Amazon Aurora DB cluster


name: rds:RemoveRoleFromDBInstance
access_level: Write
description:
Grants permission to disassociate an AWS Identity and Access Management (IAM) role from a DB instance


name: rds:RemoveSourceIdentifierFromSubscription
access_level: Write
description:
Grants permission to remove a source identifier from an existing RDS event notification subscription


name: rds:ResetDBParameterGroup
access_level: Write
description:
Grants permission to modify the parameters of a DB parameter group to the engine/system default value


name: rds:RevokeDBSecurityGroupIngress
access_level: Write
description:
Grants permission to revoke ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups


name: rds-data:CommitTransaction
access_level: Write
description:
Grants permission to end a SQL transaction started with the BeginTransaction operation and commits the changes


name: rds-data:ExecuteSql
access_level: Write
description:
Grants permission to run one or more SQL statements. This operation is deprecated. Use the BatchExecuteStatement or ExecuteStatement operation


name: rds-data:RollbackTransaction
access_level: Write
description:
Grants permission to perform a rollback of a transaction. Rolling back a transaction cancels its changes


name: redshift:AcceptReservedNodeExchange
access_level: Write
description:
Grants permission to exchange a DC1 reserved node for a DC2 reserved node with no changes to the configuration


name: redshift:CreateHsmConfiguration
access_level: Write
description:
Grants permission to create an HSM configuration that contains information required by a cluster to store and use database encryption keys in a hardware security module (HSM)


name: redshift:CreateSnapshotCopyGrant
access_level: Permissions management
description:
Grants permission to create a snapshot copy grant and encrypt copied snapshots in a destination AWS Region


name: redshift:DescribeClusterParameterGroups
access_level: Read
description:
Grants permission to describe Amazon Redshift parameter groups, including parameter groups you created and the default parameter group


name: redshift:DescribeClusterSnapshots
access_level: Read
description:
Grants permission to describe one or more snapshot objects, which contain metadata about your cluster snapshots


name: redshift:DescribeClusterSubnetGroups
access_level: Read
description:
Grants permission to describe one or more cluster subnet group objects, which contain metadata about your cluster subnet groups


name: redshift:DescribeEventCategories
access_level: Read
description:
Grants permission to describe event categories for all event source types, or for a specified source type


name: redshift:DescribeEventSubscriptions
access_level: Read
description:
Grants permission to describe Amazon Redshift event notification subscriptions for the specified AWS account


name: redshift:DescribeEvents
access_level: List
description:
Grants permission to describe events related to clusters, security groups, snapshots, and parameter groups for the past 14 days


name: redshift:DescribeLoggingStatus
access_level: Read
description:
Grants permission to describe whether information, such as queries and connection attempts, is being logged for a cluster


name: redshift:DescribeNodeConfigurationOptions
access_level: List
description:
Grants permission to describe properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type


name: redshift:DescribeSnapshotCopyGrants
access_level: Read
description:
Grants permission to describe snapshot copy grants owned by the specified AWS account in the destination AWS Region


name: redshift:DescribeTableRestoreStatus
access_level: Read
description:
Grants permission to describe status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action


name: redshift:DisableLogging
access_level: Write
description:
Grants permission to disable logging information, such as queries and connection attempts, for a cluster


name: redshift:EnableLogging
access_level: Write
description:
Grants permission to enable logging information, such as queries and connection attempts, for a cluster


name: redshift:GetClusterCredentials
access_level: Write
description:
Grants permission to get temporary credentials to access an Amazon Redshift database by the specified AWS account


name: redshift:GetReservedNodeExchangeOfferings
access_level: Read
description:
Grants permission to get an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node


name: redshift:ModifyClusterIamRoles
access_level: Permissions management
description:
Grants permission to modify the list of AWS Identity and Access Management (IAM) roles that can be used by a cluster to access other AWS services


name: redshift:ModifySnapshotCopyRetentionPeriod
access_level: Write
description:
Grants permission to modify the number of days to retain snapshots in the destination AWS Region after they are copied from the source AWS Region


name: redshift:ResetClusterParameterGroup
access_level: Write
description:
Grants permission to set one or more parameters of a parameter group to their default values and set the source values of the parameters to "engine-default"


name: redshift:RevokeClusterSecurityGroupIngress
access_level: Permissions management
description:
Grants permission to revoke an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group


name: rekognition:CreateCollection
access_level: Write
description:
Creates a collection in an AWS region. You can then add faces to the collection using the IndexFaces API.


name: rekognition:CreateStreamProcessor
access_level: Write
description:
Creates an Amazon Rekognition stream processor that you can use to detect and recognize faces in a streaming video.


name: rekognition:DetectCustomLabels
access_level: Read
description:
Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model version.


name: rekognition:GetCelebrityRecognition
access_level: Read
description:
Gets the celebrity recognition results for a Rekognition Video analysis started by StartCelebrityRecognition.


name: rekognition:GetContentModeration
access_level: Read
description:
Gets the content moderation analysis results for a Rekognition Video analysis started by StartContentModeration.


name: rekognition:SearchFacesByImage
access_level: Read
description:
For a given input image, first detects the largest face in the image, and then searches the specified collection for matching faces.


name: rekognition:StartFaceSearch
access_level: Write
description:
Starts the asynchronous search for faces in a collection that match the faces of persons detected in a video.


name: robomaker:CreateFleet
access_level: Write
description:
Create a deployment fleet that represents a logical group of robots running the same robot application


name: route53:ChangeResourceRecordSets
access_level: Write
description:
Grants permission to create, update, or delete a record, which contains authoritative DNS information for a specified domain or subdomain name


name: route53:CreateHealthCheck
access_level: Write
description:
Grants permission to create a new health check, which monitors the health and performance of your web applications, web servers, and other resources


name: route53:CreateHostedZone
access_level: Write
description:
Grants permission to create a public hosted zone, which you use to specify how the Domain Name System (DNS) routes traffic on the Internet for a domain, such as example.com, and its subdomains


name: route53:CreateReusableDelegationSet
access_level: Write
description:
Grants permission to create a delegation set (a group of four name servers) that can be reused by multiple hosted zones


name: route53:CreateTrafficPolicy
access_level: Write
description:
Grants permission to create a traffic policy, which you use to create multiple DNS records for one domain name (such as example.com) or one subdomain name (such as www.example.com)


name: route53:CreateTrafficPolicyInstance
access_level: Write
description:
Grants permission to create records in a specified hosted zone based on the settings in a specified traffic policy version


name: route53:CreateVPCAssociationAuthorization
access_level: Write
description:
Grants permission to authorize the AWS account that created a specified VPC to submit an AssociateVPCWithHostedZone request, which associates the VPC with a specified hosted zone that was created by a different account


name: route53:DeleteTrafficPolicyInstance
access_level: Write
description:
Grants permission to delete a traffic policy instance and all the records that Route 53 created when you created the instance


name: route53:DeleteVPCAssociationAuthorization
access_level: Write
description:
Grants permission to remove authorization for associating an Amazon Virtual Private Cloud with a Route 53 private hosted zone


name: route53:DisassociateVPCFromHostedZone
access_level: Write
description:
Grants permission to disassociate an Amazon Virtual Private Cloud from a Route 53 private hosted zone


name: route53:GetAccountLimit
access_level: Read
description:
Grants permission to get the specified limit for the current account, for example, the maximum number of health checks that you can create using the account


name: route53:GetChange
access_level: List
description:
Grants permission to get the current status of a request to create, update, or delete one or more records


name: route53:GetCheckerIpRanges
access_level: List
description:
Grants permission to get a list of the IP ranges that are used by Route 53 health checkers to check the health of your resources


name: route53:GetDNSSEC
access_level: Read
description:
Grants permission to get information about DNSSEC for a specific hosted zone, including the key-signing keys in the hosted zone


name: route53:GetGeoLocation
access_level: List
description:
Grants permission to get information about whether a specified geographic location is supported for Route 53 geolocation records


name: route53:GetHealthCheckCount
access_level: List
description:
Grants permission to get the number of health checks that are associated with the current AWS account


name: route53:GetHostedZone
access_level: List
description:
Grants permission to get information about a specified hosted zone including the four name servers that Route 53 assigned to the hosted zone


name: route53:GetHostedZoneCount
access_level: List
description:
Grants permission to get the number of hosted zones that are associated with the current AWS account


name: route53:GetReusableDelegationSet
access_level: List
description:
Grants permission to get information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set


name: route53:GetReusableDelegationSetLimit
access_level: Read
description:
Grants permission to get the maximum number of hosted zones that you can associate with the specified reusable delegation set


name: route53:GetTrafficPolicyInstanceCount
access_level: Read
description:
Grants permission to get the number of traffic policy instances that are associated with the current AWS account


name: route53:ListHealthChecks
access_level: List
description:
Grants permission to get a list of the health checks that are associated with the current AWS account


name: route53:ListHostedZones
access_level: List
description:
Grants permission to get a list of the public and private hosted zones that are associated with the current AWS account


name: route53:ListHostedZonesByName
access_level: List
description:
Grants permission to get a list of your hosted zones in lexicographic order. Hosted zones are sorted by name with the labels reversed, for example, com.example.www.


name: route53:ListHostedZonesByVPC
access_level: List
description:
Grants permission to get a list of all the private hosted zones that a specified VPC is associated with


name: route53:ListQueryLoggingConfigs
access_level: List
description:
Grants permission to list the configurations for DNS query logging that are associated with the current AWS account or the configuration that is associated with a specified hosted zone.


name: route53:ListReusableDelegationSets
access_level: List
description:
Grants permission to list the reusable delegation sets that are associated with the current AWS account.


name: route53:ListTrafficPolicies
access_level: List
description:
Grants permission to get information about the latest version for every traffic policy that is associated with the current AWS account. Policies are listed in the order in which they were created.


name: route53:ListTrafficPolicyInstances
access_level: List
description:
Grants permission to get information about the traffic policy instances that you created by using the current AWS account


name: route53:ListTrafficPolicyInstancesByHostedZone
access_level: List
description:
Grants permission to get information about the traffic policy instances that you created in a specified hosted zone


name: route53:ListTrafficPolicyInstancesByPolicy
access_level: List
description:
Grants permission to get information about the traffic policy instances that you created using a specified traffic policy version


name: route53:ListVPCAssociationAuthorizations
access_level: List
description:
Grants permission to get a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone


name: route53:TestDNSAnswer
access_level: Read
description:
Grants permission to get the value that Route 53 returns in response to a DNS query for a specified record name and type


name: route53:UpdateTrafficPolicyInstance
access_level: Write
description:
Grants permission to update the records in a specified hosted zone that were created based on the settings in a specified traffic policy version


name: route53domains:AcceptDomainTransferFromAnotherAwsAccount
access_level: Write
description:
Grants permission to accept the transfer of a domain from another AWS account to the current AWS account


name: route53domains:CancelDomainTransferToAnotherAwsAccount
access_level: Write
description:
Grants permission to cancel the transfer of a domain from the current AWS account to another AWS account


name: route53domains:DisableDomainAutoRenew
access_level: Write
description:
Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires


name: route53domains:DisableDomainTransferLock
access_level: Write
description:
Grants permission to remove the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers


name: route53domains:EnableDomainTransferLock
access_level: Write
description:
Grants permission to set the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers


name: route53domains:GetContactReachabilityStatus
access_level: Read
description:
For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to get information about whether the registrant contact has responded


name: route53domains:GetDomainSuggestions
access_level: Read
description:
Grants permission to get a list of suggested domain names given a string, which can either be a domain name or simply a word or phrase (without spaces)


name: route53domains:ListDomains
access_level: List
description:
Grants permission to list all the domain names registered with Amazon Route 53 for the current AWS account


name: route53domains:RejectDomainTransferFromAnotherAwsAccount
access_level: Write
description:
Grants permission to reject the transfer of a domain from another AWS account to the current AWS account


name: route53domains:ResendContactReachabilityEmail
access_level: Write
description:
For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, grants permission to resend the confirmation email to the current email address for the registrant contact


name: route53domains:UpdateDomainNameservers
access_level: Write
description:
Grants permission to replace the current set of name servers for a domain with the specified set of name servers


name: route53domains:ViewBilling
access_level: Read
description:
Grants permission to get all the domain-related billing records for the current AWS account for a specified period


name: route53resolver:AssociateResolverEndpointIpAddress
access_level: Write
description:
Grants permission to associate a specified IP address with a Resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)


name: route53resolver:CreateResolverEndpoint
access_level: Write
description:
Grants permission to create a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound


name: route53resolver:CreateResolverQueryLogConfig
access_level: Write
description:
Grants permission to create a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs


name: route53resolver:CreateResolverRule
access_level: Write
description:
For DNS queries that originate in your VPC, grants permission to define how to route the queries out of the VPC


