diff --git a/moto/iam/aws_managed_policies.py b/moto/iam/aws_managed_policies.py index d40a2e9b14f7..f011eefb86e2 100644 --- a/moto/iam/aws_managed_policies.py +++ b/moto/iam/aws_managed_policies.py @@ -3,9 +3,18 @@ { "AIDevOpsAgentAccessPolicy":{ "CreateDate":"2026-03-26T03:42:09+00:00", - "DefaultVersionId":"v4", + "DefaultVersionId":"v9", "Document":{ "Statement":[ + { + "Action":[ + "cloudtrail:StartQuery", + "support:CreateCase" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AIOPSServiceWriteAccess" + }, { "Action":[ "access-analyzer:GetAnalyzer", @@ -17,7 +26,16 @@ "acm-pca:List*", "acm:DescribeCertificate", "acm:GetAccountConfiguration", + "acm:GetCertificate", + "acm:ListCertificates", + "aidevops:GetAsset", + "aidevops:GetAssetContent", + "aidevops:GetAssetFile", "aidevops:GetKnowledgeItem", + "aidevops:ListAssetFiles", + "aidevops:ListAssets", + "aidevops:ListAssetTypes", + "aidevops:ListAssetVersions", "aidevops:ListKnowledgeItems", "airflow:List*", "amplify:GetApp", @@ -87,16 +105,24 @@ "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:List*", + "bcm-data-exports:Get*", + "bcm-data-exports:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", + "bedrock:GetCustomModel", "bedrock:GetDataSource", + "bedrock:GetFoundationModel", "bedrock:GetGuardrail", + "bedrock:GetInferenceProfile", "bedrock:GetKnowledgeBase", + "bedrock:GetModelInvocationLoggingConfiguration", + "bedrock:GetProvisionedModelThroughput", "bedrock:List*", "budgets:Describe*", "budgets:List*", + "budgets:ViewBudget", "ce:Describe*", "ce:Get*", "ce:List*", @@ -144,7 +170,6 @@ "cloudtrail:GetTrailStatus", "cloudtrail:List*", "cloudtrail:LookupEvents", - "cloudtrail:StartQuery", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:GetDashboard", @@ -214,6 +239,8 @@ "connect:Describe*", "connect:GetTaskTemplate", "connect:List*", + "cur:Describe*", + "cur:Get*", "databrew:Describe*", "databrew:List*", "datapipeline:Describe*", @@ -242,6 +269,15 @@ "devops-guru:Describe*", "devops-guru:GetResourceCollection", "devops-guru:List*", + "directconnect:DescribeConnections", + "directconnect:DescribeDirectConnectGatewayAssociations", + "directconnect:DescribeDirectConnectGatewayAttachments", + "directconnect:DescribeDirectConnectGateways", + "directconnect:DescribeHostedConnections", + "directconnect:DescribeInterconnects", + "directconnect:DescribeLags", + "directconnect:DescribeTags", + "directconnect:DescribeVirtualInterfaces", "dms:Describe*", "dms:List*", "ds:Describe*", @@ -250,6 +286,9 @@ "dynamodb:List*", "ec2:Describe*", "ec2:GetAssociatedEnclaveCertificateIamRoles", + "ec2:GetCapacityManagerAttributes", + "ec2:GetCapacityManagerMetricData", + "ec2:GetCapacityManagerMonitoredTagKeys", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", @@ -328,15 +367,32 @@ "gamelift:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", + "glue:BatchGetJobs", + "glue:GetClassifier", + "glue:GetClassifiers", + "glue:GetCrawler", + "glue:GetCrawlerMetrics", + "glue:GetCrawlers", "glue:GetDatabase", "glue:GetDatabases", + "glue:GetDataCatalogEncryptionSettings", "glue:GetJob", + "glue:GetJobBookmark", + "glue:GetJobRun", + "glue:GetJobRuns", + "glue:GetPartitions", "glue:GetRegistry", + "glue:GetResourcePolicy", "glue:GetSchema", "glue:GetSchemaVersion", "glue:GetTable", + "glue:GetTables", "glue:GetTags", "glue:GetTrigger", + "glue:GetSecurityConfiguration", + "glue:GetSecurityConfigurations", + "glue:GetWorkflow", + "glue:GetWorkflowRun", "glue:List*", "glue:querySchemaVersionMetadata", "grafana:Describe*", @@ -350,14 +406,14 @@ "groundstation:List*", "guardduty:GetDetector", "guardduty:GetFilter", + "guardduty:GetFindings", "guardduty:GetIPSet", "guardduty:GetMalwareProtectionPlan", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:List*", - "health:DescribeEvents", - "health:DescribeEventDetails", + "health:Describe*", "healthlake:Describe*", "healthlake:List*", "iam:GetGroup", @@ -374,11 +430,13 @@ "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetUser", "iam:GetUserPolicy", + "iam:ListAccountAliases", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", + "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", @@ -395,6 +453,7 @@ "imagebuilder:GetWorkflow", "imagebuilder:List*", "inspector2:List*", + "inspector2:SearchVulnerabilities", "inspector:Describe*", "inspector:List*", "internetmonitor:GetMonitor", @@ -497,6 +556,7 @@ "logs:GetDeliverySource", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", + "logs:GetLogEvents", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:List*", @@ -615,6 +675,7 @@ "rekognition:Describe*", "rekognition:List*", "resiliencehub:Describe*", + "resiliencehub:Get*", "resiliencehub:List*", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", @@ -679,6 +740,8 @@ "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", + "s3:GetIntelligentTieringConfiguration", + "s3:GetInventoryConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", @@ -706,6 +769,7 @@ "securityhub:GetConfigurationPolicyAssociation", "securityhub:GetEnabledStandards", "securityhub:GetFindingAggregator", + "securityhub:GetFindings", "securityhub:GetInsights", "securityhub:List*", "securitylake:GetSubscriber", @@ -714,8 +778,8 @@ "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", - "servicequotas:GetServiceQuota", - "servicequotas:ListServiceQuotas", + "servicequotas:Get*", + "servicequotas:List*", "ses:Describe*", "ses:GetAccount", "ses:GetAddonInstance", @@ -754,12 +818,15 @@ "ssm-sap:GetApplication", "ssm-sap:List*", "ssm:Describe*", + "ssm:GetCommandInvocation", "ssm:GetDefaultPatchBaseline", "ssm:GetDocument", "ssm:GetParameters", "ssm:GetPatchBaseline", "ssm:GetResourcePolicies", "ssm:List*", + "sso:DescribeAccountAssignmentCreationStatus", + "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:GetManagedApplicationInstance", "sso:GetPermissionsBoundaryForPermissionSet", @@ -770,11 +837,11 @@ "sso:ListCustomerManagedPolicyReferencesInPermissionSet", "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", + "sso:ListPermissionSets", "sso:ListTagsForResource", "states:GetExecutionHistory", "states:Describe*", "states:List*", - "support:CreateCase", "support:DescribeCases", "synthetics:Describe*", "synthetics:GetCanary", @@ -854,6 +921,7 @@ "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", + "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*" ], "Sid":"AIOPSAPIGatewayAccess" @@ -863,184 +931,147 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-11T21:12:21+00:00" + "UpdateDate":"2026-07-02T23:42:24+00:00" }, - "AIDevOpsAgentFullAccess":{ - "CreateDate":"2026-03-26T03:42:16+00:00", - "DefaultVersionId":"v2", + "AIDevOpsAgentActionsPolicy":{ + "CreateDate":"2026-06-23T22:27:27+00:00", + "DefaultVersionId":"v1", "Document":{ "Statement":[ { "Action":[ - "aidevops:CreateAgentSpace", - "aidevops:DeleteAgentSpace", - "aidevops:GetAgentSpace", - "aidevops:ListAgentSpaces", - "aidevops:UpdateAgentSpace" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsAgentSpaceAccess" - }, - { - "Action":[ - "aidevops:DeregisterService", - "aidevops:GetService", - "aidevops:ListServices", - "aidevops:RegisterService", - "aidevops:SearchServiceAccessibleResource" + "autoscaling:UpdateAutoScalingGroup", + "cloudformation:UpdateStack", + "cloudwatch:PutMetricAlarm", + "ec2:CreateTags", + "ec2:ModifyInstanceAttribute", + "ecs:UpdateService", + "elasticloadbalancing:ModifyTargetGroup", + "lambda:UpdateFunctionConfiguration", + "logs:PutMetricFilter", + "rds:ModifyDBInstance" ], "Effect":"Allow", "Resource":"*", - "Sid":"AIDevOpsServiceAccess" - }, + "Sid":"AIDevOpsMutativeAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-23T22:27:27+00:00" + }, + "AIDevOpsAgentFullAccess":{ + "CreateDate":"2026-03-26T03:42:16+00:00", + "DefaultVersionId":"v6", + "Document":{ + "Statement":[ { "Action":[ + "aidevops:AllowVendedLogDeliveryForResource", "aidevops:AssociateService", - "aidevops:DisassociateService", - "aidevops:GetAssociation", - "aidevops:ListAssociations", - "aidevops:UpdateAssociation", - "aidevops:ValidateAwsAssociations" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsAssociationAccess" - }, - { - "Action":[ - "aidevops:ListWebhooks" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsWebhookAccess" - }, - { - "Action":[ - "aidevops:DisableOperatorApp", - "aidevops:EnableOperatorApp", - "aidevops:GetOperatorApp", - "aidevops:UpdateOperatorAppIdpConfig" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsOperatorAppAccess" - }, - { - "Action":[ + "aidevops:CreateAccessToken", + "aidevops:CreateAgentSpace", + "aidevops:CreateAsset", + "aidevops:CreateAssetFile", + "aidevops:CreateBacklogTask", + "aidevops:CreateChat", "aidevops:CreateKnowledgeItem", + "aidevops:CreateOneTimeLoginSession", + "aidevops:CreatePrivateConnection", + "aidevops:CreateTrigger", + "aidevops:DeleteAgentSpace", + "aidevops:DeleteAsset", + "aidevops:DeleteAssetFile", "aidevops:DeleteKnowledgeItem", - "aidevops:GetKnowledgeItem", - "aidevops:ListKnowledgeItems", - "aidevops:ListKnowledgeItemVersions", - "aidevops:UpdateKnowledgeItem" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsKnowledgeAccess" - }, - { - "Action":[ - "aidevops:CreateBacklogTask", + "aidevops:DeletePrivateConnection", + "aidevops:DeleteTrigger", + "aidevops:DeregisterService", + "aidevops:DescribePrivateConnection", + "aidevops:DescribeServices", + "aidevops:DescribeSupportLevel", + "aidevops:DisableOperatorApp", + "aidevops:DisassociateService", + "aidevops:DiscoverTopology", + "aidevops:EnableOperatorApp", + "aidevops:EndChatForCase", + "aidevops:GetAccessToken", + "aidevops:GetAccountUsage", + "aidevops:GetAgentSpace", + "aidevops:GetAsset", + "aidevops:GetAssetContent", + "aidevops:GetAssetFile", + "aidevops:GetAssociation", "aidevops:GetBacklogTask", - "aidevops:ListBacklogTasks", - "aidevops:ListGoals", - "aidevops:UpdateBacklogTask", - "aidevops:UpdateGoal" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsBacklogAccess" - }, - { - "Action":[ + "aidevops:GetKnowledgeItem", + "aidevops:GetOperatorApp", "aidevops:GetRecommendation", - "aidevops:ListRecommendations", - "aidevops:UpdateRecommendation" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsRecommendationAccess" - }, - { - "Action":[ - "aidevops:CreateChat", + "aidevops:GetService", + "aidevops:GetTrigger", + "aidevops:InitiateChatForCase", + "aidevops:ListAccessTokens", + "aidevops:ListAgentSpaces", + "aidevops:ListAssetFiles", + "aidevops:ListAssets", + "aidevops:ListAssetTypes", + "aidevops:ListAssetVersions", + "aidevops:ListAssociations", + "aidevops:ListBacklogTasks", "aidevops:ListChats", - "aidevops:ListPendingMessages", - "aidevops:SendMessage" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsAgentChatAccess" - }, - { - "Action":[ "aidevops:ListExecutions", - "aidevops:ListJournalRecords" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsJournalAccess" - }, - { - "Action":[ - "aidevops:DiscoverTopology" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsTopologyAccess" - }, - { - "Action":[ - "aidevops:DescribeServices", - "aidevops:DescribeSupportLevel", - "aidevops:EndChatForCase", - "aidevops:InitiateChatForCase" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsSupportAccess" - }, - { - "Action":[ - "aidevops:GetAccountUsage" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsUsageAccess" - }, - { - "Action":[ + "aidevops:ListGoals", + "aidevops:ListJournalRecords", + "aidevops:ListKnowledgeItems", + "aidevops:ListKnowledgeItemVersions", + "aidevops:ListPendingMessages", + "aidevops:ListPrivateConnections", + "aidevops:ListRecommendations", + "aidevops:ListServices", "aidevops:ListTagsForResource", + "aidevops:ListTriggers", + "aidevops:ListWebhooks", + "aidevops:RegisterService", + "aidevops:RevokeAccessToken", + "aidevops:RotateAccessToken", + "aidevops:SearchServiceAccessibleResource", + "aidevops:SendMessage", "aidevops:TagResource", - "aidevops:UntagResource" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"AIDevOpsTaggingAccess" - }, - { - "Action":[ - "aidevops:AllowVendedLogDeliveryForResource" + "aidevops:UntagResource", + "aidevops:UpdateAgentSpace", + "aidevops:UpdateApprovalAction", + "aidevops:UpdateAsset", + "aidevops:UpdateAssetFile", + "aidevops:UpdateAssociation", + "aidevops:UpdateBacklogTask", + "aidevops:UpdateGoal", + "aidevops:UpdateKnowledgeItem", + "aidevops:UpdateOperatorAppIdpConfig", + "aidevops:UpdatePrivateConnectionCertificate", + "aidevops:UpdateRecommendation", + "aidevops:UpdateTrigger", + "aidevops:ValidateAwsAssociations" ], "Effect":"Allow", "Resource":"*", - "Sid":"AIDevOpsVendedLogs" + "Sid":"AIDevOpsAgentAccess" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-11T21:12:21+00:00" + "UpdateDate":"2026-06-26T23:57:19+00:00" }, "AIDevOpsAgentReadOnlyAccess":{ "CreateDate":"2026-03-26T03:42:07+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { "Action":[ + "aidevops:DescribePrivateConnection", + "aidevops:DescribeServices", "aidevops:Get*", "aidevops:List*", "aidevops:SearchServiceAccessibleResource" @@ -1054,44 +1085,68 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-03-26T03:42:07+00:00" + "UpdateDate":"2026-06-11T00:57:11+00:00" }, "AIDevOpsOperatorAppAccessPolicy":{ "CreateDate":"2026-03-26T03:42:13+00:00", - "DefaultVersionId":"v4", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { "Action":[ + "aidevops:CreateAccessToken", + "aidevops:CreateAsset", + "aidevops:CreateAssetFile", + "aidevops:CreateBacklogTask", + "aidevops:CreateChat", + "aidevops:CreateKnowledgeItem", + "aidevops:CreateTrigger", + "aidevops:DeleteAsset", + "aidevops:DeleteAssetFile", + "aidevops:DeleteKnowledgeItem", + "aidevops:DeleteTrigger", + "aidevops:DescribeServices", + "aidevops:DescribeSupportLevel", + "aidevops:DiscoverTopology", + "aidevops:EndChatForCase", + "aidevops:GetAccessToken", "aidevops:GetAgentSpace", + "aidevops:GetAsset", + "aidevops:GetAssetContent", + "aidevops:GetAssetFile", "aidevops:GetAssociation", - "aidevops:ListAssociations", - "aidevops:CreateBacklogTask", "aidevops:GetBacklogTask", - "aidevops:UpdateBacklogTask", + "aidevops:GetKnowledgeItem", + "aidevops:GetRecommendation", + "aidevops:GetTrigger", + "aidevops:InitiateChatForCase", + "aidevops:ListAccessTokens", + "aidevops:ListAssetFiles", + "aidevops:ListAssets", + "aidevops:ListAssetTypes", + "aidevops:ListAssetVersions", + "aidevops:ListAssociations", "aidevops:ListBacklogTasks", - "aidevops:ListJournalRecords", - "aidevops:DiscoverTopology", - "aidevops:ListGoals", - "aidevops:UpdateGoal", - "aidevops:ListRecommendations", + "aidevops:ListChats", "aidevops:ListExecutions", - "aidevops:GetRecommendation", - "aidevops:UpdateRecommendation", - "aidevops:CreateKnowledgeItem", + "aidevops:ListGoals", + "aidevops:ListJournalRecords", "aidevops:ListKnowledgeItems", "aidevops:ListKnowledgeItemVersions", - "aidevops:GetKnowledgeItem", - "aidevops:UpdateKnowledgeItem", - "aidevops:DeleteKnowledgeItem", "aidevops:ListPendingMessages", - "aidevops:InitiateChatForCase", - "aidevops:EndChatForCase", - "aidevops:DescribeSupportLevel", - "aidevops:ListChats", - "aidevops:CreateChat", + "aidevops:ListRecommendations", + "aidevops:ListTriggers", + "aidevops:RevokeAccessToken", + "aidevops:RotateAccessToken", "aidevops:SendMessage", - "aidevops:DescribeServices" + "aidevops:UpdateApprovalAction", + "aidevops:UpdateAsset", + "aidevops:UpdateAssetFile", + "aidevops:UpdateBacklogTask", + "aidevops:UpdateGoal", + "aidevops:UpdateKnowledgeItem", + "aidevops:UpdateRecommendation", + "aidevops:UpdateTrigger" ], "Condition":{ "StringEquals":{ @@ -1144,13 +1199,26 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowSecretsManagerOperatorActions" + }, + { + "Action":[ + "transcribe:StartStreamTranscriptionWebSocket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowTranscribeOperatorActions" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-22T00:12:17+00:00" + "UpdateDate":"2026-06-26T23:57:22+00:00" }, "AIOpsAssistantIncidentReportPolicy":{ "CreateDate":"2025-10-10T22:04:07+00:00", @@ -3429,7 +3497,7 @@ }, "AWSAccountSettingsManagementRole":{ "CreateDate":"2025-12-11T17:49:09+00:00", - "DefaultVersionId":"v6", + "DefaultVersionId":"v7", "Document":{ "Statement":[ { @@ -3525,13 +3593,25 @@ ], "Effect":"Allow", "Resource":"*" + }, + { + "Action":[ + "support:CreateCase", + "support:DescribeServices", + "support:DescribeSeverityLevels", + "support:DescribeCases", + "support:AddCommunicationToCase", + "support:ResolveCase" + ], + "Effect":"Allow", + "Resource":"*" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:02:39+00:00" + "UpdateDate":"2026-07-08T19:12:27+00:00" }, "AWSAccountUsageReportAccess":{ "CreateDate":"2015-02-06T18:41:19+00:00", @@ -5646,7 +5726,7 @@ }, "AWSApplicationMigrationFullAccess":{ "CreateDate":"2021-04-07T06:56:05+00:00", - "DefaultVersionId":"v12", + "DefaultVersionId":"v13", "Document":{ "Statement":[ { @@ -5918,20 +5998,21 @@ "Condition":{ "ForAllValues:StringEquals":{ "aws:TagKeys":[ - "map-migrated" + "map-migrated", + "aws-apn-id" ] } }, "Effect":"Allow", "Resource":"arn:aws:fsx:*:*:storage-virtual-machine/*", - "Sid":"AllowTagSVMWithMapMigrated" + "Sid":"AllowTagSVMWithMapKeys" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-31T13:12:11+00:00" + "UpdateDate":"2026-07-23T07:27:10+00:00" }, "AWSApplicationMigrationMGHAccess":{ "CreateDate":"2021-04-07T07:10:01+00:00", @@ -5988,7 +6069,7 @@ }, "AWSApplicationMigrationNetworkMigrationMultiAccount":{ "CreateDate":"2025-11-10T09:04:09+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -6014,7 +6095,8 @@ "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", - "ec2:DescribeNetworkInterfaces" + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeAvailabilityZones" ], "Effect":"Allow", "Resource":[ @@ -6140,6 +6222,23 @@ "Resource":"arn:aws:cloudformation:*:*:stack/Nmd*", "Sid":"CFNCreate" }, + { + "Action":[ + "cloudformation:TagResource", + "cloudformation:UntagResource" + ], + "Condition":{ + "StringEquals":{ + "cloudformation:CreateAction":[ + "CreateStack", + "UpdateStack" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:cloudformation:*:*:stack/Nmd*", + "Sid":"CFNTagOnCreate" + }, { "Action":[ "cloudformation:DeleteStack", @@ -6642,10 +6741,8 @@ { "Action":[ "ssm:DeleteParameter", - "ssm:PutResourcePolicy", "ssm:DeleteResourcePolicy", - "ssm:ListTagsForResource", - "ssm:GetResourcePolicies" + "ssm:ListTagsForResource" ], "Condition":{ "ForAnyValue:StringEquals":{ @@ -6663,6 +6760,24 @@ ], "Sid":"deleteParameter" }, + { + "Action":[ + "ssm:PutResourcePolicy", + "ssm:GetResourcePolicies" + ], + "Condition":{ + "ForAnyValue:StringEquals":{ + "aws:CalledVia":[ + "cloudformation.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:parameter/network-migration/*" + ], + "Sid":"ramResourceSharing" + }, { "Action":[ "ram:TagResource" @@ -6680,7 +6795,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:ram:*:*:resource-share/*", - "Sid":"ramTAgReource" + "Sid":"ramTagResource" }, { "Action":[ @@ -6796,7 +6911,8 @@ }, { "Action":[ - "lambda:GetFunction" + "lambda:GetFunction", + "lambda:ListTags" ], "Condition":{ "ForAnyValue:StringEquals":{ @@ -7050,11 +7166,11 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:58:43+00:00" + "UpdateDate":"2026-07-30T07:42:10+00:00" }, "AWSApplicationMigrationReadOnlyAccess":{ "CreateDate":"2021-04-07T07:15:26+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -7095,13 +7211,20 @@ ], "Effect":"Allow", "Resource":"*" + }, + { + "Action":[ + "ssm:GetParameter" + ], + "Effect":"Allow", + "Resource":"*" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2023-03-20T08:58:08+00:00" + "UpdateDate":"2026-07-01T14:57:15+00:00" }, "AWSApplicationMigrationReplicationServerPolicy":{ "CreateDate":"2021-04-07T07:21:57+00:00", @@ -7313,7 +7436,7 @@ }, "AWSApplicationMigrationServiceRolePolicy":{ "CreateDate":"2021-04-07T06:43:20+00:00", - "DefaultVersionId":"v8", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { @@ -7602,7 +7725,8 @@ "CreateSecurityGroup", "CreateVolume", "CreateSnapshot", - "RunInstances" + "RunInstances", + "RegisterImage" ] } }, @@ -7613,7 +7737,8 @@ "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:snapshot/*", "arn:aws:ec2:*:*:network-interface/*", - "arn:aws:ec2:*:*:instance/*" + "arn:aws:ec2:*:*:instance/*", + "arn:aws:ec2:*:*:image/*" ] }, { @@ -7633,7 +7758,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:57:34+00:00" + "UpdateDate":"2026-07-19T15:12:24+00:00" }, "AWSApplicationMigrationVCenterClientPolicy":{ "CreateDate":"2021-11-08T12:53:08+00:00", @@ -7822,6 +7947,68 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T18:00:59+00:00" }, + "AWSArtifactComplianceInquiriesFullAccess":{ + "CreateDate":"2026-06-30T19:27:34+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "artifact:ListComplianceInquiries", + "artifact:CreateComplianceInquiry" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ListAndCreateComplianceInquiryActions" + }, + { + "Action":[ + "artifact:ListComplianceInquiryQueries", + "artifact:GetComplianceInquiryMetadata", + "artifact:ExportComplianceInquiry", + "artifact:PutComplianceInquiryFeedback" + ], + "Effect":"Allow", + "Resource":"arn:aws:artifact:*:*:compliance-inquiry/*", + "Sid":"ComplianceInquiryActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-23T20:12:25+00:00" + }, + "AWSArtifactComplianceInquiriesReadOnlyAccess":{ + "CreateDate":"2026-06-30T19:42:13+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "artifact:ListComplianceInquiries" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ListComplianceInquiryActions" + }, + { + "Action":[ + "artifact:GetComplianceInquiryMetadata", + "artifact:ListComplianceInquiryQueries", + "artifact:ExportComplianceInquiry" + ], + "Effect":"Allow", + "Resource":"arn:aws:artifact:*:*:compliance-inquiry/*", + "Sid":"GetComplianceInquiryActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-30T19:42:13+00:00" + }, "AWSArtifactReportsReadOnlyAccess":{ "CreateDate":"2024-01-02T22:42:58+00:00", "DefaultVersionId":"v7", @@ -8044,7 +8231,7 @@ }, "AWSAuditManagerServiceRolePolicy":{ "CreateDate":"2020-12-08T15:12:12+00:00", - "DefaultVersionId":"v10", + "DefaultVersionId":"v11", "Document":{ "Statement":[ { @@ -8191,6 +8378,7 @@ "es:ListDomainNames", "organizations:DescribeOrganization", "organizations:DescribePolicy", + "organizations:DescribeAccount", "rds:DescribeCertificates", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", @@ -8304,15 +8492,14 @@ ], "Condition":{ "ForAllValues:StringEquals":{ + "events:detail-type":"Security Hub Findings - Imported", "events:source":[ "aws.securityhub" ] }, "Null":{ + "events:detail-type":"false", "events:source":"false" - }, - "StringEquals":{ - "events:detail-type":"Security Hub Findings - Imported" } }, "Effect":"Allow", @@ -8338,7 +8525,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-09-24T23:22:25+00:00" + "UpdateDate":"2026-06-02T20:12:13+00:00" }, "AWSAutoScalingPlansEC2AutoScalingPolicy":{ "CreateDate":"2018-08-23T22:46:59+00:00", @@ -12344,7 +12531,7 @@ }, "AWSBillingReadOnlyAccess":{ "CreateDate":"2020-08-27T20:08:51+00:00", - "DefaultVersionId":"v27", + "DefaultVersionId":"v28", "Document":{ "Statement":[ { @@ -12398,6 +12585,8 @@ "invoicing:ListProcurementPortalPreferences", "invoicing:ListTagsForResource", "invoicing:ListInvoiceCorrections", + "invoicing:ListProcurementPortals", + "invoicing:ListProcurementPortalSuppliers", "mapcredits:ListQuarterSpend", "mapcredits:ListAssociatedPrograms", "mapcredits:ListQuarterCredits", @@ -12434,7 +12623,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T17:12:09+00:00" + "UpdateDate":"2026-07-30T22:12:29+00:00" }, "AWSBillingServiceRolePolicy":{ "CreateDate":"2025-09-11T16:19:07+00:00", @@ -12582,6 +12771,190 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-06-17T17:41:25+00:00" }, + "AWSBudgetsSpendLimitMemberRolePolicy":{ + "CreateDate":"2026-07-18T00:57:16+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:DescribeInstances", + "ec2:StopInstances", + "ec2:DescribeNatGateways", + "ec2:DescribeVpnGateways", + "ec2:DescribeAddresses", + "ec2:DescribeSnapshots", + "ec2:DescribeInstanceStatus" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2Actions" + }, + { + "Action":[ + "rds:DescribeDBInstances", + "rds:StopDBInstance", + "rds:DescribeDBClusters", + "rds:StopDBCluster", + "rds:CreateDBClusterSnapshot", + "rds:DescribeDBClusterSnapshots", + "rds:RestoreDBClusterFromSnapshot", + "rds:RestoreDBClusterToPointInTime", + "rds:DescribeIntegrations", + "rds:DescribeDBProxies" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"RDSActions" + }, + { + "Action":[ + "dsql:GetCluster", + "dsql:ListClusters" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"DSQLActions" + }, + { + "Action":[ + "sagemaker:DescribeNotebookInstance", + "sagemaker:ListNotebookInstances", + "sagemaker:StopNotebookInstance", + "sagemaker:StartNotebookInstance", + "sagemaker:DescribeApp", + "sagemaker:ListApps", + "sagemaker:DescribeTrainingJob", + "sagemaker:ListTrainingJobs", + "sagemaker:StopTrainingJob", + "sagemaker:DescribeProcessingJob", + "sagemaker:ListProcessingJobs", + "sagemaker:StopProcessingJob", + "sagemaker:DescribeTransformJob", + "sagemaker:ListTransformJobs", + "sagemaker:StopTransformJob", + "sagemaker:ListEndpoints", + "sagemaker:DescribeEndpointConfig", + "sagemaker:ListEndpointConfigs", + "sagemaker:DescribeCluster", + "sagemaker:ListClusters", + "sagemaker:DescribeClusterNode", + "sagemaker:ListClusterNodes", + "sagemaker:AttachClusterNodeVolume", + "sagemaker:DetachClusterNodeVolume", + "sagemaker:DescribeMlflowTrackingServer", + "sagemaker:ListMlflowTrackingServers", + "sagemaker:StopMlflowTrackingServer", + "sagemaker:StopLabelingJob", + "sagemaker:DescribeUserProfile" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SageMakerActions" + }, + { + "Action":[ + "lambda:GetFunctionConfiguration", + "lambda:ListFunctions", + "lambda:GetFunctionConcurrency", + "lambda:PutFunctionConcurrency", + "lambda:DeleteFunctionConcurrency", + "lambda:ListEventSourceMappings", + "lambda:GetEventSourceMapping", + "lambda:GetProvisionedConcurrencyConfig", + "lambda:ListProvisionedConcurrencyConfigs", + "lambda:PutProvisionedConcurrencyConfig", + "lambda:DeleteProvisionedConcurrencyConfig" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"LambdaActions" + }, + { + "Action":[ + "bedrock:GetProvisionedModelThroughput", + "bedrock:ListProvisionedModelThroughputs", + "bedrock:UpdateProvisionedModelThroughput", + "bedrock:GetModelInvocationJob", + "bedrock:ListModelInvocationJobs", + "bedrock:StopModelInvocationJob", + "bedrock:GetModelCustomizationJob", + "bedrock:ListModelCustomizationJobs", + "bedrock:StopModelCustomizationJob", + "bedrock:GetEvaluationJob", + "bedrock:ListEvaluationJobs", + "bedrock:StopEvaluationJob" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"BedrockActions" + }, + { + "Action":[ + "ssm:StartAutomationExecution", + "ssm:GetAutomationExecution", + "ssm:DescribeAutomationExecutions", + "ssm:DescribeAutomationStepExecutions", + "ssm:StopAutomationExecution" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:document/AWS-StartEC2Instance", + "arn:aws:ssm:*:*:document/AWS-StopEC2Instance", + "arn:aws:ssm:*:*:document/AWS-StartRdsInstance", + "arn:aws:ssm:*:*:document/AWS-StopRdsInstance", + "arn:aws:ssm:*:*:automation-execution/*", + "arn:aws:ssm:*:*:automation-definition/AWS-StartEC2Instance:*", + "arn:aws:ssm:*:*:automation-definition/AWS-StopEC2Instance:*", + "arn:aws:ssm:*:*:automation-definition/AWS-StartRdsInstance:*", + "arn:aws:ssm:*:*:automation-definition/AWS-StopRdsInstance:*" + ], + "Sid":"SSMAutomation" + }, + { + "Action":[ + "compute-optimizer:GetIdleRecommendations", + "compute-optimizer:GetRecommendationSummaries", + "compute-optimizer:GetEnrollmentStatus" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ComputeOptimizerActions" + }, + { + "Action":[ + "aco-automation:StartAutomationEvent", + "aco-automation:ListRecommendedActions", + "aco-automation:GetAutomationEvent" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ComputeOptimizerAutomationActions" + }, + { + "Action":[ + "sso:ListInstances" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SSOActions" + }, + { + "Action":[ + "account:GetAccountInformation", + "account:GetPrimaryEmail" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AccountActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-18T00:57:16+00:00" + }, "AWSBugBustFullAccess":{ "CreateDate":"2021-06-24T07:03:26+00:00", "DefaultVersionId":"v2", @@ -12934,7 +13307,7 @@ }, "AWSCertificateManagerReadOnly":{ "CreateDate":"2016-01-21T17:07:33+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":{ "Action":[ @@ -12943,7 +13316,16 @@ "acm:SearchCertificates", "acm:GetCertificate", "acm:ListTagsForCertificate", - "acm:GetAccountConfiguration" + "acm:GetAccountConfiguration", + "acm:DescribeAcmeAccount", + "acm:DescribeAcmeDomainValidation", + "acm:DescribeAcmeEndpoint", + "acm:DescribeAcmeExternalAccountBinding", + "acm:ListAcmeAccounts", + "acm:ListAcmeDomainValidations", + "acm:ListAcmeEndpoints", + "acm:ListAcmeExternalAccountBindings", + "acm:ListTagsForResource" ], "Effect":"Allow", "Resource":"*" @@ -12952,7 +13334,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-03-31T18:57:22+00:00" + "UpdateDate":"2026-06-30T16:57:20+00:00" }, "AWSChatbotServiceLinkedRolePolicy":{ "CreateDate":"2019-11-18T16:39:50+00:00", @@ -17058,16 +17440,18 @@ }, "AWSConfigServiceRolePolicy":{ "CreateDate":"2018-05-30T23:31:46+00:00", - "DefaultVersionId":"v93", + "DefaultVersionId":"v94", "Document":{ "Statement":[ { "Action":[ + "access-analyzer:CheckNoPublicAccess", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", + "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", @@ -17300,8 +17684,11 @@ "bedrock-agentcore:GetMemory", "bedrock-agentcore:GetOauth2CredentialProvider", "bedrock-agentcore:GetOnlineEvaluationConfig", + "bedrock-agentcore:GetPaymentManager", "bedrock-agentcore:GetPolicy", "bedrock-agentcore:GetPolicyEngine", + "bedrock-agentcore:GetPolicyEngineSummary", + "bedrock-agentcore:GetPolicySummary", "bedrock-agentcore:GetTokenVault", "bedrock-agentcore:GetWorkloadIdentity", "bedrock-agentcore:ListAgentRuntimeEndpoints", @@ -17315,8 +17702,11 @@ "bedrock-agentcore:ListMemories", "bedrock-agentcore:ListOauth2CredentialProviders", "bedrock-agentcore:ListOnlineEvaluationConfigs", + "bedrock-agentcore:ListPaymentManagers", "bedrock-agentcore:ListPolicies", "bedrock-agentcore:ListPolicyEngines", + "bedrock-agentcore:ListPolicyEngineSummaries", + "bedrock-agentcore:ListPolicySummaries", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:ListWorkloadIdentities", "bedrock:GetAgent", @@ -17347,6 +17737,7 @@ "bedrock:ListBlueprints", "bedrock:ListDataAutomationProjects", "bedrock:ListDataSources", + "bedrock:ListEnforcedGuardrailsConfiguration", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", @@ -18621,8 +19012,12 @@ "notifications:GetEventRule", "notifications:ListEventRules", "notifications:ListManagedNotificationChannelAssociations", + "notifications:ListNotificationConfigurations", "notifications:ListNotificationHubs", "notifications:ListOrganizationalUnits", + "notifications:ListTagsForResource", + "nova-act:GetWorkflowDefinition", + "nova-act:ListWorkflowDefinitions", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", @@ -18999,17 +19394,21 @@ "s3tables:GetTableBucketStorageClass", "s3tables:ListTableBuckets", "s3tables:ListTagsForResource", + "s3vectors:GetIndex", "s3vectors:GetVectorBucket", "s3vectors:GetVectorBucketPolicy", + "s3vectors:ListIndexes", "s3vectors:ListTagsForResource", "s3vectors:ListVectorBuckets", "sagemaker:DescribeAction", + "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeCluster", + "sagemaker:DescribeClusterSchedulerConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", @@ -19019,12 +19418,16 @@ "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", + "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHub", + "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceExperiment", + "sagemaker:DescribeLabelingJob", + "sagemaker:DescribeMlflowApp", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", @@ -19037,12 +19440,14 @@ "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", + "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSpace", "sagemaker:DescribeStudioLifecycleConfig", + "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", @@ -19050,11 +19455,13 @@ "sagemaker:DescribeWorkteam", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:ListActions", + "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAutoMLJobs", "sagemaker:ListClusters", + "sagemaker:ListClusterSchedulerConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", @@ -19064,12 +19471,16 @@ "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", + "sagemaker:ListFlowDefinitions", "sagemaker:ListHubs", + "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListInferenceExperiments", + "sagemaker:ListLabelingJobs", + "sagemaker:ListMlflowApps", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelCardExportJobs", @@ -19084,6 +19495,7 @@ "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", + "sagemaker:ListOptimizationJobs", "sagemaker:ListPartnerApps", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", @@ -19091,6 +19503,7 @@ "sagemaker:ListSpaces", "sagemaker:ListStudioLifecycleConfigs", "sagemaker:ListTags", + "sagemaker:ListTrainingJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", @@ -19438,7 +19851,54 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-05T22:42:19+00:00" + "UpdateDate":"2026-07-30T23:27:21+00:00" + }, + "AWSConfigThirdPartyServiceRolePolicy":{ + "CreateDate":"2026-06-22T17:57:23+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":"sts:GetWebIdentityToken", + "Condition":{ + "ForAnyValue:StringLike":{ + "sts:IdentityTokenAudience":[ + "api://AzureADTokenExchange" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowGetWebIdentityTokenByConfig" + }, + { + "Action":[ + "config:PutEvaluations", + "config:GetComplianceDetailsByConfigRule" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowConfigActionsForRules" + }, + { + "Action":[ + "cloudwatch:PutMetricData" + ], + "Condition":{ + "StringEquals":{ + "cloudwatch:namespace":"AWS/Config" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowCloudwatchActionsForMetrics" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-22T17:57:23+00:00" }, "AWSConfigUserAccess":{ "CreateDate":"2015-02-18T19:38:41+00:00", @@ -24574,6 +25034,274 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2017-02-21T22:50:30+00:00" }, + "AWSElasticBeanstalkEKSImageBuild":{ + "CreateDate":"2026-07-02T21:27:26+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "s3:GetObject", + "s3:GetObjectVersion" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::*/*" + ], + "Sid":"S3SourceAccess" + }, + { + "Action":[ + "ecr:GetAuthorizationToken" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ECRAuthToken" + }, + { + "Action":[ + "ecr-public:GetAuthorizationToken", + "sts:GetServiceBearerToken" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ECRPublicAuthToken" + }, + { + "Action":[ + "ecr:BatchCheckLayerAvailability", + "ecr:GetDownloadUrlForLayer", + "ecr:BatchGetImage", + "ecr:PutImage", + "ecr:InitiateLayerUpload", + "ecr:UploadLayerPart", + "ecr:CompleteLayerUpload" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ecr:*:*:repository/elasticbeanstalk-*", + "Sid":"ECRRepositoryAccess" + }, + { + "Action":[ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:logs:*:*:log-group:/aws/codebuild/elasticbeanstalk-*", + "Sid":"CloudWatchLogs" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-02T21:27:26+00:00" + }, + "AWSElasticBeanstalkEKSObservability":{ + "CreateDate":"2026-07-02T21:27:19+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "s3:PutObject", + "s3:ListBucket", + "s3:CreateBucket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::elasticbeanstalk-logs-*", + "arn:aws:s3:::elasticbeanstalk-logs-*/*" + ], + "Sid":"FluentBitS3Plugin" + }, + { + "Action":[ + "aps:CreateWorkspace", + "aps:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":"ElasticBeanstalk", + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"APSCreateWorkspace" + }, + { + "Action":[ + "aps:DeleteWorkspace", + "aps:Describe*" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/CreatedBy":"ElasticBeanstalk" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:aps:*:*:workspace/*", + "Sid":"APSManageWorkspace" + }, + { + "Action":[ + "aps:RemoteWrite" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/CreatedBy":"ElasticBeanstalk" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:aps:*:*:workspace/*", + "Sid":"APSRemoteWrite" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-02T21:27:19+00:00" + }, + "AWSElasticBeanstalkEKSTagging":{ + "CreateDate":"2026-07-02T21:27:19+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:CreateFleet", + "ec2:RunInstances", + "ec2:CreateLaunchTemplate" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + }, + "StringLike":{ + "aws:RequestTag/eks:kubernetes-node-class-name":"*", + "aws:RequestTag/eks:kubernetes-node-pool-name":"*" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"Compute" + }, + { + "Action":[ + "ec2:CreateVolume", + "ec2:CreateSnapshot" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:volume/*", + "arn:aws:ec2:*:*:snapshot/*" + ], + "Sid":"Storage" + }, + { + "Action":"ec2:CreateNetworkInterface", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + }, + "StringLike":{ + "aws:RequestTag/eks:kubernetes-cni-node-name":"*" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"Networking" + }, + { + "Action":[ + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateTargetGroup", + "elasticloadbalancing:CreateListener", + "elasticloadbalancing:CreateRule", + "ec2:CreateSecurityGroup" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"LoadBalancer" + }, + { + "Action":[ + "shield:CreateProtection" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ShieldProtection" + }, + { + "Action":[ + "shield:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/eks:eks-cluster-name":"${aws:PrincipalTag/eks:eks-cluster-name}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:shield::*:protection/*", + "Sid":"ShieldTagResource" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-02T21:27:19+00:00" + }, "AWSElasticBeanstalkEnhancedHealth":{ "CreateDate":"2016-02-08T23:17:27+00:00", "DefaultVersionId":"v4", @@ -26826,7 +27554,7 @@ }, "AWSElasticDisasterRecoveryConsoleFullAccess_v2":{ "CreateDate":"2023-11-27T13:35:19+00:00", - "DefaultVersionId":"v9", + "DefaultVersionId":"v10", "Document":{ "Statement":[ { @@ -27286,6 +28014,14 @@ "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace", "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning", "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting", + "arn:aws:ssm:*:*:document/AWSDRS-ValidateNetworkConnectivity", + "arn:aws:ssm:*:*:document/AWSDRS-VerifyMountedVolumes", + "arn:aws:ssm:*:*:document/AWSDRS-ValidateHttpResponse", + "arn:aws:ssm:*:*:document/AWSDRS-ValidateDiskSpace", + "arn:aws:ssm:*:*:document/AWSDRS-VerifyProcessIsRunning", + "arn:aws:ssm:*:*:document/AWSDRS-LinuxTimeSyncSetting", + "arn:aws:ssm:*:*:document/AWSDRS-InstallDRAgentOnInstance", + "arn:aws:ssm:*:*:document/AWSDRS-VerifyTags", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:automation-execution/*" ], @@ -27496,7 +28232,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:02:32+00:00" + "UpdateDate":"2026-06-18T22:57:18+00:00" }, "AWSElasticDisasterRecoveryConversionServerPolicy":{ "CreateDate":"2021-11-17T13:42:23+00:00", @@ -27690,7 +28426,7 @@ }, "AWSElasticDisasterRecoveryFailbackPolicy":{ "CreateDate":"2021-11-17T10:41:40+00:00", - "DefaultVersionId":"v2", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { @@ -27731,7 +28467,9 @@ "drs:NotifyAgentDisconnectedForDrs", "drs:NotifyConsistencyAttainedForDrs", "drs:GetFailbackLaunchRequestedForDrs", - "drs:IssueAgentCertificateForDrs" + "drs:IssueAgentCertificateForDrs", + "drs:GetAgentSnapshotCreditsForDrs", + "drs:SendVolumeStatsForDrs" ], "Effect":"Allow", "Resource":"arn:aws:drs:*:*:recovery-instance/${aws:SourceIdentity}", @@ -27742,11 +28480,11 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2023-11-27T12:56:46+00:00" + "UpdateDate":"2026-07-22T18:42:25+00:00" }, "AWSElasticDisasterRecoveryLaunchActionsPolicy":{ "CreateDate":"2023-09-13T07:38:26+00:00", - "DefaultVersionId":"v6", + "DefaultVersionId":"v7", "Document":{ "Statement":[ { @@ -27811,6 +28549,7 @@ "arn:aws:ssm:*::document/AWSDisasterRecovery-*", "arn:aws:ssm:*::document/AWSDistroOTel-*", "arn:aws:ssm:*::document/AWSDocs-*", + "arn:aws:ssm:*::document/AWSDRS-*", "arn:aws:ssm:*::document/AWSEC2-*", "arn:aws:ssm:*::document/AWSEC2Launch-*", "arn:aws:ssm:*::document/AWSFIS-*", @@ -27849,6 +28588,7 @@ "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", + "arn:aws:ssm:*::automation-definition/AWSDRS-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", @@ -28004,7 +28744,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:01:19+00:00" + "UpdateDate":"2026-06-18T22:57:16+00:00" }, "AWSElasticDisasterRecoveryNetworkReplicationPolicy":{ "CreateDate":"2023-06-11T12:36:48+00:00", @@ -32093,6 +32833,27 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-10-01T14:19:12+00:00" }, + "AWSIAMRoleManagerServiceRolePolicy":{ + "CreateDate":"2026-07-15T23:57:12+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "access-analyzer:CreateServiceLinkedAnalyzer", + "access-analyzer:DeleteServiceLinkedAnalyzer" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ManageServiceLinkedAnalyzer" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-15T23:57:12+00:00" + }, "AWSIPAMServiceRolePolicy":{ "CreateDate":"2021-11-30T19:08:11+00:00", "DefaultVersionId":"v11", @@ -34884,7 +35645,7 @@ }, "AWSLambdaManagedEC2ResourceOperator":{ "CreateDate":"2025-11-30T08:34:09+00:00", - "DefaultVersionId":"v4", + "DefaultVersionId":"v5", "Document":{ "Statement":[ { @@ -34944,13 +35705,78 @@ "Resource":[ "arn:aws:ec2:*:*:image/*" ] + }, + { + "Action":[ + "logs:CreateLogGroup" + ], + "Effect":"Allow", + "Resource":"arn:aws:logs:*:*:log-group:*" + }, + { + "Action":[ + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect":"Allow", + "Resource":"arn:aws:logs:*:*:log-group:*:log-stream:*" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-10T20:27:31+00:00" + }, + "AWSLambdaNetworkConnectorOperatorPolicy":{ + "CreateDate":"2026-06-22T15:27:20+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":"ec2:CreateNetworkInterface", + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:subnet/*", + "Sid":"AllowCreateEniInAnySubnet" + }, + { + "Action":"ec2:CreateNetworkInterface", + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:security-group/*", + "Sid":"AllowCreateEniWithSecurityGroups" + }, + { + "Action":"ec2:CreateNetworkInterface", + "Condition":{ + "ForAllValues:StringEquals":{ + "aws:TagKeys":[ + "aws:lambda:networkConnectorName", + "aws:lambda:networkConnectorId" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"AllowCreateEniWithLambdaTagKeys" + }, + { + "Action":"ec2:CreateTags", + "Condition":{ + "StringEquals":{ + "ec2:CreateAction":"CreateNetworkInterface", + "ec2:ManagedResourceOperator":"network-connectors.lambda.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"TagENIOnCreate" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-23T20:42:16+00:00" + "UpdateDate":"2026-06-22T15:27:20+00:00" }, "AWSLambdaReplicator":{ "CreateDate":"2017-05-23T17:53:03+00:00", @@ -35048,7 +35874,7 @@ }, "AWSLambdaServiceRolePolicy":{ "CreateDate":"2025-11-30T08:04:07+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -35074,13 +35900,32 @@ "Resource":[ "*" ] + }, + { + "Action":[ + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups" + ], + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":"ec2:DeleteNetworkInterface", + "Condition":{ + "StringEquals":{ + "ec2:ManagedResourceOperator":"network-connectors.lambda.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2025-11-30T08:04:07+00:00" + "UpdateDate":"2026-06-22T15:12:14+00:00" }, "AWSLambdaVPCAccessExecutionRole":{ "CreateDate":"2016-02-11T23:15:26+00:00", @@ -35759,13 +36604,14 @@ }, "AWSLicenseManagerUserSubscriptionsServiceRolePolicy":{ "CreateDate":"2022-07-30T01:17:18+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { "Action":[ "ds:DescribeDirectories", - "ds:GetAuthorizedApplicationDetails" + "ds:GetAuthorizedApplicationDetails", + "ds:DescribeTrusts" ], "Effect":"Allow", "Resource":"*", @@ -35875,6 +36721,14 @@ "Resource":"*", "Sid":"DescribeNetworkInterfacePermissions" }, + { + "Action":[ + "ec2:DescribeVpcEndpoints" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"DescribeVpcEndpoints" + }, { "Action":[ "secretsmanager:GetSecretValue" @@ -35888,7 +36742,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-20T22:57:09+00:00" + "UpdateDate":"2026-07-10T20:42:22+00:00" }, "AWSM2ServicePolicy":{ "CreateDate":"2022-06-07T20:26:39+00:00", @@ -35950,6 +36804,27 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2022-06-07T20:26:39+00:00" }, + "AWSMCPSignInOAuthAccessPolicy":{ + "CreateDate":"2026-07-09T06:57:15+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "signin:AuthorizeOAuth2Access", + "signin:CreateOAuth2Token" + ], + "Effect":"Allow", + "Resource":"arn:aws:signin:*:*:service-principal/aws-mcp.amazonaws.com", + "Sid":"AllowOAuthForAWSMCP" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-09T06:57:15+00:00" + }, "AWSMSKReplicatorExecutionRole":{ "CreateDate":"2023-12-06T00:07:52+00:00", "DefaultVersionId":"v2", @@ -36012,6 +36887,221 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-03-25T21:36:08+00:00" }, + "AWSManagedAccountManagementAccess":{ + "CreateDate":"2026-07-20T19:57:12+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":{ + "Action":[ + "iam:AttachRolePolicy", + "iam:CreateRole", + "iam:DeleteRole", + "iam:DeleteRolePermissionsBoundary", + "iam:DeleteRolePolicy", + "iam:DetachRolePolicy", + "iam:PutRolePermissionsBoundary", + "iam:PutRolePolicy", + "iam:TagRole", + "iam:UntagRole", + "iam:UpdateAssumeRolePolicy", + "iam:UpdateRole" + ], + "Effect":"Allow", + "Resource":"arn:*:iam::*:role/managed/*" + }, + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-20T19:57:12+00:00" + }, + "AWSManagedAccountUserEntitlementAccess":{ + "CreateDate":"2026-07-17T21:42:25+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":{ + "Action":[ + "identitystore:CreateGroup", + "identitystore:GetGroupId", + "identitystore:GetUserId", + "identitystore:CreateGroupMembership", + "sso:ListInstances", + "sso-directory:ListProvisioningTenants", + "account-access:ListApplications", + "account-access:CreateEntitlement", + "account-access:ListEntitlements" + ], + "Effect":"Allow", + "Resource":"*" + }, + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-17T21:42:25+00:00" + }, + "AWSManagedAdvancedFeaturesActivationAccess":{ + "CreateDate":"2026-07-21T14:27:10+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":{ + "Action":[ + "iam:PutAccountProperties" + ], + "Effect":"Allow", + "Resource":"*" + }, + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-21T14:27:10+00:00" + }, + "AWSManagedBudgetsSpendLimitManagementAccess":{ + "CreateDate":"2026-07-17T21:12:21+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "organizations:AttachPolicy", + "organizations:DescribePolicy", + "organizations:DetachPolicy", + "organizations:ListPolicies" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/ManagedBy":"SpendLimit" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:policy/*/service_control_policy/*", + "Sid":"SCPActions" + }, + { + "Action":[ + "organizations:AttachPolicy", + "organizations:DetachPolicy" + ], + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:account/*", + "Sid":"SCPTargetActions" + }, + { + "Action":"organizations:CloseAccount", + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:account/*", + "Sid":"AccountActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-17T21:12:21+00:00" + }, + "AWSManagedControlPolicyManagementAccess":{ + "CreateDate":"2026-07-21T14:27:23+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":{ + "Action":[ + "organizations:DescribePolicy", + "organizations:UpdatePolicy", + "organizations:ListPolicies", + "organizations:ListRoots", + "organizations:CreatePolicy", + "organizations:AttachPolicy", + "organizations:DetachPolicy", + "organizations:DeletePolicy", + "organizations:TagResource", + "organizations:UntagResource", + "organizations:ListTagsForResource" + ], + "Effect":"Allow", + "Resource":"*" + }, + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-21T14:27:23+00:00" + }, + "AWSManagedServiceAccessManagementAccess":{ + "CreateDate":"2026-07-21T17:57:17+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":"organizations:ListRoots", + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListRoots" + }, + { + "Action":[ + "organizations:ListPolicies", + "organizations:ListPoliciesForTarget" + ], + "Condition":{ + "StringEquals":{ + "organizations:PolicyType":"SERVICE_CONTROL_POLICY" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowSCPList" + }, + { + "Action":[ + "organizations:CreatePolicy", + "organizations:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/ManagedBy":"service-access", + "organizations:PolicyType":"SERVICE_CONTROL_POLICY" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowSCPCreateWithTag" + }, + { + "Action":"organizations:UpdatePolicy", + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/ManagedBy":"service-access" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:policy/*/service_control_policy/*", + "Sid":"AllowSCPUpdateTagged" + }, + { + "Action":"organizations:AttachPolicy", + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/ManagedBy":"service-access" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:policy/*/service_control_policy/*", + "Sid":"AllowSCPAttachTaggedPolicy" + }, + { + "Action":"organizations:AttachPolicy", + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:root/*", + "Sid":"AllowSCPAttachRoot" + } + ], + "Version":"2012-10-17" + }, + "Path":"/service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-21T17:57:17+00:00" + }, "AWSManagedServicesDeploymentToolkitPolicy":{ "CreateDate":"2022-06-09T18:33:03+00:00", "DefaultVersionId":"v4", @@ -36268,6 +37358,509 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2025-01-08T21:22:06+00:00" }, + "AWSManagedSettingsAdminAccess":{ + "CreateDate":"2026-07-22T01:27:25+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "account:PutAccountName" + ], + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ActivateAdvancedUpdateAccountName" + }, + { + "Action":[ + "account:GetAccountInformation", + "account:GetContactInformation", + "account:CloseAccount", + "account:PutAccountName", + "account:PutContactInformation", + "account:StartPrimaryEmailUpdate", + "account:AcceptPrimaryEmailUpdate", + "account:GetPrimaryEmailUpdateStatus" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsAccountAccess" + }, + { + "Action":[ + "billing:GetCredits", + "billing:GetSellerOfRecord", + "billing:RedeemCredits" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsBillingAccess" + }, + { + "Action":[ + "ce:GetCostAndUsage", + "ce:GetCostForecast" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsCostExplorerAccess" + }, + { + "Action":[ + "budgets:CreateBudgetAction", + "budgets:DeleteBudgetAction", + "budgets:DescribeBudgetActionsForAccount", + "budgets:DescribeBudgetActionsForBudget", + "budgets:ModifyBudget", + "budgets:ViewBudget", + "budgets:UpdateBudget", + "budgets:CreateBudget", + "budgets:DeleteBudget", + "budgets:DescribeBudgets", + "budgets:DescribeBudget", + "budgets:DescribeBudgetActionHistories" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsBudgetsAccess" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "iam:PassedToService":"budgets.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/managed/AWSManagedBudgetsSpendLimitManagementRole", + "Sid":"AWSSettingsIAMPassRole" + }, + { + "Action":[ + "customer-verification:CreateCustomerVerificationDetails", + "customer-verification:CreateUploadUrls", + "customer-verification:GetCustomerVerificationDetails", + "customer-verification:GetCustomerVerificationEligibility", + "customer-verification:UpdateCustomerVerificationDetails" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsCustomerVerificationAccess" + }, + { + "Action":[ + "freetier:GetAccountPlanState", + "freetier:UpgradeAccountPlan" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsFreeTierAccess" + }, + { + "Action":[ + "identitystore:CreateGroup", + "identitystore:CreateGroupMembership", + "identitystore:CreateUser", + "identitystore:DeleteGroup", + "identitystore:DeleteGroupMembership", + "identitystore:DeleteUser", + "identitystore:DescribeGroup", + "identitystore:DescribeUser", + "identitystore:GetGroupId", + "identitystore:GetUserId", + "identitystore:ListGroupMemberships", + "identitystore:UpdateIdentityStore", + "identitystore:ListGroupMembershipsForMember", + "identitystore:ListGroups", + "identitystore:ListUsers", + "identitystore:ReserveUser", + "identitystore:UpdateGroup", + "identitystore:UpdateUser", + "sso-directory:DescribeUsers", + "sso-directory:SearchGroups", + "sso-directory:SearchUsers", + "builderid:CreateInvitation", + "builderid:DeleteInvitation", + "builderid:DisassociateCollaborator", + "builderid:ListInvitations" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsIdentityStoreAccess" + }, + { + "Action":[ + "invoicing:GetInvoicePDF" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsInvoicingAccess" + }, + { + "Action":[ + "organizations:CloseAccount", + "organizations:CreatePolicy", + "organizations:DescribeEffectivePolicy", + "organizations:DescribeOrganization", + "organizations:ListAccounts", + "organizations:ListPolicies", + "organizations:ListPoliciesForTarget", + "organizations:ListRoots", + "organizations:CreateBuilderIdOwnedAccount", + "organizations:DescribeCreateAccountStatus", + "organizations:DescribeAccount", + "organizations:InviteAccountToOrganization" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsOrganizationsAccess" + }, + { + "Action":[ + "organizations:AttachPolicy", + "organizations:DetachPolicy", + "organizations:EnablePolicyType", + "organizations:DisablePolicyType" + ], + "Condition":{ + "StringEquals":{ + "organizations:PolicyType":"AISERVICES_OPT_OUT_POLICY" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsOrganizationsAiOptOutPolicyManagement" + }, + { + "Action":[ + "payments:CreatePaymentInstrument", + "payments:GetPaymentInstrument", + "payments:GetPaymentStatus", + "payments:ListPaymentPreferences", + "payments:MakePayment", + "payments:UpdatePaymentInstrument", + "payments:UpdatePaymentPreferences", + "payments:TagResource", + "payments:UntagResource", + "payments:ListTagsForResource", + "payments:BatchGetPaymentProfiles", + "payments:AcceptTermsAndConditionsForProgramByAccountId", + "payments:CreatePaymentAttempt", + "payments:CreatePaymentProfile", + "payments:Get", + "payments:GetAcceptedTermsAndConditionsForProgramByAccountId", + "payments:GetEligibleCurrencies", + "payments:GetPaymentAttempt", + "payments:GetPaymentPreferences", + "payments:GetPreferredCurrency", + "payments:GetRecommendedTermsAndConditionsForProgram", + "payments:ListPaymentProfiles", + "payments:SearchFinancialRecords", + "payments:SetPreferredCurrency", + "payments:UpdatePaymentProfile", + "payments:GetAccountBalance" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsPaymentsAccess" + }, + { + "Action":[ + "ses:SendEmail" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsSESAccess" + }, + { + "Action":[ + "sso:DeleteApplicationAssignment", + "sso:DescribeInstance", + "sso:GetApplicationAssignmentConfiguration", + "sso:ListApplicationAssignments", + "sso:CreateApplicationAssignment", + "sso:DescribeApplication", + "sso:ListApplications", + "sso:UpdateInstance" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsSSOAccess" + }, + { + "Action":[ + "tax:BatchPutTaxRegistration", + "tax:DeleteTaxRegistration", + "tax:GetTaxRegistration", + "tax:GetTaxRegistrationDocument", + "tax:ListTaxRegistrations", + "tax:PutTaxRegistration" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsTaxAccess" + }, + { + "Action":[ + "support:CreateCase", + "support:DescribeServices", + "support:DescribeSeverityLevels", + "support:DescribeCases", + "support:AddCommunicationToCase", + "support:ResolveCase" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSSettingsSupportAccess" + }, + { + "Action":[ + "organizations:CreateBuilderIdOwnedAccount", + "organizations:DescribeCreateAccountStatus", + "organizations:ListAccounts", + "sso:ListInstances", + "identitystore:GetUserId", + "sso-directory:ListProvisioningTenants", + "account-access:ListApplications", + "account-access:CreateApplication", + "account-access:CreateEntitlement", + "signin:DeleteConsoleAuthorizationConfiguration" + ], + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ActivateAdvancedProvisioningAccess" + }, + { + "Action":[ + "organizations:RegisterDelegatedAdministrator", + "organizations:ListDelegatedAdministrators" + ], + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com", + "organizations:ServicePrincipal":"sso.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ActivateAdvancedDelegatedAdminAccess" + }, + { + "Action":[ + "iam:GetRole", + "iam:CreateRole", + "iam:AttachRolePolicy", + "iam:DeleteRole", + "iam:ListAttachedRolePolicies", + "iam:DetachRolePolicy", + "iam:ListRolePolicies", + "iam:DeleteRolePolicy" + ], + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/managed/*", + "arn:aws:iam::*:role/ManagedAccountAdmin", + "arn:aws:iam::*:role/AccountFullAccessRole" + ], + "Sid":"ActivateAdvancedManagedRoleAccess" + }, + { + "Action":"sts:AssumeRole", + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/managed/AWSManagedAdvancedFeaturesActivationRole", + "Sid":"ActivateAdvancedMemberAccountAssume" + }, + { + "Action":"budgets:ModifyBudget", + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:budgets::*:budget/sla-*", + "Sid":"ActivateAdvancedBudgetsAccess" + }, + { + "Action":[ + "organizations:DeletePolicy", + "organizations:DetachPolicy", + "organizations:ListPolicies", + "organizations:ListRoots" + ], + "Condition":{ + "StringEquals":{ + "aws:CalledViaLast":"account.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ActivateAdvancedSCPCleanupAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-23T00:42:22+00:00" + }, + "AWSManagedSettingsReadOnlyAccess":{ + "CreateDate":"2026-07-22T01:12:28+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "account:GetAccountInformation", + "account:GetContactInformation" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AccountReadOnly" + }, + { + "Action":[ + "identitystore:DescribeUser", + "identitystore:ListGroupMemberships", + "identitystore:ListGroups", + "identitystore:ListUsers" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"IdentityStoreReadOnly" + }, + { + "Action":[ + "organizations:DescribeOrganization", + "organizations:ListAccounts" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"OrganizationsReadOnly" + }, + { + "Action":[ + "sso:DescribeInstance" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SSOReadOnly" + }, + { + "Action":[ + "sso-directory:DescribeUsers", + "sso-directory:SearchGroups", + "sso-directory:SearchUsers" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SSODirectoryReadOnly" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-23T00:42:16+00:00" + }, + "AWSManagedSignUpAdminAccess":{ + "CreateDate":"2026-07-20T19:27:24+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "payments:CreatePaymentInstrument", + "payments:GetPaymentInstrument", + "payments:GetPaymentStatus", + "payments:ListPaymentPreferences", + "payments:ListTagsForResource", + "payments:MakePayment", + "payments:TagResource", + "payments:UntagResource", + "payments:UpdatePaymentInstrument", + "payments:UpdatePaymentPreferences" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"PaymentWidgetPermissions" + }, + { + "Action":[ + "billing:GetSellerOfRecord" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"BillingPermissions" + }, + { + "Action":[ + "account:GetContactInformation" + ], + "Effect":"Allow", + "Resource":"arn:aws:account::*:account", + "Sid":"AccountPermissions" + }, + { + "Action":[ + "invoicing:GetInvoicePDF" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"InvoicingPermissions" + }, + { + "Action":[ + "tax:BatchPutTaxRegistration", + "tax:DeleteTaxRegistration", + "tax:GetTaxRegistration", + "tax:GetTaxRegistrationDocument", + "tax:ListTaxRegistrations", + "tax:PutTaxRegistration" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"TaxWidgetPermissions" + }, + { + "Action":[ + "customer-verification:CreateCustomerVerificationDetails", + "customer-verification:CreateUploadUrls", + "customer-verification:GetCustomerVerificationDetails", + "customer-verification:GetCustomerVerificationEligibility", + "customer-verification:UpdateCustomerVerificationDetails" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"CustomerVerificationWidgetPermissions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-20T19:27:24+00:00" + }, "AWSManagementConsoleAdministratorAccess":{ "CreateDate":"2025-08-14T21:19:07+00:00", "DefaultVersionId":"v7", @@ -37089,7 +38682,7 @@ }, "AWSMarketplaceSellerFullAccess":{ "CreateDate":"2019-07-02T20:40:09+00:00", - "DefaultVersionId":"v29", + "DefaultVersionId":"v32", "Document":{ "Statement":[ { @@ -37178,7 +38771,10 @@ "Effect":"Allow", "Resource":[ "arn:aws:aws-marketplace:*:*:AWSMarketplace*/*", - "arn:aws:aws-marketplace:*:*:catalog/AWSMarketplace*/*" + "arn:aws:aws-marketplace:*:*:catalog/AWSMarketplace*/*", + "arn:aws:aws-marketplace:*:*:verification-type/*/verification-evidence/*", + "arn:aws:aws-marketplace:*:*:tax-compliance-profile/*", + "arn:aws:aws-marketplace:*:*:tax-compliance-profile-change-task/*" ], "Sid":"TagManagement" }, @@ -37201,6 +38797,8 @@ "tax:PutSupplementalTaxRegistration", "tax:DeleteSupplementalTaxRegistration", "tax:GetTaxRegistration", + "tax:PutTaxRegistration", + "tax:ListTaxRegistrations", "aws-marketplace:ListPayables", "aws-marketplace:ListInvoiceSubmissionTasks", "invoicing:ListInvoiceSummaries", @@ -37211,6 +38809,27 @@ "Resource":"*", "Sid":"SellerSettings" }, + { + "Action":[ + "aws-marketplace:CreateVerificationEvidence", + "aws-marketplace:UpdateVerificationEvidence", + "aws-marketplace:GetVerificationEvidence" + ], + "Effect":"Allow", + "Resource":"arn:aws:aws-marketplace:*:*:verification-type/*/verification-evidence/*", + "Sid":"MarketplaceSellerVerificationEvidenceManagement" + }, + { + "Action":[ + "aws-marketplace:ListVerificationEvidence", + "aws-marketplace:StartVerification", + "aws-marketplace:GetVerification", + "aws-marketplace:ListVerifications" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"MarketplaceSellerVerificationManagement" + }, { "Action":[ "aws-marketplace:StartInvoiceSubmissionTask", @@ -37336,13 +38955,38 @@ "Effect":"Allow", "Resource":"*", "Sid":"AWSMarketplaceAgreementsCancellationAndAdjustmentAccess" + }, + { + "Action":[ + "aws-marketplace:StartTaxComplianceProfileChangeTask" + ], + "Effect":"Allow", + "Resource":"arn:aws:aws-marketplace:*:*:tax-compliance-profile-change-task/*", + "Sid":"TaxComplianceProfileChangeTaskManagement" + }, + { + "Action":[ + "aws-marketplace:GetTaxComplianceProfile" + ], + "Effect":"Allow", + "Resource":"arn:aws:aws-marketplace:*:*:tax-compliance-profile/*", + "Sid":"TaxComplianceProfileRead" + }, + { + "Action":[ + "aws-marketplace:ListTaxComplianceProfileChangeTasks", + "aws-marketplace:ListTaxComplianceProfiles" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"TaxComplianceProfileList" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-07T18:27:21+00:00" + "UpdateDate":"2026-07-21T16:42:13+00:00" }, "AWSMarketplaceSellerOfferManagement":{ "CreateDate":"2024-11-19T00:41:38+00:00", @@ -39688,7 +41332,7 @@ }, "AWSNetworkFirewallServiceRolePolicy":{ "CreateDate":"2020-11-17T17:17:26+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -39747,13 +41391,27 @@ }, "Effect":"Allow", "Resource":"*" + }, + { + "Action":[ + "ecs:ListContainerInstances", + "ecs:ListTasks", + "ecs:DescribeTasks", + "ecs:DescribeContainerInstances" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ecs:*:*:cluster/*", + "arn:aws:ecs:*:*:container-instance/*/*", + "arn:aws:ecs:*:*:task/*/*" + ] } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2023-03-30T17:19:09+00:00" + "UpdateDate":"2026-06-01T21:57:07+00:00" }, "AWSNetworkManagerCloudWANServiceRolePolicy":{ "CreateDate":"2022-07-12T12:17:49+00:00", @@ -39917,7 +41575,7 @@ }, "AWSObservabilityAdminServiceRolePolicy":{ "CreateDate":"2024-11-27T19:36:07+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -39927,7 +41585,8 @@ "organizations:ListChildren", "organizations:ListParents", "organizations:DescribeOrganization", - "organizations:DescribeOrganizationalUnit" + "organizations:DescribeOrganizationalUnit", + "organizations:ListAWSServiceAccessForOrganization" ], "Effect":"Allow", "Resource":"*" @@ -40019,11 +41678,11 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-11-27T19:36:07+00:00" + "UpdateDate":"2026-07-14T22:42:17+00:00" }, "AWSObservabilityAdminTelemetryEnablementServiceRolePolicy":{ "CreateDate":"2025-08-01T18:04:06+00:00", - "DefaultVersionId":"v10", + "DefaultVersionId":"v14", "Document":{ "Statement":[ { @@ -40034,7 +41693,9 @@ "logs:DescribeResourcePolicies", "logs:ListLogGroups", "ec2:MonitorInstances", - "logs:DescribeDeliverySources" + "logs:DescribeDeliverySources", + "logs:DescribeDeliveries", + "logs:DescribeDeliveryDestinations" ], "Condition":{ "StringEquals":{ @@ -40262,7 +41923,8 @@ }, { "Action":[ - "bedrock-agentcore:AllowVendedLogDeliveryForResource" + "bedrock-agentcore:AllowVendedLogDeliveryForResource", + "bedrock:AllowVendedLogDeliveryForResource" ], "Condition":{ "StringEquals":{ @@ -40273,6 +41935,19 @@ "Resource":"*", "Sid":"TelemetryOperationsForBedrock" }, + { + "Action":[ + "s3:AllowVendedLogDeliveryForResource" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TelemetryOperationsForS3" + }, { "Action":[ "securityhub:AllowVendedLogDeliveryForResource", @@ -40553,13 +42228,55 @@ "Effect":"Allow", "Resource":"arn:aws:iam::*:role/aws-service-role/resource-explorer-2.amazonaws.com/*", "Sid":"TelemetryOperationsForOTelEnrichmentSLR" + }, + { + "Action":[ + "logs:ListTagsForResource" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/CloudWatchTelemetryRuleManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TelemetryReadTagsForLogs" + }, + { + "Action":[ + "kms:Describe*", + "logs:AssociateKmsKey" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TelemetryKMSOperationsForAccount" + }, + { + "Action":[ + "kms:Describe*", + "logs:AssociateKmsKey" + ], + "Condition":{ + "StringEquals":{ + "aws:PrincipalOrgId":"${aws:ResourceOrgId}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TelemetryKMSOperationsForOrganization" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-29T21:12:11+00:00" + "UpdateDate":"2026-07-24T19:12:23+00:00" }, "AWSOrganizationsFullAccess":{ "CreateDate":"2018-11-06T20:31:57+00:00", @@ -42177,7 +43894,7 @@ }, "AWSPartnerCentralOpportunityManagement":{ "CreateDate":"2024-11-14T19:09:05+00:00", - "DefaultVersionId":"v9", + "DefaultVersionId":"v10", "Document":{ "Statement":[ { @@ -42197,6 +43914,7 @@ "partnercentral:GetEngagement", "partnercentral:GetEngagementInvitation", "partnercentral:GetOpportunity", + "partnercentral:GetProspectingFromEngagementTask", "partnercentral:GetResourceSnapshot", "partnercentral:GetResourceSnapshotJob", "partnercentral:ListEngagementByAcceptingInvitationTasks", @@ -42207,6 +43925,7 @@ "partnercentral:ListEngagements", "partnercentral:ListOpportunities", "partnercentral:ListOpportunityFromEngagementTasks", + "partnercentral:ListProspectingFromEngagementTasks", "partnercentral:ListResourceSnapshotJobs", "partnercentral:ListResourceSnapshots", "partnercentral:ListSolutions", @@ -42214,6 +43933,7 @@ "partnercentral:StartEngagementByAcceptingInvitationTask", "partnercentral:StartEngagementFromOpportunityTask", "partnercentral:StartOpportunityFromEngagementTask", + "partnercentral:StartProspectingFromEngagementTask", "partnercentral:StartResourceSnapshotJob", "partnercentral:StopResourceSnapshotJob", "partnercentral:SubmitOpportunity", @@ -42361,7 +44081,209 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-03-12T17:12:09+00:00" + "UpdateDate":"2026-06-16T13:27:14+00:00" + }, + "AWSPartnerCentralRevenueAttributionManagement":{ + "CreateDate":"2026-06-30T19:12:18+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "partnercentral:CreateRevenueAttribution", + "partnercentral:CreateMarketplaceRevenueShare", + "partnercentral:CreateMarketplaceRevenueShareAllocation" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"RevenueMeasurementCreation" + }, + { + "Action":[ + "partnercentral:ListRevenueAttributions", + "partnercentral:ListRevenueAttributionAllocations", + "partnercentral:ListMarketplaceRevenueShares", + "partnercentral:ListMarketplaceRevenueShareAllocations" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"RevenueMeasurementListing" + }, + { + "Action":[ + "partnercentral:GetRevenueAttribution", + "partnercentral:UpdateRevenueAttribution", + "partnercentral:GetRevenueAttributionAllocation", + "partnercentral:StartRevenueAttributionAllocationsTask", + "partnercentral:GetRevenueAttributionAllocationsTask" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/revenue-attribution/*", + "Sid":"RevenueAttributionManagement" + }, + { + "Action":[ + "partnercentral:GetMarketplaceRevenueShare", + "partnercentral:GetMarketplaceRevenueShareAllocation", + "partnercentral:UpdateMarketplaceRevenueShareAllocation" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/marketplace-revenue-share/*", + "Sid":"MarketplaceRevenueShareManagement" + }, + { + "Action":[ + "partnercentral:TagResource", + "partnercentral:UntagResource", + "partnercentral:ListTagsForResource" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:partnercentral:*:*:catalog/*/revenue-attribution/*", + "arn:aws:partnercentral:*:*:catalog/*/marketplace-revenue-share/*" + ], + "Sid":"TaggingAccess" + }, + { + "Action":[ + "partnercentral:ListOpportunities" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"OpportunityListing" + }, + { + "Action":[ + "partnercentral:GetOpportunity" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/opportunity/*", + "Sid":"OpportunityAccess" + }, + { + "Action":[ + "partnercentral:ListPartners" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"PartnerListing" + }, + { + "Action":[ + "partnercentral:GetPartner" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/partner/*", + "Sid":"PartnerResourceAccess" + }, + { + "Action":[ + "aws-marketplace:ListEntities" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ListingAWSMarketplaceEntities" + }, + { + "Action":[ + "aws-marketplace:DescribeEntity" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:aws-marketplace:*:*:AWSMarketplace*/Offer/*" + ], + "Sid":"AWSMarketplaceEntityAccess" + }, + { + "Action":[ + "q:StartConversation", + "q:SendMessage", + "q:GetConversation", + "q:ListConversations", + "q:PassRequest" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AmazonQPartnerAssistantAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-30T19:12:18+00:00" }, "AWSPartnerCentralSandboxFullAccess":{ "CreateDate":"2024-11-14T19:10:37+00:00", @@ -46287,7 +48209,7 @@ }, "AWSQuickSetupManagedInstanceProfileExecutionPolicy":{ "CreateDate":"2024-11-15T21:51:23+00:00", - "DefaultVersionId":"v7", + "DefaultVersionId":"v8", "Document":{ "Statement":[ { @@ -46347,13 +48269,14 @@ "Condition":{ "StringEquals":{ "iam:PassedToService":[ - "ec2.amazonaws.com" + "ec2.amazonaws.com", + "ssm.amazonaws.com" ] } }, "Effect":"Allow", "Resource":"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup", - "Sid":"DefaultInstanceRolePassToEC2Permissions" + "Sid":"DefaultInstanceRolePassToEC2AndSSMPermissions" }, { "Action":"iam:AttachRolePolicy", @@ -46381,6 +48304,35 @@ "Resource":"*", "Sid":"InstanceProfileAssociationEc2Permissions" }, + { + "Action":[ + "ssm:DescribeInstanceInformation", + "ssm:UpdateManagedInstanceRole" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SSMInstanceManagement" + }, + { + "Action":"iam:TagRole", + "Condition":{ + "ForAllValues:StringLike":{ + "aws:TagKeys":"QSConfigId-*" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/*", + "Sid":"TagRoles" + }, + { + "Action":[ + "iam:TagRole", + "iam:AttachRolePolicy" + ], + "Effect":"Deny", + "Resource":"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*", + "Sid":"DenyModifyQuickSetupAutomationRoles" + }, { "Action":[ "ssm:StartAutomationExecution", @@ -46465,7 +48417,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:01:22+00:00" + "UpdateDate":"2026-06-03T14:12:12+00:00" }, "AWSQuickSetupPatchPolicyBaselineAccess":{ "CreateDate":"2024-06-26T09:38:00+00:00", @@ -46852,6 +48804,45 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-06-26T09:57:02+00:00" }, + "AWSQuickSetupPatchPolicyLambdaExecutionPolicy":{ + "CreateDate":"2026-06-03T14:12:26+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ssm:DescribeAssociationExecutions", + "ssm:UpdateAssociation", + "ssm:DescribeAssociation" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:association/*", + "arn:aws:ssm:*:*:document/AWSQuickSetup-*", + "arn:aws:ssm:*:*:document/AWSQuickSetupType-*" + ], + "Sid":"ManageSSMAssociations" + }, + { + "Action":[ + "iam:PassRole" + ], + "Condition":{ + "StringEquals":{ + "iam:PassedToService":"ssm.