name: route53resolver:DeleteResolverEndpoint
access_level: Write
description:
Grants permission to delete a Resolver endpoint. The effect of deleting a Resolver endpoint depends on whether it's an inbound or an outbound endpoint


name: route53resolver:DisassociateFirewallRuleGroup
access_level: Write
description:
Grants permission to remove the association between a specified Firewall rule group and a specified VPC


name: route53resolver:DisassociateResolverEndpointIpAddress
access_level: Write
description:
Grants permission to remove a specified IP address from a Resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)


name: route53resolver:DisassociateResolverQueryLogConfig
access_level: Write
description:
Grants permission to remove the association between a specified Resolver query logging configuration and a specified VPC


name: route53resolver:GetFirewallRuleGroupAssociation
access_level: Read
description:
Grants permission to get information about an association between a specified Firewall rule group and a VPC


name: route53resolver:GetFirewallRuleGroupPolicy
access_level: Read
description:
Grants permission to get information about a specified Firewall rule group policy, which specifies the Firewall rule group operations and resources that you want to allow another AWS account to use


name: route53resolver:GetResolverDnssecConfig
access_level: Read
description:
Grants permission to get the DNSSEC validation support status for DNS queries within the specified resource


name: route53resolver:GetResolverEndpoint
access_level: Read
description:
Grants permission to get information about a specified Resolver endpoint, such as whether it's an inbound or an outbound endpoint, and the IP addresses in your VPC that DNS queries are forwarded to on the way into or out of your VPC


name: route53resolver:GetResolverQueryLogConfig
access_level: Read
description:
Grants permission to get information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to


name: route53resolver:GetResolverQueryLogConfigAssociation
access_level: Read
description:
Grants permission to get information about a specified association between a Resolver query logging configuration and an Amazon VPC. When you associate a VPC with a query logging configuration, Resolver logs DNS queries that originate in that VPC


name: route53resolver:GetResolverQueryLogConfigPolicy
access_level: Read
description:
Grants permission to get information about a specified Resolver query logging policy, which specifies the Resolver query logging operations and resources that you want to allow another AWS account to use


name: route53resolver:GetResolverRule
access_level: Read
description:
Grants permission to get information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the IP address that queries are forwarded to


name: route53resolver:GetResolverRuleAssociation
access_level: Read
description:
Grants permission to get information about an association between a specified Resolver rule and a VPC


name: route53resolver:GetResolverRulePolicy
access_level: Read
description:
Grants permission to get information about a Resolver rule policy, which specifies the Resolver operations and resources that you want to allow another AWS account to use


name: route53resolver:ListFirewallRuleGroupAssociations
access_level: List
description:
Grants permission to list information about associations between Amazon VPCs and Firewall rule group


name: route53resolver:ListResolverEndpointIpAddresses
access_level: List
description:
For a specified Resolver endpoint, grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)


name: route53resolver:ListResolverEndpoints
access_level: List
description:
Grants permission to list all the Resolver endpoints that were created using the current AWS account


name: route53resolver:ListResolverQueryLogConfigAssociations
access_level: List
description:
Grants permission to list information about associations between Amazon VPCs and query logging configurations


name: route53resolver:ListResolverQueryLogConfigs
access_level: List
description:
Grants permission to list information about the specified query logging configurations, which define where you want Resolver to save DNS query logs and specify the VPCs that you want to log queries for


name: route53resolver:ListResolverRuleAssociations
access_level: List
description:
Grants permission to list the associations that were created between Resolver rules and VPCs using the current AWS account


name: route53resolver:PutFirewallRuleGroupPolicy
access_level: Write
description:
Grants permission to specify an AWS account that you want to share a Firewall rule group with, the Firewall rule group that you want to share, and the operations that you want the account to be able to perform on the configuration


name: route53resolver:PutResolverQueryLogConfigPolicy
access_level: Write
description:
Grants permission to specify an AWS account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configuration


name: route53resolver:PutResolverRulePolicy
access_level: Write
description:
Grants permission to specify an AWS account that you want to share rules with, the Resolver rules that you want to share, and the operations that you want the account to be able to perform on those rules


name: route53resolver:UpdateResolverDnssecConfig
access_level: Write
description:
Grants permission to update the DNSSEC validation support status for DNS queries within the specified resource


name: s3:DeleteObject
access_level: Write
description:
Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object


name: s3:DeleteObjectTagging
access_level: Tagging
description:
Grants permission to use the tagging subresource to remove the entire tag set from the specified object


name: s3:GetAccelerateConfiguration
access_level: Read
description:
Grants permission to uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended


name: s3:GetAccessPointPolicyForObjectLambda
access_level: Read
description:
Grants permission to returns the access point policy associated with the specified object lambda enabled access point


name: s3:GetAnalyticsConfiguration
access_level: Read
description:
Grants permission to get an analytics configuration from an Amazon S3 bucket, identified by the analytics configuration ID


name: s3:GetBucketAcl
access_level: Read
description:
Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket


name: s3:GetBucketLogging
access_level: Read
description:
Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status


name: s3:GetBucketPolicyStatus
access_level: Read
description:
Grants permission to retrieve the policy status for a specific Amazon S3 bucket, which indicates whether the bucket is public


name: s3:GetInventoryConfiguration
access_level: Read
description:
Grants permission to return an inventory configuration from an Amazon S3 bucket, identified by the inventory configuration ID


name: s3:GetObjectVersionForReplication
access_level: Read
description:
Grants permission to replicate both unencrypted objects and objects encrypted with SSE-S3 or SSE-KMS


name: s3:PutAccelerateConfiguration
access_level: Write
description:
Grants permission to use the accelerate subresource to set the Transfer Acceleration state of an existing S3 bucket


name: s3:PutAnalyticsConfiguration
access_level: Write
description:
Grants permission to set an analytics configuration for the bucket, specified by the analytics configuration ID


name: s3:PutBucketPublicAccessBlock
access_level: Permissions management
description:
Grants permission to create or modify the PublicAccessBlock configuration for a specific Amazon S3 bucket


name: s3:PutBucketWebsite
access_level: Write
description:
Grants permission to set the configuration of the website that is specified in the website subresource


name: s3:PutIntelligentTieringConfiguration
access_level: Write
description:
Grants permission to create new or update or delete an existing Amazon S3 Intelligent Tiering configuration


name: s3:PutLifecycleConfiguration
access_level: Write
description:
Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration


name: s3:PutMetricsConfiguration
access_level: Write
description:
Grants permission to set or update a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket


name: s3:PutObjectAcl
access_level: Permissions management
description:
Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket.


name: s3:PutObjectVersionAcl
access_level: Permissions management
description:
Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket


name: s3-outposts:PutObjectAcl
access_level: Permissions management
description:
Grants permission to set the access control list (ACL) permissions for an object that already exists in a bucket


name: sagemaker:AddAssociation
access_level: Write
description:
Grants permission to associate a lineage entity (artifact, context, action, experiment, experiment-trial-component) to each other


name: sagemaker:BatchGetMetrics
access_level: Read
description:
Grants permission to retrieve metrics associated with SageMaker Resources such as Training Jobs. This API is not publicly exposed at this point, however admins can control this action


name: sagemaker:BatchPutMetrics
access_level: Write
description:
Grants permission to publish metrics associated with a SageMaker Resource such as a Training Job. This API is not publicly exposed at this point, however admins can control this action


name: sagemaker:CreateEndpointConfig
access_level: Write
description:
Grants permission to create an endpoint configuration that can be deployed using Amazon SageMaker hosting services


name: sagemaker:CreateHyperParameterTuningJob
access_level: Write
description:
Grants permission to create a hyper parameter tuning job that can be deployed using Amazon SageMaker


name: sagemaker:CreateLabelingJob
access_level: Write
description:
Grants permission to start a labeling job. A labeling job takes unlabeled data in and produces labeled data as output, which can be used for training SageMaker models


name: sagemaker:CreateModel
access_level: Write
description:
Grants permission to create a model in Amazon SageMaker. In the request, you specify a name for the model and describe one or more containers


name: sagemaker:CreateNotebookInstance
access_level: Write
description:
Grants permission to create an Amazon SageMaker notebook instance. A notebook instance is an Amazon EC2 instance running on a Jupyter Notebook


name: sagemaker:CreateNotebookInstanceLifecycleConfig
access_level: Write
description:
Grants permission to create a notebook instance lifecycle configuration that can be deployed using Amazon SageMaker


name: sagemaker:CreatePresignedDomainUrl
access_level: Write
description:
Grants permission to return a URL that you can use from your browser to connect to the Domain as a specified UserProfile when AuthMode is 'IAM'


name: sagemaker:CreatePresignedNotebookInstanceUrl
access_level: Write
description:
Grants permission to create a URL that you can use from your browser to connect to the Notebook Instance


name: sagemaker:CreateProcessingJob
access_level: Write
description:
Grants permission to start a processing job. After processing completes, Amazon SageMaker saves the resulting artifacts and other optional output to an Amazon S3 location that you specify


name: sagemaker:CreateTrainingJob
access_level: Write
description:
Grants permission to start a model training job. After training completes, Amazon SageMaker saves the resulting model artifacts and other optional output to an Amazon S3 location that you specify


name: sagemaker:CreateTransformJob
access_level: Write
description:
Grants permission to start a transform job. After the results are obtained, Amazon SageMaker saves them to an Amazon S3 location that you specify


name: sagemaker:DeleteAssociation
access_level: Write
description:
Grants permission to delete the association from a lineage entity (artifact, context, action, experiment, experiment-trial-component) to another


name: sagemaker:DeleteDataQualityJobDefinition
access_level: Write
description:
Grants permission to delete the data quality job definition created using the CreateDataQualityJobDefinition API


name: sagemaker:DeleteEndpoint
access_level: Write
description:
Grants permission to delete an endpoint. Amazon SageMaker frees up all the resources that were deployed when the endpoint was created


name: sagemaker:DeleteEndpointConfig
access_level: Write
description:
Grants permission to delete the endpoint configuration created using the CreateEndpointConfig API. The DeleteEndpointConfig API deletes only the specified configuration. It does not delete any endpoints created using the configuration


name: sagemaker:DeleteModel
access_level: Write
description:
Grants permission to delete a model created using the CreateModel API. The DeleteModel API deletes only the model entry in Amazon SageMaker that you created by calling the CreateModel API. It does not delete model artifacts, inference code, or the IAM role that you specified when creating the model


name: sagemaker:DeleteModelBiasJobDefinition
access_level: Write
description:
Grants permission to delete the model bias job definition created using the CreateModelBiasJobDefinition API


name: sagemaker:DeleteModelExplainabilityJobDefinition
access_level: Write
description:
Grants permission to delete the model explainability job definition created using the CreateModelExplainabilityJobDefinition API


name: sagemaker:DeleteModelQualityJobDefinition
access_level: Write
description:
Grants permission to delete the model quality job definition created using the CreateModelQualityJobDefinition API


name: sagemaker:DeleteNotebookInstance
access_level: Write
description:
Grants permission to delete a Amazon SageMaker notebook instance. Before you can delete a notebook instance, you must call the StopNotebookInstance API


name: sagemaker:DescribeEndpointConfig
access_level: Read
description:
Grants permission to return the description of an endpoint configuration, which was created using the CreateEndpointConfig API


name: sagemaker:DescribeHyperParameterTuningJob
access_level: Read
description:
Grants permission to describe a hyper parameter tuning job that was created via the CreateHyperParameterTuningJob API


name: sagemaker:DescribeNotebookInstanceLifecycleConfig
access_level: Read
description:
Grants permission to describe a notebook instance lifecycle configuration that was created via the CreateNotebookInstanceLifecycleConfig API


name: sagemaker:GetDeviceRegistration
access_level: Read
description:
Grants permission to get device registration. After you deploy a model onto edge devices this api is used to get current device registration


name: sagemaker:InvokeEndpoint
access_level: Read
description:
Grants permission to invoke an endpoint. After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint


name: sagemaker:ListFlowDefinitions
access_level: List
description:
Grants permission to return summary information about flow definitions, given the specified parameters


name: sagemaker:ListHumanTaskUis
access_level: List
description:
Grants permission to return summary information about human review workflow user interfaces, given the specified parameters


name: sagemaker:ListNotebookInstanceLifecycleConfigs
access_level: List
description:
Grants permission to list the notebook instance lifecycle configurations that can be deployed using Amazon SageMaker


name: sagemaker:ListNotebookInstances
access_level: List
description:
Grants permission to list the Amazon SageMaker notebook instances in the requester's account in an AWS Region


name: sagemaker:SendHeartbeat
access_level: Write
description:
Grants permission to publish heartbeat data from devices. After you deploy a model onto edge devices this api is used to report device status


name: sagemaker:StartNotebookInstance
access_level: Write
description:
Grants permission to start a notebook instance. This launches an EC2 instance with the latest version of the libraries and attaches your EBS volume


name: sagemaker:StopHyperParameterTuningJob
access_level: Write
description:
Grants permission to stop a running hyper parameter tuning job create via the CreateHyperParameterTuningJob


name: sagemaker:StopLabelingJob
access_level: Write
description:
Grants permission to stop a labeling job. Any labels already generated will be exported before stopping


name: sagemaker:StopNotebookInstance
access_level: Write
description:
Grants permission to stop a notebook instance. This terminates the EC2 instance. Before terminating the instance, Amazon SageMaker disconnects the EBS volume from it. Amazon SageMaker preserves the EBS volume


name: sagemaker:StopProcessingJob
access_level: Write
description:
Grants permission to stop a processing job. To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds


name: sagemaker:StopTrainingJob
access_level: Write
description:
Grants permission to stop a training job. To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds


name: sagemaker:StopTransformJob
access_level: Write
description:
Grants permission to stop a transform job. When Amazon SageMaker receives a StopTransformJob request, the status of the job changes to Stopping. After Amazon SageMaker stops the job, the status is set to Stopped


name: sagemaker:UpdateEndpointWeightsAndCapacities
access_level: Write
description:
Grants permission to update variant weight, capacity, or both of one or more variants associated with an endpoint


name: sagemaker:UpdateNotebookInstance
access_level: Write
description:
Grants permission to update a notebook instance. Notebook instance updates include upgrading or downgrading the EC2 instance used for your notebook instance to accommodate changes in your workload requirements. You can also update the VPC security groups


name: sagemaker:UpdateNotebookInstanceLifecycleConfig
access_level: Write
description:
Grants permission to updates a notebook instance lifecycle configuration created with the CreateNotebookInstanceLifecycleConfig API


name: schemas:CreateDiscoverer
access_level: Write
description:
Creates an event schema discoverer. Once created, your events will be automatically map into corresponding schema documents


name: schemas:StartDiscoverer
access_level: Write
description:
Starts the specified discoverer. Once started the discoverer will automatically register schemas for published events to configured source in your account


name: sdb:BatchDeleteAttributes
access_level: Write
description:
Performs multiple DeleteAttributes operations in a single call, which reduces round trips and latencies.


name: sdb:BatchPutAttributes
access_level: Write
description:
With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call. With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call.


name: sdb:DomainMetadata
access_level: Read
description:
Returns information about the domain, including when the domain was created, the number of items and attributes, and the size of attribute names and values.


name: secretsmanager:ReplicateSecretToRegions
access_level: Write
description:
Converts an existing secret to a multi-Region secret and begins replicating the secret to a list of new regions.


name: secretsmanager:StopReplicationToReplica
access_level: Write
description:
Removes the secret from replication and promotes the secret to a regional secret in the replica Region.


name: securityhub:DisassociateFromAdministratorAccount
access_level: Write
description:
Grants permission to a Security Hub member account to disassociate from the associated administrator account


name: securityhub:DisassociateFromMasterAccount
access_level: Write
description:
Grants permission to a Security Hub member account to disassociate from the associated master account


name: securityhub:DisassociateMembers
access_level: Write
description:
Grants permission to disassociate Security Hub member accounts from the associated administrator account


name: securityhub:GetAdhocInsightResults
access_level: Read
description:
Grants permission to retrieve insight results by providing a set of filters instead of an insight ARN


name: securityhub:GetControlFindingSummary
access_level: Read
description:
Grants permission to retrieve a security score and counts of finding and control statuses for a security standard


name: securityhub:GetInsightFindingTrend
access_level: Read
description:
Grants permission to retrieve an insight finding trend from Security Hub in order to generate a graph


name: securityhub:ListControlEvaluationSummaries
access_level: Read
description:
Grants permission to retrieve a list of controls for a standard, including the control IDs, statuses and finding counts


name: securityhub:ListMembers
access_level: List
description:
Grants permission to retrieve details about Security Hub member accounts associated with the administrator account


name: serverlessrepo:CreateApplication
access_level: Write
description:
Creates an application, optionally including an AWS SAM file to create the first application version in the same call.


name: servicecatalog:AssociatePrincipalWithPortfolio
access_level: Write
description:
Grants permission to associate an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio


name: servicecatalog:BatchDisassociateServiceActionFromProvisioningArtifact
access_level: Write
description:
Grants permission to disassociate a batch of self-service actions from the specified provisioning artifact


name: servicecatalog:CopyProduct
access_level: Write
description:
Grants permission to copy the specified source product to the specified target product or a new product


name: servicecatalog:DeleteApplication
access_level: Write
description:
Grants permission to delete an application if all associations have been removed from the application


name: servicecatalog:DeleteAttributeGroup
access_level: Write
description:
Grants permission to delete an attribute group if all associations have been removed from the attribute group


name: servicecatalog:DeleteConstraint
access_level: Write
description:
Grants permission to remove and delete an existing constraint from an associated product and portfolio


name: servicecatalog:DeletePortfolio
access_level: Write
description:
Grants permission to delete a portfolio if all associations and shares have been removed from the portfolio


name: servicecatalog:DeletePortfolioShare
access_level: Permissions management
description:
Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with


name: servicecatalog:DescribePortfolioShares
access_level: List
description:
Grants permission to view a summary of each of the portfolio shares that were created for the specified portfolio


name: servicecatalog:DescribeProvisioningParameters
access_level: Read
description:
Grants permission to describe the parameters that you need to specify to successfully provision a specified provisioning artifact


name: servicecatalog:DescribeServiceActionExecutionParameters
access_level: Read
description:
Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product


name: servicecatalog:DisassociateServiceActionFromProvisioningArtifact
access_level: Write
description:
Grants permission to disassociate the specified self-service action association from the specified provisioning artifact


name: servicecatalog:ListRecordHistory
access_level: List
description:
Grants permission to list all the records in your account or all the records related to a given provisioned product


name: servicecatalog:ListServiceActionsForProvisioningArtifact
access_level: List
description:
Grants permission to list all the service actions associated with the specified provisioning artifact in your account


name: servicecatalog:ListStackInstancesForProvisionedProduct
access_level: List
description:
Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product


name: servicecatalog:ProvisionProduct
access_level: Write
description:
Grants permission to provision a product with a specified provisioning artifact and launch parameters


name: servicecatalog:SearchProductsAsAdmin
access_level: List
description:
Grants permission to list all the products in your account or all the products associated with a given portfolio


name: servicediscovery:CreatePrivateDnsNamespace
access_level: Write
description:
Grants permission to create a private namespace based on DNS, which will be visible only inside a specified Amazon VPC


name: servicediscovery:DeregisterInstance
access_level: Write
description:
Grants permission to delete the records and the health check, if any, that Amazon Route 53 created for the specified instance


name: servicediscovery:GetInstancesHealthStatus
access_level: Read
description:
Grants permission to get the current health status (Healthy, Unhealthy, or Unknown) of one or more instances


name: servicediscovery:ListInstances
access_level: List
description:
Grants permission to get summary information about the instances that were registered with a specified service


name: servicediscovery:UpdateInstanceCustomHealthStatus
access_level: Write
description:
Grants permission to update the current health status for an instance that has a custom health check


name: servicequotas:GetAWSDefaultServiceQuota
access_level: Read
description:
Grants permission to return the details for the specified service quota, including the AWS default value


name: servicequotas:GetAssociationForServiceQuotaTemplate
access_level: Read
description:
Grants permission to retrieve the ServiceQuotaTemplateAssociationStatus value, which tells you if the Service Quotas template is associated with an organization


name: servicequotas:GetServiceQuota
access_level: Read
description:
Grants permission to return the details for the specified service quota, including the applied value


name: servicequotas:GetServiceQuotaIncreaseRequestFromTemplate
access_level: Read
description:
Grants permission to retrieve the details for a service quota increase request from the service quota template


name: servicequotas:ListServiceQuotaIncreaseRequestsInTemplate
access_level: Read
description:
Grants permission to return a list of the service quota increase requests from the service quota template


name: servicequotas:ListServiceQuotas
access_level: Read
description:
Grants permission to list all service quotas for the specified AWS service, in that account, in that Region


name: servicequotas:UntagResource
access_level: Tagging
description:
Grants permission to remove a set of tags from a SQ resource, where tags to be removed match a set of customer-supplied tag keys


name: ses:DeleteEmailIdentityPolicy
access_level: Permissions management
description:
Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)


name: ses:GetAccount
access_level: Read
description:
Grants permission to get information about the email-sending status and capabilities for your account


name: ses:GetBlacklistReports
access_level: Read
description:
Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses or tracked domains appear


name: ses:GetConfigurationSetEventDestinations
access_level: Read
description:
Grants permission to retrieve a list of event destinations that are associated with a configuration set


name: ses:GetCustomVerificationEmailTemplate
access_level: Read
description:
Grants permission to return the custom email verification template for the template name you specify


name: ses:GetDomainStatisticsReport
access_level: Read
description:
Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email


name: ses:GetEmailIdentityPolicies
access_level: Read
description:
Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)


name: ses:GetEmailTemplate
access_level: Read
description:
Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify


name: ses:GetSuppressedDestination
access_level: Read
description:
Grants permission to retrieve information about a specific email address that's on the suppression list for your account


name: ses:ListDeliverabilityTestReports
access_level: List
description:
Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account


name: ses:ListDomainDeliverabilityCampaigns
access_level: Read
description:
Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range


name: ses:ListTagsForResource
access_level: Read
description:
Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account


name: ses:PutConfigurationSetReputationOptions
access_level: Write
description:
Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set


name: ses:PutConfigurationSetSendingOptions
access_level: Write
description:
Grants permission to enable or disable email sending for messages that use a particular configuration set


name: ses:PutConfigurationSetSuppressionOptions
access_level: Write
description:
Grants permission to specify the account suppression list preferences for a particular configuration set


name: ses:PutConfigurationSetTrackingOptions
access_level: Write
description:
Grants permission to specify a custom domain to use for open and click tracking elements in email that you send for a particular configuration set


name: ses:PutEmailIdentityDkimSigningAttributes
access_level: Write
description:
Grants permission to configure or change the DKIM authentication settings for an email domain identity


name: ses:PutEmailIdentityMailFromAttributes
access_level: Write
description:
Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity


name: ses:TestRenderEmailTemplate
access_level: Write
description:
Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data


name: ses:UpdateEmailIdentityPolicy
access_level: Permissions management
description:
Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain)


name: ses:CreateConfigurationSetTrackingOptions
access_level: Write
description:
Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking


name: ses:DeleteConfigurationSetTrackingOptions
access_level: Write
description:
Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking


name: ses:DescribeActiveReceiptRuleSet
access_level: Read
description:
Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active


name: ses:GetIdentityMailFromDomainAttributes
access_level: Read
description:
Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains)


name: ses:GetIdentityNotificationAttributes
access_level: Read
description:
Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),


name: ses:GetIdentityVerificationAttributes
access_level: Read
description:
Grants permission to return the verification status and (for domain identities) the verification token for a list of identities


name: ses:GetTemplate
access_level: Read
description:
Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify


name: ses:PutIdentityPolicy
access_level: Permissions management
description:
Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain)


name: ses:SendBounce
access_level: Write
description:
Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES


name: ses:SendCustomVerificationEmail
access_level: Write
description:
Grants permission to add an email address to the list of identities and attempts to verify it for your account


name: ses:SetIdentityFeedbackForwardingEnabled
access_level: Write
description:
Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain)


name: ses:SetIdentityHeadersInNotificationsEnabled
access_level: Write
description:
Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain)


name: ses:SetIdentityNotificationTopic
access_level: Write
description:
Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity


name: ses:UpdateConfigurationSetReputationMetricsEnabled
access_level: Write
description:
Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set


name: ses:UpdateConfigurationSetSendingEnabled
access_level: Write
description:
Grants permission to enable or disable email sending for messages sent using a specific configuration set


name: ses:UpdateConfigurationSetTrackingOptions
access_level: Write
description:
Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking


name: ses:ListDeliverabilityTestReports
access_level: List
description:
Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses


name: ses:ListDomainDeliverabilityCampaigns
access_level: Read
description:
Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range


name: ses:ListTagsForResource
access_level: Read
description:
Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource


name: ses:PutConfigurationSetTrackingOptions
access_level: Write
description:
Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set


name: shield:AssociateDRTLogBucket
access_level: Write
description:
Grants permission to authorize the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs


name: shield:AssociateDRTRole
access_level: Write
description:
Grants permission to authorize the DDoS Response team using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks


name: shield:AssociateProactiveEngagementDetails
access_level: Write
description:
Grants permission to initialize proactive engagement and set the list of contacts for the DDoS Response Team (DRT) to use


name: shield:CreateProtectionGroup
access_level: Write
description:
Grants permission to create a grouping of protected resources so they can be handled as a collective


name: shield:DescribeAttackStatistics
access_level: Read
description:
Grants permission to describe information about the number and type of attacks AWS Shield has detected in the last year


name: shield:DescribeDRTAccess
access_level: Read
description:
Grants permission to describe the current role and list of Amazon S3 log buckets used by the DDoS Response team to access your AWS account while assisting with attack mitigation


name: shield:DescribeEmergencyContactSettings
access_level: Read
description:
Grants permission to list the email addresses that the DRT can use to contact you during a suspected attack


name: shield:DisableProactiveEngagement
access_level: Write
description:
Grants permission to remove authorization from the DDoS Response Team (DRT) to notify contacts about escalations


name: shield:DisassociateDRTLogBucket
access_level: Write
description:
Grants permission to remove the DDoS Response team's access to the specified Amazon S3 bucket containing your flow logs


name: shield:DisassociateHealthCheck
access_level: Write
description:
Grants permission to remove health-based detection from the Shield Advanced protection for a resource


name: shield:EnableProactiveEngagement
access_level: Write
description:
Grants permission to authorize the DDoS Response Team (DRT) to use email and phone to notify contacts about escalations


name: shield:ListTagsForResource
access_level: Read
description:
Grants permission to get information about AWS tags for a specified Amazon Resource Name (ARN) in AWS Shield


name: shield:UpdateEmergencyContactSettings
access_level: Write
description:
Grants permission to update the details of the list of email addresses that the DRT can use to contact you during a suspected attack


name: sms-voice:CreateConfigurationSet
access_level: Write
description:
Create a new configuration set. After you create the configuration set, you can add one or more event destinations to it.


name: sms-voice:GetConfigurationSetEventDestinations
access_level: Read
description:
Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.


name: sms-voice:ListConfigurationSets
access_level: Read
description:
Return a list of configuration sets. This operation only returns the configuration sets that are associated with your account in the current AWS Region.


name: sms-voice:UpdateConfigurationSetEventDestination
access_level: Write
description:
Update an event destination in a configuration set. An event destination is a location that you publish information about your voice calls to. For example, you can log an event to an Amazon CloudWatch destination when a call fails.


name: snowball:DescribeAddress
access_level: Read
description:
Takes an AddressId and returns specific details about that address in the form of an Address object.


name: snowball:DescribeCluster
access_level: Read
description:
Returns information about a specific cluster including shipping information, cluster status, and other important metadata.


name: snowball:DescribeJob
access_level: Read
description:
Returns information about a specific job including shipping information, job status, and other important metadata.


name: snowball:GetJobManifest
access_level: Read
description:
Returns a link to an Amazon S3 presigned URL for the manifest file associated with the specified JobId value.


name: snowball:GetSnowballUsage
access_level: Read
description:
Returns information about the Snowball service limit for your account, and also the number of Snowballs your account has in use.


name: snowball:ListCompatibleImages
access_level: List
description:
This action returns a list of the different Amazon EC2 Amazon Machine Images (AMIs) that are owned by your AWS account that would be supported for use on a Snow device.


name: snowball:UpdateCluster
access_level: Write
description:
While a cluster's ClusterState value is in the AwaitingQuorum state, you can update some of the information associated with a cluster.


name: sns:AddPermission
access_level: Permissions management
description:
Grants permission to add a statement to a topic's access control policy, granting access for the specified AWS accounts to the specified actions


name: sns:CheckIfPhoneNumberIsOptedOut
access_level: Read
description:
Grants permission to accept a phone number and indicate whether the phone holder has opted out of receiving SMS messages from your account


name: sns:ConfirmSubscription
access_level: Write
description:
Grants permission to verify an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action


name: sns:CreatePlatformApplication
access_level: Write
description:
Grants permission to create a platform application object for one of the supported push notification services, such as APNS and GCM, to which devices and mobile apps may register


name: sns:CreatePlatformEndpoint
access_level: Write
description:
Grants permission to create an endpoint for a device and mobile app on one of the supported push notification services, such as GCM and APNS


name: sns:CreateSMSSandboxPhoneNumber
access_level: Write
description:
Grants permission to add a destination phone number and send a one-time password (OTP) to that phone number for an AWS account


name: sns:DeletePlatformApplication
access_level: Write
description:
Grants permission to delete a platform application object for one of the supported push notification services, such as APNS and GCM


name: sns:GetEndpointAttributes
access_level: Read
description:
Grants permission to retrieve the endpoint attributes for a device on one of the supported push notification services, such as GCM and APNS


name: sns:GetPlatformApplicationAttributes
access_level: Read
description:
Grants permission to retrieve the attributes of the platform application object for the supported push notification services, such as APNS and GCM


name: sns:ListEndpointsByPlatformApplication
access_level: List
description:
Grants permission to list the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM and APNS


name: sns:ListPhoneNumbersOptedOut
access_level: Read
description:
Grants permission to return a list of phone numbers that are opted out, meaning you cannot send SMS messages to them


name: sns:ListPlatformApplications
access_level: List
description:
Grants permission to list the platform application objects for the supported push notification services, such as APNS and GCM


name: sns:ListSMSSandboxPhoneNumbers
access_level: List
description:
Grants permission to list the calling account's current pending and verified destination phone numbers


name: sns:OptInPhoneNumber
access_level: Write
description:
Grants permission to opt in a phone number that is currently opted out, which enables you to resume sending SMS messages to the number


name: sns:SetEndpointAttributes
access_level: Write
description:
Grants permission to set the attributes for an endpoint for a device on one of the supported push notification services, such as GCM and APNS


name: sns:SetPlatformApplicationAttributes
access_level: Write
description:
Grants permission to set the attributes of the platform application object for the supported push notification services, such as APNS and GCM


name: sns:SetSMSAttributes
access_level: Write
description:
Grants permission to set the default settings for sending SMS messages and receiving daily SMS usage reports


name: sns:Subscribe
access_level: Write
description:
Grants permission to prepare to subscribe an endpoint by sending the endpoint a confirmation message


name: sns:VerifySMSSandboxPhoneNumber
access_level: Write
description:
Grants permission to verify a destination phone number with a one-time password (OTP) for an AWS account


name: sqs:ListDeadLetterSourceQueues
access_level: Read
description:
Returns a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue.


name: ssm:CreateActivation
access_level: Write
description:
Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager


name: ssm:CreateAssociation
access_level: Write
description:
Grants permission to associate a specified Systems Manager document with specified instances or other targets


name: ssm:CreateResourceDataSync
access_level: Write
description:
Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket


name: ssm:DeleteInventory
access_level: Write
description:
Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type


name: ssm:DeregisterManagedInstance
access_level: Write
description:
Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager


name: ssm:DeregisterPatchBaselineForPatchGroup
access_level: Write
description:
Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group


name: ssm:DescribeActivations
access_level: Read
description:
Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation


name: ssm:DescribeAssociation
access_level: Read
description:
Grants permission to view details about the specified association for a specified instance or target


name: ssm:DescribeAutomationStepExecutions
access_level: Read
description:
Grants permission to view information about all active and terminated step executions in an Automation workflow


name: ssm:DescribeDocumentParameters
access_level: Read
description:
Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action)


name: ssm:DescribeEffectivePatchesForPatchBaseline
access_level: Read
description:
Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only)


name: ssm:DescribeInstancePatchStatesForPatchGroup
access_level: Read
description:
Grants permission to describe the high-level patch state for the instances in the specified patch group


name: ssm:DescribeMaintenanceWindowExecutionTasks
access_level: List
description:
Grants permission to view details about the tasks that ran during a specified maintenance window execution


name: ssm:DescribeMaintenanceWindowsForTarget
access_level: List
description:
Grants permission to view information about the maintenance window targets and tasks associated with a specified instance


name: ssm:DescribePatchProperties
access_level: List
description:
Grants permission to view details of available patches for a specified operating system and patch property


name: ssm:DescribeSessions
access_level: List
description:
Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria


name: ssm:GetInventorySchema
access_level: Read
description:
Grants permission to view a list of inventory types or attribute names for a specified inventory item type


name: ssm:GetMaintenanceWindowExecutionTaskInvocation
access_level: Read
description:
Grants permission to view details about a specific maintenance window task running on a specific target


name: ssm:GetManifest
access_level: Read
description:
Used by Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call)


name: ssm:GetOpsSummary
access_level: Read
description:
Grants permission to view summary information about OpsItems based on specified filters and aggregators


name: ssm:ListComplianceSummaries
access_level: List
description:
Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type


name: ssm:PutComplianceItems
access_level: Write
description:
Grants permission to register a compliance type and other compliance details on a specified resource


name: ssm:PutConfigurePackageResult
access_level: Read
description:
Used by SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call)


name: ssm:SendAutomationSignal
access_level: Write
description:
Grants permission to send a signal to change the current behavior or status of a specified Automation execution


name: ssm:UpdateAssociation
access_level: Write
description:
Grants permission to update an association and immediately run the association on the specified targets


name: ssm:UpdateInstanceAssociationStatus
access_level: Write
description:
Used by SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)


name: ssmmessages:CreateControlChannel
access_level: Write
description:
Grants permission to register a control channel for an instance to send control messages to Systems Manager service


name: ssmmessages:CreateDataChannel
access_level: Write
description:
Grants permission to register a data channel for an instance to send data messages to Systems Manager service


name: ssmmessages:OpenControlChannel
access_level: Write
description:
Grants permission to open a websocket connection for a registered control channel stream from an instance to Systems Manager service


name: ssmmessages:OpenDataChannel
access_level: Write
description:
Grants permission to open a websocket connection for a registered data channel stream from an instance to Systems Manager service


name: sso:CreateAccountAssignment
access_level: Write
description:
Grants permission to assign access to a Principal for a specified AWS account using a specified permission set.


name: sso:DeleteAccountAssignment
access_level: Write
description:
Grants permission to delete a Principal's access from a specified AWS account using a specified permission set.


name: sso:ImportApplicationInstanceServiceProviderMetadata
access_level: Write
description:
Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider


name: sso:ListAccountAssignmentCreationStatus
access_level: List
description:
Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance.


name: sso:ListAccountAssignmentDeletionStatus
access_level: List
description:
Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance.


name: sso:ListAccountAssignments
access_level: List
description:
Grants permission to list the assignee of the specified AWS account with the specified permission set.


name: sso:ListPermissionSetProvisioningStatus
access_level: List
description:
Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance.


name: sso-directory:DeleteExternalIdPConfigurationForDirectory
access_level: Write
description:
Grants permission to delete an External Identity Provider configuration associated with the directory


name: sso-directory:DescribeGroups
access_level: Read
description:
Grants permission to retrieve information about groups from the directory that AWS SSO provides by default


name: sso-directory:DescribeUser
access_level: Read
description:
Grants permission to retrieve information about a user from the directory that AWS SSO provides by default


name: sso-directory:DescribeUsers
access_level: Read
description:
Grants permission to retrieve information about user from the directory that AWS SSO provides by default


name: sso-directory:IsMemberInGroup
access_level: Read
description:
Grants permission to check if a member is a part of the group in the directory that AWS SSO provides by default


name: sso-directory:ListExternalIdPConfigurationsForDirectory
access_level: Read
description:
Grants permission to list all the External Identity Provider configurations created for the directory


name: sso-directory:ListMembersInGroup
access_level: Read
description:
Grants permission to retrieve all members that are part of a group in the directory that AWS SSO provides by default


name: sso-directory:RemoveMemberFromGroup
access_level: Write
description:
Grants permission to remove a member that is part of a group in the directory that AWS SSO provides by default


name: sso-directory:UpdateExternalIdPConfigurationForDirectory
access_level: Write
description:
Grants permission to update an External Identity Provider configuration associated with the directory


name: sso-directory:UpdateGroup
access_level: Write
description:
Grants permission to update information about a group in the directory that AWS SSO provides by default


name: sso-directory:UpdatePassword
access_level: Write
description:
Grants permission to update a password by sending password reset link via email or generating one time password for a user in the directory that AWS SSO provides by default


name: states:GetActivityTask
access_level: Write
description:
Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine


name: states:SendTaskHeartbeat
access_level: Write
description:
Grants permission to report to the service that the task represented by the specified taskToken is still making progress


name: storagegateway:AddUploadBuffer
access_level: Write
description:
Grants permission to configure one or more gateway local disks as upload buffer for a specified gateway


name: storagegateway:AttachVolume
access_level: Write
description:
Grants permission to connect a volume to an iSCSI connection and then attaches the volume to the specified gateway


name: storagegateway:CancelArchival
access_level: Write
description:
Grants permission to cancel archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated


name: storagegateway:CancelRetrieval
access_level: Write
description:
Grants permission to cancel retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated


name: storagegateway:CreateCachediSCSIVolume
access_level: Write
description:
Grants permission to create a cached volume on a specified cached gateway. This operation is supported only for the gateway-cached volume architecture


name: storagegateway:CreateTapes
access_level: Write
description:
Grants permission to create one or more virtual tapes. You write data to the virtual tapes and then archive the tapes


name: storagegateway:DeleteChapCredentials
access_level: Write
description:
Grants permission to delete Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair


name: storagegateway:DeleteVolume
access_level: Write
description:
Grants permission to delete the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API


name: storagegateway:DescribeAvailabilityMonitorTest
access_level: Read
description:
Grants permission to get the information about the most recent high availability monitoring test that was performed on the gateway


name: storagegateway:DescribeCache
access_level: Read
description:
Grants permission to get information about the cache of a gateway. This operation is supported only for the gateway-cached volume architecture


name: storagegateway:DescribeCachediSCSIVolumes
access_level: Read
description:
Grants permission to get a description of the gateway volumes specified in the request. This operation is supported only for the gateway-cached volume architecture


name: storagegateway:DescribeChapCredentials
access_level: Read
description:
Grants permission to get an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair


name: storagegateway:DescribeGatewayInformation
access_level: Read
description:
Grants permission to get metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not)


name: storagegateway:DescribeMaintenanceStartTime
access_level: Read
description:
Grants permission to get your gateway's weekly maintenance start time including the day and time of the week


name: storagegateway:DescribeSMBSettings
access_level: Read
description:
Grants permission to get a description of a Server Message Block (SMB) file share settings from a file gateway


name: storagegateway:DescribeTapeRecoveryPoints
access_level: Read
description:
Grants permission to get a list of virtual tape recovery points that are available for the specified gateway-VTL


name: storagegateway:DescribeVTLDevices
access_level: Read
description:
Grants permission to get a description of virtual tape library (VTL) devices for the specified gateway


name: storagegateway:DetachVolume
access_level: Write
description:
Grants permission to disconnect a volume from an iSCSI connection and then detaches the volume from the specified gateway


name: storagegateway:ListAutomaticTapeCreationPolicies
access_level: List
description:
Grants permission to list the automatic tape creation policies configured on the specified gateway-VTL or all gateway-VTLs owned by your account


name: storagegateway:ListFileShares
access_level: List
description:
Grants permission to get a list of the file shares for a specific file gateway, or the list of file shares that belong to the calling user account


name: storagegateway:ListGateways
access_level: List
description:
Grants permission to list gateways owned by an AWS account in a region specified in the request. The returned list is ordered by gateway Amazon Resource Name (ARN)


name: storagegateway:ListTapes
access_level: List
description:
Grants permission to list virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS)


name: storagegateway:NotifyWhenUploaded
access_level: Write
description:
Grants permission to send you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3


name: storagegateway:ResetCache
access_level: Write
description:
Grants permission to reset all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage


name: storagegateway:RetrieveTapeArchive
access_level: Write
description:
Grants permission to retrieve an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL


name: storagegateway:StartAvailabilityMonitorTest
access_level: Write
description:
Grants permission to start a test that verifies that the specified gateway is configured for High Availability monitoring in your host environment


name: storagegateway:UpdateChapCredentials
access_level: Write
description:
Grants permission to update the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target


name: storagegateway:UpdateMaintenanceStartTime
access_level: Write
description:
Grants permission to update a gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone


name: storagegateway:UpdateSMBFileShareVisibility
access_level: Write
description:
Grants permission to update whether the shares on a gateway are visible in a net view or browse list


name: sts:AssumeRole
access_level: Write
description:
Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to


name: sts:AssumeRoleWithSAML
access_level: Write
description:
Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response


name: sts:AssumeRoleWithWebIdentity
access_level: Write
description:
Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider


name: sts:DecodeAuthorizationMessage
access_level: Write
description:
Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request


name: sts:GetFederationToken
access_level: Read
description:
Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user


name: sts:GetSessionToken
access_level: Read
description:
Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user


name: support:DescribeCaseAttributes
access_level: Read
description:
This is an internally managed function which allows secondary services to read AWS Support case attributes.


name: support:DescribeTrustedAdvisorCheckSummaries
access_level: Read
description:
Returns the summaries of the results of the Trusted Advisor checks that have the specified check identifiers.


name: support:DescribeTrustedAdvisorChecks
access_level: Read
description:
Returns a list of all available Trusted Advisor checks, including name, identifier, category and description.


name: support:PutCaseAttributes
access_level: Write
description:
This is an internally managed function which allows secondary services to attach attributes to AWS Support cases.


name: swf:CountClosedWorkflowExecutions
access_level: Read
description:
Returns the number of closed workflow executions within the given domain that meet the specified filtering criteria.


name: swf:CountOpenWorkflowExecutions
access_level: Read
description:
Returns the number of open workflow executions within the given domain that meet the specified filtering criteria.


name: swf:ListActivityTypes
access_level: List
description:
Returns information about all activities registered in the specified domain that match the specified name and registration status.


name: swf:ListClosedWorkflowExecutions
access_level: List
description:
Returns a list of closed workflow executions in the specified domain that meet the filtering criteria.


name: swf:ListOpenWorkflowExecutions
access_level: List
description:
Returns a list of open workflow executions in the specified domain that meet the filtering criteria.


name: swf:RecordActivityTaskHeartbeat
access_level: Write
description:
Used by activity workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress.


name: swf:RequestCancelWorkflowExecution
access_level: Write
description:
Records a WorkflowExecutionCancelRequested event in the currently running workflow execution identified by the given domain, workflowId, and runId.


name: swf:RespondActivityTaskCanceled
access_level: Write
description:
Used by workers to tell the service that the ActivityTask identified by the taskToken was successfully canceled.


name: swf:RespondActivityTaskCompleted
access_level: Write
description:
Used by workers to tell the service that the ActivityTask identified by the taskToken completed successfully with a result (if provided).


name: swf:RespondActivityTaskFailed
access_level: Write
description:
Used by workers to tell the service that the ActivityTask identified by the taskToken has failed with reason (if specified).


name: swf:RespondDecisionTaskCompleted
access_level: Write
description:
Used by deciders to tell the service that the DecisionTask identified by the taskToken has successfully completed.


name: swf:SignalWorkflowExecution
access_level: Write
description:
Records a WorkflowExecutionSignaled event in the workflow execution history and creates a decision task for the workflow execution identified by the given domain, workflowId and runId.


name: swf:StartWorkflowExecution
access_level: Write
description:
Starts an execution of the workflow type in the specified domain using the provided workflowId and input data.


name: swf:TerminateWorkflowExecution
access_level: Write
description:
Records a WorkflowExecutionTerminated event and forces closure of the workflow execution identified by the given domain, runId, and workflowId.


name: synthetics:DeleteCanary
access_level: Write
description:
Grants permission to delete a canary. Amazon Synthetics deletes all the resources except for the Lambda function and the CloudWatch Alarms if you created one


name: synthetics:StartCanary
access_level: Write
description:
Grants permission to start a canary, so that Amazon CloudWatch Synthetics starts monitoring a website


name: tag:GetComplianceSummary
access_level: Read
description:
Grants permission to retrieve a summary of how many resources are noncompliant with their effective tag policies


name: tag:GetResources
access_level: Read
description:
Grants permission to return tagged or previously tagged resources in the specified AWS Region for the calling account


name: tag:GetTagKeys
access_level: Read
description:
Grants permission to returns tag keys currently in use in the specified AWS Region for the calling account


name: tag:GetTagValues
access_level: Read
description:
Grants permission to return tag values for the specified key that are used in the specified AWS Region for the calling account


name: tag:StartReportCreation
access_level: Write
description:
Grants permission to start generating a report listing all tagged resources in accounts across your organization, and whether each resource is compliant with the effective tag policy


name: textract:StartDocumentAnalysis
access_level: Write
description:
Starts an asynchronous job to detect instances of real-world document entities within an image or pdf provided as input.


name: transcribe:CreateCallAnalyticsCategory
access_level: Write
description:
Grants permission to create an analytics category. Amazon Transcribe applies the conditions specified by your analytics categories to your call analytics jobs


name: transcribe:CreateMedicalVocabulary
access_level: Write
description:
Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe Medical handles transcription of an audio file


name: transcribe:CreateVocabulary
access_level: Write
description:
Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe handles transcription of an audio file


name: transcribe:CreateVocabularyFilter
access_level: Write
description:
Grants permission to create a new vocabulary filter that you can use to filter out words from the transcription of an audio file generated by Amazon Transcribe


name: transcribe:DeleteCallAnalyticsJob
access_level: Write
description:
Grants permission to delete a previously submitted call analytics job along with any other generated results such as the transcription, models, and so on


name: transcribe:DeleteTranscriptionJob
access_level: Write
description:
Grants permission to delete a previously submitted transcription job along with any other generated results such as the transcription, models, and so on


name: transcribe:ListMedicalVocabularies
access_level: List
description:
Grants permission to return a list of medical vocabularies that match the specified criteria. If no criteria are specified, returns the entire list of vocabularies


name: transcribe:ListVocabularies
access_level: List
description:
Grants permission to return a list of vocabularies that match the specified criteria. If no criteria are specified, returns the entire list of vocabularies


name: transcribe:ListVocabularyFilters
access_level: List
description:
Grants permission to return a list of vocabulary filters that match the specified criteria. If no criteria are specified, returns the at most 5 vocabulary filters


name: transcribe:StartCallAnalyticsJob
access_level: Write
description:
Grants permission to start an asynchronous analytics job that not only transcribes the audio recording of a caller and agent, but also returns additional insights


name: transcribe:StartMedicalStreamTranscription
access_level: Write
description:
Grants permission to start a protocol where audio is streamed to Transcribe Medical and the transcription results are streamed to your application


name: transcribe:StartMedicalStreamTranscriptionWebSocket
access_level: Write
description:
Grants permission to start a WebSocket where audio is streamed to Transcribe Medical and the transcription results are streamed to your application


name: transcribe:UpdateCallAnalyticsCategory
access_level: Write
description:
Grants permission to update the call analytics category with new values. The UpdateCallAnalyticsCategory operation overwrites all of the existing information with the values that you provide in the request


name: transcribe:UpdateMedicalVocabulary
access_level: Write
description:
Grants permission to update an existing medical vocabulary with new values. The UpdateMedicalVocabulary operation overwrites all of the existing information with the values that you provide in the request


name: transcribe:UpdateVocabulary
access_level: Write
description:
Grants permission to update an existing vocabulary with new values. The UpdateVocabulary operation overwrites all of the existing information with the values that you provide in the request


name: transcribe:UpdateVocabularyFilter
access_level: Write
description:
Grants permission to update an existing vocabulary filter with new values. The UpdateVocabularyFilter operation overwrites all of the existing information with the values that you provide in the request


name: translate:ImportTerminology
access_level: Write
description:
Grants permission to create or update a terminology, depending on whether or not one already exists for the given terminology name


name: translate:StartTextTranslationJob
access_level: Write
description:
Grants permission to start an asynchronous batch translation job. Batch translation jobs can be used to translate large volumes of text across multiple documents at once


name: trustedadvisor:DescribeOrganization
access_level: Read
description:
Grants permission to view if the AWS account meets the requirements to enable the organizational view feature


name: trustedadvisor:DescribeReports
access_level: Read
description:
Grants permission to view details for organizational view reports, such as the report name, runtime, date created, status, and format


name: trustedadvisor:DescribeServiceMetadata
access_level: Read
description:
Grants permission to view information about organizational view reports, such as the AWS Regions, check categories, check names, and resource statuses


name: trustedadvisor:ListAccountsForParent
access_level: Read
description:
Grants permission to view, in the Trusted Advisor console, all of the accounts in an AWS organization that are contained by a root or organizational unit (OU)


name: trustedadvisor:ListOrganizationalUnitsForParent
access_level: Read
description:
Grants permission to view, in the Trusted Advisor console, all of the organizational units (OUs) in a parent organizational unit or root


name: trustedadvisor:ListRoots
access_level: Read
description:
Grants permission to view, in the Trusted Advisor console, all of the roots that are defined in an AWS organization


name: waf:CreateRateBasedRule
access_level: Write
description:
Grants permission to create a RateBasedRule for limiting the volume of requests from a single IP address


name: waf:CreateRuleGroup
access_level: Write
description:
Grants permission to create a RuleGroup, which is a collection of predefined rules that you can use in a WebACL


name: waf:CreateWebACLMigrationStack
access_level: Write
description:
Grants permission to create a CloudFormation web ACL template in an S3 bucket for the purposes of migrating the web ACL from AWS WAF Classic to AWS WAF v2


name: waf:CreateXssMatchSet
access_level: Write
description:
Grants permission to create an XssMatchSet, which you use to detect requests that contain cross-site scripting attacks


name: waf:GetRateBasedRuleManagedKeys
access_level: Read
description:
Grants permission to retrieve the array of IP addresses that are currently being blocked by a RateBasedRule


name: waf-regional:PutPermissionPolicy
access_level: Permissions management
description:
Grants permission to attach an IAM policy to a specified rule group, to support rule group sharing between accounts


name: waf-regional:UpdateRateBasedRule
access_level: Write
description:
Grants permission to insert or delete predicate objects in a rate based rule and update the RateLimit in the rule


name: wafv2:CheckCapacity
access_level: Read
description:
Grants permission to calculate web ACL capacity unit (WCU) requirements for a specified scope and set of rules


name: wafv2:DeleteFirewallManagerRuleGroups
access_level: Write
description:
Grants permission to delete FirewallManagedRulesGroups from a WebACL if not managed by Firewall Manager anymore


name: wafv2:ListRegexPatternSets
access_level: List
description:
Grants permission to retrieve an array of RegexPatternSetSummary objects for the regex pattern sets that you manage


name: wafv2:ListResourcesForWebACL
access_level: List
description:
Grants permission to retrieve an array of the Amazon Resource Names (ARNs) for the resources that are associated with a web ACL


name: wafv2:ListRuleGroups
access_level: List
description:
Grants permission to retrieve an array of RuleGroupSummary objects for the rule groups that you manage


name: wellarchitected:GetLensVersionDifference
access_level: Read
description:
Grants permission to get the difference between the specified lens version and latest available lens version


name: wellarchitected:UpgradeLensReview
access_level: Write
description:
Grants permission to upgrade the specified lens review to use the latest version of the associated lens


name: workdocs:AbortDocumentVersionUpload
access_level: Write
description:
Grants permission to abort the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload.


name: workdocs:DeactivateUser
access_level: Write
description:
Grants permission to deactivate the specified user, which revokes the user's access to Amazon WorkDocs.


name: workdocs:DescribeFolderContents
access_level: List
description:
Grants permission to describe the contents of the specified folder, including its documents and sub-folders.


name: workdocs:DescribeUsers
access_level: List
description:
Grants permission to view a description of the specified users. You can describe all users or filter the results (for example, by status or organization).


name: workdocs:GetDocumentPath
access_level: Read
description:
Grants permission to retrieve the path information (the hierarchy from the root folder) for the requested document.


name: workdocs:GetFolderPath
access_level: Read
description:
Grants permission to retrieve the path information (the hierarchy from the root folder) for the specified folder.


name: workdocs:UpdateUser
access_level: Write
description:
Grants permission to update the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site.


name: worklink:DescribeWebsiteCertificateAuthority
access_level: Read
description:
Grants permission to describe a website certificate authority associated with an Amazon WorkLink fleet


name: worklink:ListWebsiteCertificateAuthorities
access_level: List
description:
Grants permission to list the website certificate authorities associated with an Amazon WorkLink fleet


name: workmail:CreateGroup
access_level: Write
description:
Grants permission to create a group that can be used in WorkMail by calling the RegisterToWorkMail operation


name: workmail:CreateInboundMailFlowRule
access_level: Write
description:
Grants permission to create an inbound email flow rule which will apply to all email sent to an organization


name: workmail:CreateOutboundMailFlowRule
access_level: Write
description:
Grants permission to create an outbound email flow rule which will apply to all email sent from an organization


name: workmail:CreateUser
access_level: Write
description:
Grants permission to create a user, which can be enabled afterwards by calling the RegisterToWorkMail operation


name: workmail:DeleteInboundMailFlowRule
access_level: Write
description:
Grants permission to remove an inbound email flow rule to no longer apply to emails sent to an organization


name: workmail:DeleteOrganization
access_level: Write
description:
Grants permission to delete an Amazon WorkMail organization and all underlying AWS resources managed by Amazon WorkMail as part of the organization


name: workmail:DeleteOutboundMailFlowRule
access_level: Write
description:
Grants permission to remove an outbound email flow rule so that it no longer applies to emails sent from an organization


name: workmail:DeleteRetentionPolicy
access_level: Write
description:
Grants permission to delete the retention policy based on the supplied organization and policy identifiers


name: workmail:DisableMailGroups
access_level: Write
description:
Grants permission to disable a mail group when it is not being used, in order to allow it to be deleted


name: workmail:DisableMailUsers
access_level: Write
description:
Grants permission to disable a user mailbox when it is no longer being used, in order to allow it to be deleted


name: workmail:GetAccessControlEffect
access_level: Read
description:
Grants permission to get the effects of access control rules as they apply to a specified IPv4 address, access protocol action, or user ID


name: workmail:GetJournalingRules
access_level: Read
description:
Grants permission to read the configured journaling and fallback email addresses for email journaling


name: workmail:GetMobileDeviceAccessEffect
access_level: Read
description:
Grants permission to simulate the effect of the mobile device access rules for the given attributes of a sample access event


name: workmail:ListGroupMembers
access_level: List
description:
Grants permission to read an overview of the members of a group. Users and groups can be members of a group


name: workmail:ListMailboxPermissions
access_level: List
description:
Grants permission to list the mailbox permissions associated with a user, group, or resource mailbox


name: workmail:PutMailboxPermissions
access_level: Write
description:
Grants permission to set permissions for a user, group, or resource, replacing any existing permissions


name: workmail:RegisterToWorkMail
access_level: Write
description:
Grants permission to register an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities


name: workmail:TestInboundMailFlowRules
access_level: Write
description:
Grants permission to test what inbound rules will apply to an email with a given sender and recipient


name: workmail:TestOutboundMailFlowRules
access_level: Write
description:
Grants permission to test what outbound rules will apply to an email with a given sender and recipient


name: workmail:UpdateInboundMailFlowRule
access_level: Write
description:
Grants permission to update the details of an inbound email flow rule which will apply to all email sent to an organization


name: workmail:UpdateOutboundMailFlowRule
access_level: Write
description:
Grants permission to update the details of an outbound email flow rule which will apply to all email sent from an organization


name: workspaces:DescribeAccount
access_level: Read
description:
Grants permission to retrieve the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts


name: workspaces:DescribeAccountModifications
access_level: Read
description:
Grants permission to retrieve modifications to the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts


name: workspaces:DescribeConnectionAliasPermissions
access_level: Read
description:
Grants permission to retrieve the permissions that the owners of connection aliases have granted to other AWS accounts for connection aliases


name: workspaces:DescribeConnectionAliases
access_level: Read
description:
Grants permission to retrieve a list that describes the connection aliases used for cross-Region redirection


name: workspaces:ListAvailableManagementCidrRanges
access_level: List
description:
Grants permission to list the available CIDR ranges for enabling Bring Your Own License (BYOL) for WorkSpaces accounts


name: workspaces:ModifyAccount
access_level: Write
description:
Grants permission to modify the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts


name: workspaces:ModifyWorkspaceAccessProperties
access_level: Write
description:
Grants permission to specify which devices and operating systems users can use to access their WorkSpaces


name: workspaces:ModifyWorkspaceProperties
access_level: Write
description:
Grants permission to modify WorkSpace properties, including the running mode and the AutoStop period


name: workspaces:UpdateWorkspaceImagePermission
access_level: Permissions management
description:
Grants permission to share or unshare WorkSpace images with other accounts by specifying whether other accounts have permission to copy the image


name: xray:BatchGetTraces
access_level: List
description:
Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs


name: xray:GetInsightImpactGraph
access_level: Read
description:
Grants permission to retrieve the part of the service graph which is impacted for a specific insight


name: xray:GetInsightSummaries
access_level: Read
description:
Grants permission to retrieve the summary of all insights for a group and time range with optional filters


name: xray:GetSamplingTargets
access_level: Read
description:
Grants permission to request a sampling quota for rules that the service is using to sample requests


name: xray:GetServiceGraph
access_level: Read
description:
Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result


name: xray:GetTimeSeriesServiceStatistics
access_level: Read
description:
Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals


name: xray:GetTraceSummaries
access_level: Read
description:
Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces


name: xray:PutTraceSegments
access_level: Write
description:
Grants permission to upload segment documents to AWS X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches


name: aws-marketplace:AssociateProductsWithPrivateMarketplace
access_level: Write
description:
Grants permission to add new approved products to the Private Marketplace. Also allows to approve a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:CreatePrivateMarketplaceRequests
access_level: Write
description:
Grants permission to create a new request for a product or products to be associated with the Private Marketplace. This action can be performed by any account in an in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:DescribePrivateMarketplaceRequests
access_level: List
description:
Grants permission to describe requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:DisassociateProductsFromPrivateMarketplace
access_level: Write
description:
Grants permission to remove approved products from the Private Marketplace. Also allows to decline a request for a product to be associated with the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: aws-marketplace:ListPrivateMarketplaceRequests
access_level: List
description:
Grants permission to get a queryable list for requests and associated products in the Private Marketplace. This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it.


name: chime:AssociateSigninDelegateGroupsWithAccount
access_level: Write
description:
Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account


name: chime:DisassociateSigninDelegateGroupsFromAccount
access_level: Write
description:
Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account


name: cloud9:CreateEnvironmentEC2
access_level: Write
description:
Grants permission to create an AWS Cloud9 development environment, launches an Amazon Elastic Compute Cloud (Amazon EC2) instance, and then hosts the environment on the instance


name: cloud9:CreateEnvironmentToken
access_level: Read
description:
Grants permission to create an authentication token that allows a connection between the AWS Cloud9 IDE and the user's environment


name: cloud9:DeleteEnvironment
access_level: Write
description:
Grants permission to delete an AWS Cloud9 development environment. If the environment is hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance, also terminates the instance


name: cloud9:DescribeEC2Remote
access_level: Read
description:
Grants permission to get details about the connection to the EC2 development environment, including host, user, and port


name: cloud9:DescribeEnvironmentMemberships
access_level: Read
description:
Grants permission to get information about environment members for an AWS Cloud9 development environment


name: cloud9:DescribeSSHRemote
access_level: Read
description:
Grants permission to get details about the connection to the SSH development environment, including host, user, and port


name: cloud9:GetUserPublicKey
access_level: Read
description:
Grants permission to get the user's public SSH key, which is used by AWS Cloud9 to connect to SSH development environments


name: cloud9:ModifyTemporaryCredentialsOnEnvironmentEC2
access_level: Write
description:
Grants permission to set AWS managed temporary credentials on the Amazon EC2 instance that's used by the AWS Cloud9 integrated development environment (IDE)


name: cloud9:UpdateEnvironmentMembership
access_level: Write
description:
Grants permission to change the settings of an existing environment member for an AWS Cloud9 development environment


name: cloud9:UpdateSSHRemote
access_level: Write
description:
Grants permission to update details about the connection to the SSH development environment, including host, user, and port


name: cloud9:ValidateEnvironmentName
access_level: Read
description:
Grants permission to validate the environment name during the process of creating an AWS Cloud9 development environment


name: directconnect:AssociateMacSecKey
access_level: Write
description:
Grants permission to associate a MAC Security (MACsec) Connection Key Name (CKN)/ Connectivity Association Key (CAK) pair with an AWS Direct Connect dedicated connection


name: directconnect:DisassociateMacSecKey
access_level: Write
description:
Grants permission to remove the association between a MAC Security (MACsec) security key and an AWS Direct Connect dedicated connection


name: directconnect:UpdateConnection
access_level: Write
description:
Grants permission to update the AWS Direct Connect dedicated connection configuration. You can update the following parameters for a connection: The connection name or The connection's MAC Security (MACsec) encryption mode


name: ec2:CreateInstanceEventWindow
access_level: Write
description:
Grants permission to create an event window in which scheduled events for the associated Amazon EC2 instances can run


name: ecr:DescribeImageReplicationStatus
access_level: Read
description:
Grants permission to retrieve replication status about an image in a registry, including failure reason if replication fails


name: elasticbeanstalk:AbortEnvironmentUpdate
access_level: Write
description:
Grants permission to cancel in-progress environment configuration update or application version deployment


name: elasticbeanstalk:ComposeEnvironments
access_level: Write
description:
Grants permission to create or update a group of environments, each running a separate component of a single application


name: elasticbeanstalk:DescribeApplicationVersions
access_level: List
description:
Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket


name: elasticbeanstalk:RebuildEnvironment
access_level: Write
description:
Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart


name: elasticbeanstalk:RestartAppServer
access_level: Write
description:
Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance


name: elasticbeanstalk:UpdateApplicationResourceLifecycle
access_level: Write
description:
Grants permission to update the application version lifecycle policy associated with the application


name: elasticbeanstalk:UpdateConfigurationTemplate
access_level: Write
description:
Grants permission to update a configuration template with specified properties or configuration option values


name: elasticbeanstalk:UpdateTagsForResource
access_level: Tagging
description:
Grants permission to add tags to an Elastic Beanstalk resource, remove tags, and to update tag values


name: elasticbeanstalk:ValidateConfigurationSettings
access_level: Read
description:
Grants permission to check the validity of a set of configuration settings for a configuration template or an environment


name: es:DescribeDomainAutoTunes
access_level: Read
description:
Grants permission to view the AutoTune configuration of the domain for the specified Amazon OpenSearch domain, including the AutoTune state and maintenance schedules


name: fsx:DeleteVolume
access_level: Write
description:
Grants permission to delete a volume, deleting its contents and any existing automatic backups of the volume.


name: fsx:DescribeStorageVirtualMachines
access_level: Read
description:
Grants permission to return the descriptions of all storage virtual machines owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DescribeVolumes
access_level: Read
description:
Grants permission to return the descriptions of all volumes owned by your AWS account in the AWS Region of the endpoint that you're calling


name: kms:CreateAlias
access_level: Write
description:
Controls permission to create an alias for an AWS KMS key. Aliases are optional friendly names that you can associate with KMS keys


name: kms:CreateGrant
access_level: Permissions management
description:
Controls permission to add a grant to an AWS KMS key. You can use grants to add permissions without changing the key policy or IAM policy


name: kms:CreateKey
access_level: Write
description:
Controls permission to create an AWS KMS key that can be used to protect data keys and other sensitive information


name: kms:DeleteAlias
access_level: Write
description:
Controls permission to delete an alias. Aliases are optional friendly names that you can associate with AWS KMS keys


name: kms:DeleteImportedKeyMaterial
access_level: Write
description:
Controls permission to delete cryptographic material that you imported into an AWS KMS key. This action makes the key unusable


name: kms:DisableKey
access_level: Write
description:
Controls permission to disable an AWS KMS key, which prevents it from being used in cryptographic operations


name: kms:EnableKey
access_level: Write
description:
Controls permission to change the state of an AWS KMS key to enabled. This allows the KMS key to be used in cryptographic operations


name: kms:GenerateDataKey
access_level: Write
description:
Controls permission to use the AWS KMS key to generate data keys. You can use the data keys to encrypt data outside of AWS KMS


name: kms:GenerateDataKeyPairWithoutPlaintext
access_level: Write
description:
Controls permission to use the AWS KMS key to generate data key pairs. Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy


name: kms:GenerateDataKeyWithoutPlaintext
access_level: Write
description:
Controls permission to use the AWS KMS key to generate a data key. Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key


name: kms:ListAliases
access_level: List
description:
Controls permission to view the aliases that are defined in the account. Aliases are optional friendly names that you can associate with AWS KMS keys


name: kms:ListKeys
access_level: List
description:
Controls permission to view the key ID and Amazon Resource Name (ARN) of all AWS KMS keys in the account


name: kms:UpdateAlias
access_level: Write
description:
Controls permission to associate an alias with a different AWS KMS key. An alias is an optional friendly name that you can associate with a KMS key


name: mediatailor:CreateVodSource
access_level: Write
description:
Grants permission to create a new VOD source on the source location with the specified source location name


name: mediatailor:DeleteProgram
access_level: Write
description:
Grants permission to delete the program with the specified program name on the channel with the specified channel name


name: mediatailor:DeleteVodSource
access_level: Write
description:
Grants permission to delete the VOD source with the specified VOD source name on the source location with the specified source location name


name: mediatailor:DescribeProgram
access_level: Read
description:
Grants permission to retrieve the program with the specified program name on the channel with the specified channel name


name: mediatailor:DescribeVodSource
access_level: Read
description:
Grants permission to retrieve the VOD source with the specified VOD source name on the source location with the specified source location name


name: mediatailor:GetChannelSchedule
access_level: Read
description:
Grants permission to retrieve the schedule of programs on the channel with the specified channel name


name: mediatailor:ListVodSources
access_level: Read
description:
Grants permission to retrieve the list of existing VOD sources on the source location with the specified source location name


name: mediatailor:UpdateVodSource
access_level: Write
description:
Grants permission to update the VOD source with the specified VOD source name on the source location with the specified source location name


name: s3:GetMultiRegionAccessPointPolicy
access_level: Read
description:
Grants permission to returns the access point policy associated with the specified multi region access point


name: sagemaker:InvokeEndpointAsync
access_level: Read
description:
Grants permission to get inferences from the hosted model at the specified endpoint in an asynchronous manner


name: snowball:CreateLongTermPricing
access_level: Write
description:
Grants permission to creates a LongTermPricingListEntry for allowing customers to add an upfront billing contract for a job


name: sqs:DeleteQueue
access_level: Write
description:
Grants permission to delete the queue specified by the queue URL, regardless of whether the queue is empty


name: sqs:ListDeadLetterSourceQueues
access_level: Read
description:
Grants permission to return a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue


name: sqs:ReceiveMessage
access_level: Read
description:
Grants permission to retrieve one or more messages, with a maximum limit of 10 messages, from the specified queue


name: sqs:RemovePermission
access_level: Permissions management
description:
Grants permission to revoke any permissions in the queue policy that matches the specified Label parameter


name: textract:AnalyzeDocument
access_level: Read
description:
Grants permission to detect instances of real-world document entities within an image provided as input


name: textract:StartDocumentAnalysis
access_level: Write
description:
Grants permission to start an asynchronous job to detect instances of real-world document entities within an image or pdf provided as input


name: cloudformation:ActivateType
access_level: Write
description:
Grants permission to activate a public third-party extension, making it available for use in stack templates


name: cloudformation:DeactivateType
access_level: Write
description:
Grants permission to deactivate a public extension that was previously activated in this account and region


name: cloudformation:PublishType
access_level: Write
description:
Grants permission to publish the specified extension to the CloudFormation registry as a public extension in this region


name: cloudformation:RegisterPublisher
access_level: Write
description:
Grants permission to register account as a publisher of public extensions in the CloudFormation registry


name: cloudformation:SetTypeConfiguration
access_level: Write
description:
Grants permission to set the configuration data for a registered CloudFormation extension, in the given account and region


name: cloudformation:TestType
access_level: Write
description:
Grants permission to test a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry


name: ebs:CompleteSnapshot
access_level: Write
description:
Grants permission to seal and complete the snapshot after all of the required blocks of data have been written to it


name: es:AcceptInboundCrossClusterSearchConnection
access_level: Write
description:
Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request. This permission is deprecated. Use AcceptInboundConnection instead


name: es:CancelElasticsearchServiceSoftwareUpdate
access_level: Write
description:
Grants permission to cancel a service software update of a domain. This permission is deprecated. Use CancelServiceSoftwareUpdate instead


name: es:CreateElasticsearchDomain
access_level: Write
description:
Grants permission to create an OpenSearch Service domain. This permission is deprecated. Use CreateDomain instead


name: es:CreateElasticsearchServiceRole
access_level: Write
description:
Grants permission to create the service-linked role required for OpenSearch Service domains that use VPC access. This permission is deprecated. OpenSearch Service creates the service-linked role for you


name: es:CreateOutboundCrossClusterSearchConnection
access_level: Write
description:
Grants permission to create a new cross-cluster search connection from a source domain to a destination domain. This permission is deprecated. Use CreateOutboundConnection instead


name: es:CreateServiceRole
access_level: Write
description:
Grants permission to create the service-linked role required for Amazon OpenSearch Service domains that use VPC access


name: es:DeleteElasticsearchDomain
access_level: Write
description:
Grants permission to delete an OpenSearch Service domain and all of its data. This permission is deprecated. Use DeleteDomain instead


name: es:DeleteElasticsearchServiceRole
access_level: Write
description:
Grants permission to delete the service-linked role required for OpenSearch Service domains that use VPC access. This permission is deprecated. Use the IAM API to delete service-linked roles


name: es:DeleteInboundCrossClusterSearchConnection
access_level: Write
description:
Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection. This permission is deprecated. Use DeleteInboundConnection instead


name: es:DeleteOutboundCrossClusterSearchConnection
access_level: Write
description:
Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection. This permission is deprecated. Use DeleteOutboundConnection instead


name: es:DeletePackage
access_level: Write
description:
Grants permission to delete a package from OpenSearch Service. The package cannot be associated with any domains


name: es:DescribeDomain
access_level: Read
description:
Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN


name: es:DescribeDomainAutoTunes
access_level: Read
description:
Grants permission to view the Auto-Tune configuration of the domain for the specified OpenSearch Service domain, including the Auto-Tune state and maintenance schedules


name: es:DescribeDomainConfig
access_level: Read
description:
Grants permission to view a description of the configuration options and status of an OpenSearch Service domain


name: es:DescribeDomains
access_level: List
description:
Grants permission to view a description of the domain configuration for up to five specified OpenSearch Service domains


name: es:DescribeElasticsearchDomain
access_level: Read
description:
Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN. This permission is deprecated. Use DescribeDomain instead


name: es:DescribeElasticsearchDomainConfig
access_level: Read
description:
Grants permission to view a description of the configuration and status of an OpenSearch Service domain. This permission is deprecated. Use DescribeDomainConfig instead.s


name: es:DescribeElasticsearchDomains
access_level: List
description:
Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domains. This permission is deprecated. Use DescribeDomains instead


name: es:DescribeElasticsearchInstanceTypeLimits
access_level: List
description:
Grants permission to view the instance count, storage, and master node limits for a given OpenSearch version and instance type. This permission is deprecated. Use DescribeInstanceTypeLimits instead


name: es:DescribeInboundCrossClusterSearchConnections
access_level: List
description:
Grants permission to list all the inbound cross-cluster search connections for a destination domain. This permission is deprecated. Use DescribeInboundConnections instead


name: es:DescribeInstanceTypeLimits
access_level: List
description:
Grants permission to view the instance count, storage, and master node limits for a given engine version and instance type


name: es:DescribeOutboundCrossClusterSearchConnections
access_level: List
description:
Grants permission to list all the outbound cross-cluster search connections for a source domain. This permission is deprecated. Use DescribeOutboundConnections instead


name: es:DescribeReservedElasticsearchInstanceOfferings
access_level: List
description:
Grants permission to fetch Reserved Instance offerings for Amazon OpenSearch Service. This permission is deprecated. Use DescribeReservedInstanceOfferings instead


name: es:DescribeReservedElasticsearchInstances
access_level: List
description:
Grants permission to fetch OpenSearch Service Reserved Instances that have already been purchased. This permission is deprecated. Use DescribeReservedInstances instead


name: es:GetCompatibleElasticsearchVersions
access_level: List
description:
Grants permission to fetch a list of compatible OpenSearch and Elasticsearch versions to which an OpenSearch Service domain can be upgraded. This permission is deprecated. Use GetCompatibleVersions instead


name: es:GetCompatibleVersions
access_level: List
description:
Grants permission to fetch list of compatible engine versions to which an OpenSearch Service domain can be upgraded


name: es:ListElasticsearchInstanceTypeDetails
access_level: List
description:
Grants permission to list all instance types and available features for a given OpenSearch version. This permission is deprecated. Use ListInstanceTypeDetails instead


name: es:ListElasticsearchVersions
access_level: List
description:
Grants permission to list all supported OpenSearch versions on Amazon OpenSearch Service. This permission is deprecated. Use ListVersions instead


name: es:ListInstanceTypeDetails
access_level: List
description:
Grants permission to list all instance types and available features for a given OpenSearch or Elasticsearch version


name: es:ListVersions
access_level: List
description:
Grants permission to list all supported OpenSearch and Elasticsearch versions in Amazon OpenSearch Service


name: es:PurchaseReservedElasticsearchInstanceOffering
access_level: Write
description:
Grants permission to purchase OpenSearch Service Reserved Instances. This permission is deprecated. Use PurchaseReservedInstanceOffering instead


name: es:RejectInboundCrossClusterSearchConnection
access_level: Write
description:
Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request. This permission is deprecated. Use RejectInboundConnection instead


name: es:StartElasticsearchServiceSoftwareUpdate
access_level: Write
description:
Grants permission to start a service software update of a domain. This permission is deprecated. Use StartServiceSoftwareUpdate instead


name: es:UpdateDomainConfig
access_level: Write
description:
Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances


name: es:UpdateElasticsearchDomainConfig
access_level: Write
description:
Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances. This permission is deprecated. Use UpdateDomainConfig instead


name: es:UpgradeElasticsearchDomain
access_level: Write
description:
Grants permission to initiate upgrade of an OpenSearch Service domain to a specified version. This permission is deprecated. Use UpgradeDomain instead


name: wisdom:NotifyRecommendationsReceived
access_level: Write
description:
Grants permission to remove the specified recommendations from the specified assistant's queue of newly available recommendations


name: wisdom:SearchContent
access_level: Read
description:
Grants permission to search for content referencing a specified knowledge base. Can be used to get a specific content resource by its name


name: wisdom:SearchSessions
access_level: Read
description:
Grants permission to search for sessions referencing a specified assistant. Can be used to et a specific session resource by its name


name: aws-marketplace:AcceptAgreementApprovalRequest
access_level: Write
description:
Grants permission to users to approve an incoming subscription request (for providers who provide products that require subscription verification)


name: aws-marketplace:CancelAgreementRequest
access_level: Write
description:
Grants permission to users to cancel pending subscription requests for products that require subscription verification


name: aws-marketplace:GetAgreementApprovalRequest
access_level: Read
description:
Grants permission to users to view the details of their incoming subscription requests (for providers who provide products that require subscription verification)


name: aws-marketplace:GetAgreementRequest
access_level: Read
description:
Grants permission to users to view the details of their subscription requests for data products that require subscription verification


name: aws-marketplace:ListAgreementApprovalRequests
access_level: List
description:
Grants permission to users to list their incoming subscription requests (for providers who provide products that require subscription verification)


name: aws-marketplace:ListAgreementRequests
access_level: List
description:
Grants permission to users to list their subscription requests for products that require subscription verification


name: aws-marketplace:RejectAgreementApprovalRequest
access_level: Write
description:
Grants permission to users to decline an incoming subscription requests (for providers who provide products that require subscription verification)


name: aws-marketplace:Subscribe
access_level: Write
description:
Grants permission to users to subscribe to AWS Marketplace products. Includes the ability to send a subscription request for products that require subscription verification. Includes the ability to enable auto-renewal for an existing subscription


name: aws-marketplace:Unsubscribe
access_level: Write
description:
Grants permission to users to remove subscriptions to AWS Marketplace products. Includes the ability to disable auto-renewal for an existing subscription


name: aws-marketplace:UpdateAgreementApprovalRequest
access_level: Write
description:
Grants permission to users to make changes to an incoming subscription request, including the ability to delete the prospective subscriber's information (for providers who provide products that require subscription verification)


name: ec2:GetVpnConnectionDeviceSampleConfiguration
access_level: List
description:
Grants permission to download an AWS-provided sample configuration file to be used with the customer gateway device


name: ec2:GetVpnConnectionDeviceTypes
access_level: List
description:
Grants permission to obtain a list of customer gateway devices for which sample configuration files can be provided


name: elasticmapreduce:DescribeCluster
access_level: Read
description:
Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on


name: elasticmapreduce:DescribeEditor
access_level: Read
description:
Grants permission to view information about a notebook, including status, user, role, tags, location, and more


name: elasticmapreduce:DescribeJobFlows
access_level: Read
description:
Grants permission to describe details of clusters (job flows). This API is deprecated and will eventually be removed. We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead


name: elasticmapreduce:DescribeReleaseLabel
access_level: Read
description:
Grants permission to view information about an EMR release, such as which applications are supported


name: elasticmapreduce:GetBlockPublicAccessConfiguration
access_level: Read
description:
Grants permission to retrieve the EMR block public access configuration for the AWS account in the Region


name: elasticmapreduce:ListSecurityConfigurations
access_level: List
description:
Grants permission to list available security configurations in this account by name, along with creation dates and times


name: elasticmapreduce:ModifyCluster
access_level: Write
description:
Grants permission to change cluster settings such as number of steps that can be executed concurrently for a cluster


name: elasticmapreduce:PutAutoScalingPolicy
access_level: Write
description:
Grants permission to create or update an automatic scaling policy for a core instance group or task instance group


name: elasticmapreduce:PutBlockPublicAccessConfiguration
access_level: Permissions management
description:
Grants permission to create or update the EMR block public access configuration for the AWS account in the Region


name: lakeformation:GetDataLakeSettings
access_level: Read
description:
Grants permission to retrieve data lake settings such as the list of data lake administrators and database and table default permissions


name: lakeformation:PutDataLakeSettings
access_level: Permissions management
description:
Grants permission to overwrite data lake settings such as the list of data lake administrators and database and table default permissions


name: migrationhub-strategy:GetAntiPattern
access_level: Read
description:
Grants permission to get details of each anti pattern that collector should look at in a customer's environment


name: migrationhub-strategy:GetApplicationComponentStrategies
access_level: Read
description:
Grants permission to get a list of all recommended strategies and tools for an application running in a server


name: migrationhub-strategy:GetPortfolioSummary
access_level: Read
description:
Grants permission to retrieve overall summary (number-of servers to rehost etc as well as overall number of anti patterns)


name: migrationhub-strategy:ListAntiPatterns
access_level: List
description:
Grants permission to get a list of all anti patterns that collector should look for in a customer's environment


name: migrationhub-strategy:RegisterCollector
access_level: Write
description:
Grants permission to register the collector to receive an ID and to start receiving messages from the service


name: migrationhub-strategy:StartAssessment
access_level: Write
description:
Grants permission to start assessment in a customer's environment (collect data from all servers and provide recommendations)


name: appstream:CreateAppBlock
access_level: Write
description:
Grants permission to create an app block. App blocks store details about the virtual hard disk that contains the files for the application in an S3 bucket. It also stores the setup script with details about how to mount the virtual hard disk. App blocks are only supported for Elastic fleets


name: appstream:CreateApplication
access_level: Write
description:
Grants permission to create an application within customer account. Applications store the details about how to launch applications on streaming instances. This is only supported for Elastic fleets


name: appstream:DescribeAppBlocks
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified app blocks, if the app block arns are provided. Otherwise, all app blocks in the account are described


name: appstream:DescribeApplicationFleetAssociations
access_level: Read
description:
Grants permission to retrieve the associations that are associated with the specified application or fleet


name: appstream:DescribeApplications
access_level: Read
description:
Grants permission to retrieve a list that describes one or more specified applications, if the application arns are provided. Otherwise, all applications in the account are described


name: appstream:TagResource
access_level: Tagging
description:
Grants permission to add or overwrite one or more tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, stacks, app blocks and applications


name: auditmanager:ListAssessmentControlInsightsByControlDomain
access_level: List
description:
Grants permission to list analytics data for controls in a specific control domain and active assessment


name: auditmanager:ListAssessmentFrameworkShareRequests
access_level: List
description:
Grants permission to list all sent or received share requests for custom frameworks in AWS Audit Manager


name: auditmanager:ListControlInsightsByControlDomain
access_level: List
description:
Grants permission to list analytics data for controls in a specific control domain across all active assessments


name: braket:ListTagsForResource
access_level: Read
description:
Grants permission to listing the tags that have been applied to the quantum task resource or the job


name: braket:UntagResource
access_level: Tagging
description:
Grants permission to remove one or more tags from a quantum task resource or a job. A tag consists of a key-value pair


name: codebuild:CreateReport
access_level: Write
description:
Creates a report. A report is created when tests specified in the buildspec file for a report groups run during the build of a project


name: codebuild:CreateWebhook
access_level: Write
description:
For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables AWS CodeBuild to start rebuilding the source code every time a code change is pushed to the repository


name: codebuild:DeleteOAuthToken
access_level: Write
description:
Deletes an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console


name: codebuild:DeleteWebhook
access_level: Write
description:
For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops AWS CodeBuild from rebuilding the source code every time a code change is pushed to the repository


name: codebuild:ImportSourceCredentials
access_level: Write
description:
Imports the source repository credentials for an AWS CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository


name: codebuild:ListBuildBatchesForProject
access_level: List
description:
Gets a list of build batch IDs for the specified build project, with each build batch ID representing a single build batch


name: codebuild:ListBuildsForProject
access_level: List
description:
Gets a list of build IDs for the specified build project, with each build ID representing a single build


name: codebuild:ListProjects
access_level: List
description:
Gets a list of build project names, with each build project name representing a single build project


name: codebuild:ListReportsForReportGroup
access_level: List
description:
Returns a list of report ARNs that belong to the specified report group. Each report ARN represents one report


name: codebuild:ListRepositories
access_level: List
description:
Lists source code repositories from a connected third-party OAuth provider. Only used in the AWS CodeBuild console


name: codebuild:ListSharedProjects
access_level: List
description:
Returns a list of project ARNs that have been shared with the requester. Each project ARN represents one project


name: codebuild:ListSharedReportGroups
access_level: List
description:
Returns a list of report group ARNs that have been shared with the requester. Each report group ARN represents one report group


name: codebuild:PersistOAuthToken
access_level: Write
description:
Saves an OAuth token from a connected third-party OAuth provider. Only used in the AWS CodeBuild console


name: connect:DeleteInstance
access_level: Write
description:
Grants permission to delete an Amazon Connect instance. When you remove an instance, the link to an existing AWS directory is also removed


name: connect:DeleteIntegrationAssociation
access_level: Write
description:
Grants permission to delete an integration association from an Amazon Connect instance. The association must not have any use cases associated with it


name: connect:DescribeInstance
access_level: Read
description:
Grants permission to view details of an Amazon Connect instance and is also required to create an instance


name: connect:DescribeInstanceStorageConfig
access_level: Read
description:
Grants permission to view the instance storage configuration for an existing Amazon Connect instance


name: connect:DisassociateCustomerProfilesDomain
access_level: Write
description:
Grants permission to disassociate a Customer Profiles domain for an existing Amazon Connect instance


name: connect:GetFederationToken
access_level: Read
description:
Grants permission to federate into an Amazon Connect instance when using SAML-based authentication for identity management


name: connect:GetFederationTokens
access_level: Write
description:
Grants permission to federate into an Amazon Connect instance (Log in for emergency access functionality in the Amazon Connect console)


name: connect:ListIntegrationAssociations
access_level: List
description:
Grants permission to list summary information about the integration associations for the specified Amazon Connect instance


name: connect:ListSecurityProfilePermissions
access_level: List
description:
Grants permission to list permissions associated with security profile in an Amazon Connect instance


name: connect:StopContact
access_level: Write
description:
Grants permission to stop contacts that were initiated using the Amazon Connect API. If you use this operation on an active contact the contact ends, even if the agent is active on a call with a customer


name: connect:UpdateContactFlowName
access_level: Write
description:
Grants permission to update the name and description of a contact flow in an Amazon Connect instance


name: connect:UpdateContactSchedule
access_level: Write
description:
Grants permission to update the schedule of a contact that is already scheduled in an Amazon Connect instance


name: devops-guru:DescribeOrganizationResourceCollectionHealth
access_level: Read
description:
Grants permission to view the health of operations for each AWS CloudFormation stack or AWS Services or accounts specified in DevOps Guru in your organization


name: directconnect:AcceptDirectConnectGatewayAssociationProposal
access_level: Write
description:
Grants permission to accept a proposal request to attach a virtual private gateway to a Direct Connect gateway


name: directconnect:AllocateHostedConnection
access_level: Write
description:
Grants permission to create a new hosted connection between a AWS Direct Connect partner's network and a specific AWS Direct Connect location


name: directconnect:AssociateHostedConnection
access_level: Write
description:
Grants permission to associate a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect


name: directconnect:AssociateVirtualInterface
access_level: Write
description:
Grants permission to associate a virtual interface with a specified link aggregation group (LAG) or connection


name: directconnect:ConfirmCustomerAgreement
access_level: Write
description:
Grants permission to confirm the the terms of agreement when creating the connection or link aggregation group (LAG)


name: directconnect:CreateConnection
access_level: Write
description:
Grants permission to create a new connection between the customer network and a specific AWS Direct Connect location


name: directconnect:CreateDirectConnectGateway
access_level: Write
description:
Grants permission to create a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways


name: directconnect:CreateDirectConnectGatewayAssociation
access_level: Write
description:
Grants permission to create an association between a Direct Connect gateway and a virtual private gateway


name: directconnect:CreateDirectConnectGatewayAssociationProposal
access_level: Write
description:
Grants permission to create a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway


name: directconnect:CreateInterconnect
access_level: Write
description:
Grants permission to create a new interconnect between a AWS Direct Connect partner's network and a specific AWS Direct Connect location


name: directconnect:CreateLag
access_level: Write
description:
Grants permission to create a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific AWS Direct Connect location


name: directconnect:DeleteBGPPeer
access_level: Write
description:
Grants permission to delete the specified BGP peer on the specified virtual interface with the specified customer address and ASN


name: directconnect:DeleteDirectConnectGatewayAssociation
access_level: Write
description:
Grants permission to delete the association between the specified Direct Connect gateway and virtual private gateway


name: directconnect:DeleteDirectConnectGatewayAssociationProposal
access_level: Write
description:
Grants permission to delete the association proposal request between the specified Direct Connect gateway and virtual private gateway


name: directconnect:DescribeConnectionsOnInterconnect
access_level: Read
description:
Grants permission to describe a list of connections that have been provisioned on the given interconnect