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*", + "Sid":"PassQuickSetupAutomationRole" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T14:12:26+00:00" + }, "AWSQuickSetupPatchPolicyPermissionsBoundary":{ "CreateDate":"2024-06-26T09:46:54+00:00", "DefaultVersionId":"v5", @@ -47211,6 +49202,60 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-03-05T16:57:14+00:00" }, + "AWSQuickSetupPatchPolicyTagManagementExecutionPolicy":{ + "CreateDate":"2026-06-03T14:12:13+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ssm:GetInventory" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"GetSSMInventory" + }, + { + "Action":[ + "ssm:AddTagsToResource", + "ssm:RemoveTagsFromResource" + ], + "Condition":{ + "ForAllValues:StringLike":{ + "aws:TagKeys":"QSConfigName-*" + }, + "ForAnyValue:StringLike":{ + "aws:TagKeys":"QSConfigName-*" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ssm:*:*:managed-instance/*", + "Sid":"ManageSSMManagedInstanceTags" + }, + { + "Action":[ + "ec2:CreateTags", + "ec2:DeleteTags" + ], + "Condition":{ + "ForAllValues:StringLike":{ + "aws:TagKeys":"QSConfigName-*" + }, + "ForAnyValue:StringLike":{ + "aws:TagKeys":"QSConfigName-*" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:instance/*", + "Sid":"ManageEC2InstanceTags" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T14:12:13+00:00" + }, "AWSQuickSetupSSMDeploymentRolePolicy":{ "CreateDate":"2024-11-15T22:53:20+00:00", "DefaultVersionId":"v8", @@ -50019,20 +52064,157 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T18:00:12+00:00" }, + "AWSResilienceHubResilienceTestingPolicy":{ + "CreateDate":"2026-07-31T22:27:21+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":"fis:CreateExperimentTemplate", + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:action/*", + "Sid":"AWSResilienceHubFISActionStatement" + }, + { + "Action":"fis:CreateExperimentTemplate", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:experiment-template/*", + "Sid":"AWSResilienceHubFISCreateExperimentTemplateStatement" + }, + { + "Action":"fis:StartExperiment", + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:experiment-template/*", + "Sid":"AWSResilienceHubFISStartExperimentFromTemplateStatement" + }, + { + "Action":"fis:StartExperiment", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:experiment/*", + "Sid":"AWSResilienceHubFISStartExperimentStatement" + }, + { + "Action":[ + "fis:GetExperiment", + "fis:StopExperiment", + "fis:ListExperimentResolvedTargets" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:experiment/*", + "Sid":"AWSResilienceHubFISExperimentStatement" + }, + { + "Action":[ + "fis:CreateTargetAccountConfiguration", + "fis:DeleteExperimentTemplate" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:fis:*:*:experiment-template/*", + "Sid":"AWSResilienceHubFISExperimentTemplateStatement" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "iam:PassedToService":"fis.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/*", + "Sid":"AWSResilienceHubFISPassRoleStatement" + }, + { + "Action":"fis:TagResource", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/managedBy":"resiliencehub" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:fis:*:*:experiment-template/*", + "arn:aws:fis:*:*:experiment/*" + ], + "Sid":"AWSResilienceHubFISTagResourceStatement" + }, + { + "Action":[ + "arc-region-switch:ListPlanExecutions", + "arc-region-switch:GetPlanExecution" + ], + "Effect":"Allow", + "Resource":"arn:aws:arc-region-switch::*:plan/*:*", + "Sid":"AWSResilienceHubRegionSwitchStatement" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":"fis.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/*", + "Sid":"AWSResilienceHubFISCreateSLRStatement" + }, + { + "Action":"cloudwatch:DescribeAlarmHistory", + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSResilienceHubCloudWatchAlarmStatement" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-31T22:27:21+00:00" + }, "AWSResilienceHubServiceRolePolicy":{ "CreateDate":"2026-05-28T17:42:17+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { "Action":[ + "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", + "organizations:ListAWSServiceAccessForOrganization", "organizations:ListAccounts", + "organizations:ListAccountsForParent", "organizations:ListChildren", + "organizations:ListDelegatedAdministrators", + "organizations:ListDelegatedServicesForAccount", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", - "organizations:ListRoots" + "organizations:ListRoots", + "organizations:ListTagsForResource" ], "Effect":"Allow", "Resource":"*", @@ -50043,7 +52225,269 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-28T17:42:17+00:00" + "UpdateDate":"2026-07-06T18:12:14+00:00" + }, + "AWSResilienceHubV2AssessmentExecutionPolicy":{ + "CreateDate":"2026-06-17T22:57:15+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "acm:Describe*", + "acm:List*", + "application-autoscaling:Describe*", + "application-autoscaling:GetPredictiveScalingForecast", + "application-autoscaling:ListTagsForResource", + "arc-region-switch:Get*", + "arc-region-switch:List*", + "arc-zonal-shift:Get*", + "arc-zonal-shift:List*", + "autoscaling:Describe*", + "autoscaling:GetPredictiveScalingForecast", + "backup:Describe*", + "backup:GetBackupPlan", + "backup:GetBackupSelection", + "backup:GetBackupVaultAccessPolicy", + "backup:GetBackupVaultNotifications", + "backup:GetRestoreTestingPlan", + "backup:GetRestoreTestingSelection", + "backup:List*", + "cloudformation:Describe*", + "cloudformation:GetResource", + "cloudformation:GetStackPolicy", + "cloudformation:GetTemplate", + "cloudformation:List*", + "cloudfront:Get*", + "cloudfront:List*", + "cloudwatch:DescribeAlarms", + "cloudwatch:GetMetricData", + "cloudwatch:GetMetricStatistics", + "config:Describe*", + "config:GetStoredQuery", + "config:List*", + "datasync:Describe*", + "datasync:List*", + "dlm:Get*", + "docdb-elastic:Get*", + "docdb-elastic:List*", + "drs:Describe*", + "drs:Get*", + "drs:List*", + "ds:Describe*", + "dsql:Get*", + "dsql:List*", + "dynamodb:Describe*", + "dynamodb:GetResourcePolicy", + "dynamodb:List*", + "ec2:DescribeAddresses", + "ec2:DescribeAvailabilityZones", + "ec2:DescribeCapacityReservations", + "ec2:DescribeClientVpnConnections", + "ec2:DescribeClientVpnEndpoints", + "ec2:DescribeCustomerGateways", + "ec2:DescribeDhcpOptions", + "ec2:DescribeFastSnapshotRestores", + "ec2:DescribeFleets", + "ec2:DescribeFlowLogs", + "ec2:DescribeHosts", + "ec2:DescribeImages", + "ec2:DescribeInstances", + "ec2:DescribeInstanceAttribute", + "ec2:DescribeInternetGateways", + "ec2:DescribeKeyPairs", + "ec2:DescribeLaunchTemplates", + "ec2:DescribeLaunchTemplateVersions", + "ec2:DescribeManagedPrefixLists", + "ec2:DescribeNatGateways", + "ec2:DescribeNetworkAcls", + "ec2:DescribeNetworkInsightsAnalyses", + "ec2:DescribeNetworkInsightsPaths", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribePlacementGroups", + "ec2:DescribeRegions", + "ec2:DescribeRouteTables", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSnapshots", + "ec2:DescribeSubnets", + "ec2:DescribeTags", + "ec2:DescribeTransitGatewayAttachments", + "ec2:DescribeTransitGatewayPeeringAttachments", + "ec2:DescribeTransitGatewayRouteTables", + "ec2:DescribeTransitGateways", + "ec2:DescribeTransitGatewayVpcAttachments", + "ec2:DescribeVolumes", + "ec2:DescribeVpcAttribute", + "ec2:DescribeVpcEndpointConnectionNotifications", + "ec2:DescribeVpcEndpointConnections", + "ec2:DescribeVpcEndpoints", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServicePermissions", + "ec2:DescribeVpcEndpointServices", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeVpcs", + "ec2:DescribeVpnConnections", + "ec2:DescribeVpnGateways", + "ec2:GetTransitGatewayRouteTableAssociations", + "ecr:Describe*", + "ecs:Describe*", + "ecs:List*", + "eks:Describe*", + "eks:List*", + "elasticache:Describe*", + "elasticache:List*", + "elasticfilesystem:Describe*", + "elasticfilesystem:ListTagsForResource", + "elasticloadbalancing:Describe*", + "events:Describe*", + "events:List*", + "firehose:Describe*", + "firehose:List*", + "fis:Get*", + "fis:List*", + "fsx:Describe*", + "fsx:List*", + "globalaccelerator:Describe*", + "globalaccelerator:List*", + "iam:GetInstanceProfile", + "iam:GetPolicy", + "iam:GetPolicyVersion", + "iam:GetRole", + "iam:GetRolePolicy", + "iam:ListAttachedRolePolicies", + "iam:ListInstanceProfiles", + "iam:ListRolePolicies", + "iam:ListRoles", + "iam:ListRoleTags", + "kafka:Describe*", + "kafka:GetClusterPolicy", + "kafka:List*", + "kafkaconnect:Describe*", + "kafkaconnect:List*", + "kinesis:Describe*", + "kinesis:List*", + "lambda:GetAlias", + "lambda:GetCodeSigningConfig", + "lambda:GetEventSourceMapping", + "lambda:GetFunctionCodeSigningConfig", + "lambda:GetFunctionConfiguration", + "lambda:GetFunctionEventInvokeConfig", + "lambda:GetFunctionRecursionConfig", + "lambda:GetFunctionUrlConfig", + "lambda:GetLayerVersion", + "lambda:GetLayerVersionPolicy", + "lambda:GetPolicy", + "lambda:GetProvisionedConcurrencyConfig", + "lambda:GetRuntimeManagementConfig", + "lambda:List*", + "memorydb:Describe*", + "memorydb:List*", + "network-firewall:Describe*", + "network-firewall:List*", + "qldb:Describe*", + "qldb:List*", + "ram:Get*", + "ram:List*", + "rds:Describe*", + "rds:List*", + "redshift:Describe*", + "redshift:List*", + "resource-groups:Get*", + "resource-groups:List*", + "resource-groups:Search*", + "route53-recovery-cluster:Get*", + "route53-recovery-cluster:List*", + "route53-recovery-control-config:Describe*", + "route53-recovery-control-config:Get*", + "route53-recovery-control-config:List*", + "route53-recovery-readiness:Get*", + "route53-recovery-readiness:List*", + "route53:Get*", + "route53:List*", + "route53domains:Check*", + "route53domains:List*", + "route53resolver:Get*", + "route53resolver:List*", + "s3:ListBucket", + "secretsmanager:DescribeSecret", + "secretsmanager:ListSecrets", + "servicecatalog:GetApplication", + "servicecatalog:ListAssociatedResources", + "shield:Describe*", + "shield:Get*", + "shield:List*", + "sns:GetDataProtectionPolicy", + "sns:GetSubscriptionAttributes", + "sns:GetTopicAttributes", + "sns:List*", + "sqs:GetQueueAttributes", + "sqs:GetQueueUrl", + "sqs:List*", + "ssm:Describe*", + "ssm:GetDefaultPatchBaseline", + "ssm:GetDocument", + "ssm:GetMaintenanceWindow", + "ssm:GetParameters", + "ssm:GetPatchBaseline", + "ssm:GetResourcePolicies", + "ssm:List*", + "ssm-incidents:GetReplicationSet", + "ssm-incidents:GetResponsePlan", + "ssm-incidents:List*", + "states:Describe*", + "states:List*", + "tag:GetResources", + "vpc-lattice:Get*", + "vpc-lattice:List*", + "wafv2:Get*", + "wafv2:List*" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSResilienceHubV2ReadResourceConfigStatement" + }, + { + "Action":[ + "apigateway:GET" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:apigateway:*::/apis/*", + "arn:aws:apigateway:*::/restapis/*", + "arn:aws:apigateway:*::/usageplans", + "arn:aws:apigateway:*::/domainnames/*" + ], + "Sid":"AWSResilienceHubApiGatewayStatement" + }, + { + "Action":[ + "s3:GetBucketLocation", + "s3:GetBucketLogging", + "s3:GetBucketObjectLockConfiguration", + "s3:GetBucketPolicy", + "s3:GetBucketPolicyStatus", + "s3:GetBucketTagging", + "s3:GetBucketVersioning", + "s3:GetMultiRegionAccessPointRoutes", + "s3:GetReplicationConfiguration", + "s3:ListAllMyBuckets", + "s3:ListMultiRegionAccessPoints" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AWSResilienceHubS3AccessStatement" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-17T22:57:15+00:00" }, "AWSResourceAccessManagerFullAccess":{ "CreateDate":"2019-06-04T17:28:22+00:00", @@ -50286,7 +52730,7 @@ }, "AWSResourceExplorerServiceRolePolicy":{ "CreateDate":"2022-10-25T20:35:29+00:00", - "DefaultVersionId":"v50", + "DefaultVersionId":"v52", "Document":{ "Statement":[ { @@ -50295,14 +52739,7 @@ "resource-explorer-2:CreateIndex", "resource-explorer-2:CreateView", "resource-explorer-2:AssociateDefaultView", - "resource-explorer-2:DeleteIndex" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"ResourceExplorerAccess" - }, - { - "Action":[ + "resource-explorer-2:DeleteIndex", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", @@ -50313,7 +52750,7 @@ ], "Effect":"Allow", "Resource":"*", - "Sid":"OrganizationsAccess" + "Sid":"ResourceExplorerAndOrganizationsAccess" }, { "Action":[ @@ -50351,21 +52788,32 @@ }, { "Action":[ + "access-analyzer:GetAnalyzer", "access-analyzer:ListAnalyzers", + "access-analyzer:ListArchiveRules", + "acm-pca:DescribeCertificateAuthority", + "acm-pca:GetCertificateAuthorityCsr", "acm-pca:ListCertificateAuthorities", + "acm-pca:ListTags", "acm:ListCertificates", "airflow:ListEnvironments", "amplify:ListApps", "amplify:ListBranches", "amplify:ListDomainAssociations", + "amplify:ListTagsForResource", "aoss:ListCollections", + "app-integrations:GetApplication", + "app-integrations:GetEventIntegration", "app-integrations:ListApplications", "app-integrations:ListEventIntegrations", + "app-integrations:ListTagsForResource", "appconfig:ListApplications", "appconfig:ListDeploymentStrategies", "appconfig:ListEnvironments", "appconfig:ListExtensionAssociations", + "appflow:DescribeFlow", "appflow:ListFlows", + "appflow:ListTagsForResource", "appmesh:ListGatewayRoutes", "appmesh:ListMeshes", "appmesh:ListRoutes", @@ -50373,6 +52821,8 @@ "appmesh:ListVirtualNodes", "appmesh:ListVirtualRouters", "appmesh:ListVirtualServices", + "apprunner:DescribeService", + "apprunner:DescribeVpcConnector", "apprunner:ListAutoScalingConfigurations", "apprunner:ListConnections", "apprunner:ListServices", @@ -50382,15 +52832,24 @@ "appstream:DescribeFleets", "appstream:DescribeImageBuilders", "appstream:DescribeStacks", + "appstream:ListTagsForResource", "appsync:ListGraphqlApis", + "aps:DescribeRuleGroupsNamespace", "aps:ListRuleGroupsNamespaces", + "aps:ListTagsForResource", "aps:ListWorkspaces", "athena:ListDataCatalogs", "athena:ListWorkGroups", "auditmanager:GetAccountStatus", + "auditmanager:GetAssessment", + "auditmanager:ListAssessmentFrameworks", "auditmanager:ListAssessments", + "auditmanager:ListControls", + "auditmanager:ListTagsForResource", "autoscaling:DescribeAutoScalingGroups", + "backup-gateway:GetHypervisor", "backup-gateway:ListHypervisors", + "backup-gateway:ListTagsForResource", "backup:ListBackupPlans", "backup:ListBackupVaults", "backup:ListRecoveryPointsByBackupVault", @@ -50400,6 +52859,8 @@ "batch:DescribeJobQueues", "batch:ListSchedulingPolicies", "bedrock-agentcore:ListAgentRuntimes", + "bedrock:GetFlowAlias", + "bedrock:GetInferenceProfile", "bedrock:ListAgentAliases", "bedrock:ListAgents", "bedrock:ListDataAutomationProjects", @@ -50410,6 +52871,7 @@ "bedrock:ListKnowledgeBases", "bedrock:ListPromptRouters", "bedrock:ListPrompts", + "bedrock:ListTagsForResource", "budgets:DescribeBudgetActionsForAccount", "budgets:ViewBudget", "ce:GetAnomalyMonitors", @@ -50422,7 +52884,10 @@ "chime:ListMediaPipelines", "chime:ListSipMediaApplications", "chime:ListVoiceConnectors", + "cleanrooms:GetCollaboration", "cleanrooms:ListCollaborations", + "cleanrooms:ListMembers", + "cleanrooms:ListTagsForResource", "cloud9:ListEnvironments", "cloudformation:ListResources", "cloudformation:ListStackSets", @@ -50439,40 +52904,68 @@ "cloudfront:ListRealtimeLogConfigs", "cloudfront:ListResponseHeadersPolicies", "cloudfront:ListTagsForResource", + "cloudhsm:DescribeClusters", "cloudtrail:ListChannels", "cloudtrail:ListDashboards", "cloudtrail:ListEventDataStores", + "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudwatch:DescribeAlarms", "cloudwatch:DescribeInsightRules", "cloudwatch:ListDashboards", "cloudwatch:ListMetricStreams", + "codeartifact:DescribeDomain", + "codeartifact:DescribeRepository", + "codeartifact:GetDomainPermissionsPolicy", + "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:ListDomains", "codeartifact:ListRepositories", + "codeartifact:ListTagsForResource", "codebuild:ListProjects", "codecommit:ListRepositories", "codeconnections:ListConnections", "codeconnections:ListHosts", + "codedeploy:GetApplication", + "codedeploy:GetDeploymentConfig", "codedeploy:ListApplications", "codedeploy:ListDeploymentConfigs", + "codedeploy:ListTagsForResource", + "codeguru-profiler:DescribeProfilingGroup", + "codeguru-profiler:GetNotificationConfiguration", + "codeguru-profiler:GetPolicy", "codeguru-profiler:ListProfilingGroups", + "codeguru-profiler:ListTagsForResource", + "codeguru-reviewer:DescribeRepositoryAssociation", "codeguru-reviewer:ListRepositoryAssociations", + "codeguru-reviewer:ListTagsForResource", "codepipeline:ListPipelines", "codepipeline:ListWebhooks", "codestar-connections:ListConnections", "codestar-connections:ListHosts", + "cognito-identity:DescribeIdentityPool", "cognito-identity:ListIdentityPools", + "cognito-idp:DescribeUserPool", + "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:ListUserPools", + "comprehend:DescribeFlywheel", "comprehend:ListDocumentClassifiers", "comprehend:ListEntityRecognizers", "comprehend:ListFlywheels", + "comprehend:ListTagsForResource", "config:DescribeConfigRules", + "connect:DescribeInstance", + "connect:DescribePhoneNumber", + "connect:DescribeQuickConnect", + "connect:DescribeRule", + "connect:DescribeUser", + "connect:GetTaskTemplate", "connect:ListEvaluationForms", "connect:ListHoursOfOperations", "connect:ListInstanceAttributes", "connect:ListInstances", "connect:ListPhoneNumbersV2", "connect:ListPrompts", + "connect:ListQueueEmailAddresses", "connect:ListQueueQuickConnects", "connect:ListQueues", "connect:ListQuickConnects", @@ -50660,6 +53153,8 @@ "gamelift:DescribeMatchmakingRuleSets", "gamelift:ListAliases", "gamelift:ListBuilds", + "gamelift:ListFleets", + "gamelift:ListGameServerGroups", "gamelift:ListLocations", "gamelift:ListScripts", "geo:ListMaps", @@ -50722,20 +53217,25 @@ "iot:ListBillingGroups", "iot:ListCACertificates", "iot:ListCertificates", + "iot:ListCustomMetrics", + "iot:ListDimensions", "iot:ListFleetMetrics", "iot:ListJobTemplates", "iot:ListJobs", "iot:ListMitigationActions", + "iot:ListOTAUpdates", "iot:ListPolicies", "iot:ListProvisioningTemplates", "iot:ListRoleAliases", "iot:ListScheduledAudits", "iot:ListSecurityProfiles", + "iot:ListStreams", "iot:ListThingGroups", "iot:ListThingTypes", "iot:ListThings", "iot:ListTopicRuleDestinations", "iot:ListTopicRules", + "iot:ListTunnels", "iotanalytics:ListChannels", "iotanalytics:ListDatasets", "iotanalytics:ListDatastores", @@ -50858,11 +53358,12 @@ "omics:ListReferenceStores", "omics:ListRunGroups", "omics:ListWorkflows", - "outposts:ListSites", "organizations:DescribeResourcePolicy", "organizations:ListPolicies", + "outposts:ListSites", "panorama:ListDevices", "panorama:ListPackages", + "partnercentral:ListBenefitApplications", "partnercentral:ListEngagementInvitations", "partnercentral:ListEngagements", "partnercentral:ListOpportunities", @@ -50884,10 +53385,13 @@ "quicksight:DescribeAccountSubscription", "quicksight:ListDataSets", "quicksight:ListDataSources", + "quicksight:ListFolders", "quicksight:ListTemplates", "quicksight:ListThemes", "ram:GetResourceShares", "ram:ListPermissions", + "rbin:ListRules", + "rbin:ListTagsForResource", "rds:DescribeBlueGreenDeployments", "rds:DescribeDBClusterEndpoints", "rds:DescribeDBClusterParameterGroups", @@ -50920,6 +53424,8 @@ "refactor-spaces:ListRoutes", "refactor-spaces:ListServices", "rekognition:DescribeProjects", + "rekognition:ListCollections", + "resiliencehub:ListAppAssessments", "resiliencehub:ListApps", "resiliencehub:ListResiliencyPolicies", "resource-explorer-2:GetIndex", @@ -50952,6 +53458,8 @@ "s3:ListStorageLensConfigurations", "s3:ListStorageLensGroups", "s3express:ListAllMyDirectoryBuckets", + "s3vectors:ListIndexes", + "s3vectors:ListVectorBuckets", "sagemaker:DescribeInferenceComponent", "sagemaker:ListActions", "sagemaker:ListAlgorithms", @@ -51004,6 +53512,7 @@ "ses:ListContactLists", "ses:ListDedicatedIpPools", "ses:ListEmailIdentities", + "ses:ListEmailTemplates", "shield:ListProtectionGroups", "shield:ListProtections", "signer:ListSigningProfiles", @@ -51023,6 +53532,7 @@ "states:ListStateMachines", "storagegateway:ListFileShares", "storagegateway:ListGateways", + "swf:ListDomains", "synthetics:DescribeCanaries", "synthetics:ListGroups", "transfer:ListAgreements", @@ -51033,11 +53543,13 @@ "transfer:ListUsers", "transfer:ListWorkflows", "verifiedpermissions:ListPolicyStores", + "vpc-lattice:ListAccessLogSubscriptions", "vpc-lattice:ListListeners", "vpc-lattice:ListRules", "vpc-lattice:ListServiceNetworkServiceAssociations", "vpc-lattice:ListServiceNetworks", "vpc-lattice:ListServices", + "vpc-lattice:ListTagsForResource", "vpc-lattice:ListTargetGroups", "wafv2:ListIPSets", "wafv2:ListRegexPatternSets", @@ -51089,10 +53601,30 @@ "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "connect:DescribeQueue", + "connect:ListInstances", + "connect:ListQuickConnects", + "connect:ListUserProficiencies", + "connect:ListUsers", + "databrew:DescribeDataset", + "databrew:DescribeJob", + "databrew:DescribeProject", + "databrew:DescribeRecipe", + "databrew:DescribeRuleset", + "databrew:DescribeSchedule", + "databrew:ListJobs", + "databrew:ListProjects", + "databrew:ListSchedules", + "databrew:ListTagsForResource", "dataexchange:GetRevision", "dataexchange:ListTagsForResource", + "datasync:DescribeTask", + "datasync:ListTagsForResource", + "datasync:ListTasks", + "detective:DescribeOrganizationConfiguration", + "detective:ListTagsForResource", "dlm:GetLifecyclePolicy", "dlm:ListTagsForResource", + "ds:DescribeDirectories", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeKinesisStreamingDestination", @@ -51117,6 +53649,9 @@ "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", + "emr-containers:DescribeVirtualCluster", + "emr-containers:ListVirtualClusters", + "emr-serverless:GetApplication", "es:DescribeDomain", "es:DescribeDomains", "es:ListDomainsForPackage", @@ -51126,12 +53661,46 @@ "events:ListTagsForResource", "events:ListTargetsByRule", "fis:GetExperiment", + "fis:GetExperimentTemplate", + "fis:ListTagsForResource", + "gamelift:DescribeAlias", + "gamelift:DescribeBuild", + "gamelift:DescribeGameSessionQueues", + "gamelift:DescribeMatchmakingConfigurations", + "gamelift:DescribeMatchmakingRuleSets", + "gamelift:DescribeScript", + "gamelift:ListBuilds", + "gamelift:ListLocations", + "gamelift:ListScripts", + "gamelift:ListTagsForResource", + "gamelift:ValidateMatchmakingRuleSet", + "globalaccelerator:DescribeAccelerator", + "globalaccelerator:DescribeAcceleratorAttributes", + "globalaccelerator:DescribeEndpointGroup", + "globalaccelerator:DescribeListener", + "globalaccelerator:ListTagsForResource", + "grafana:DescribeWorkspace", + "grafana:DescribeWorkspaceAuthentication", + "grafana:DescribeWorkspaceConfiguration", + "grafana:ListTagsForResource", + "greengrass:DescribeComponent", + "greengrass:ListTagsForResource", + "groundstation:GetConfig", + "groundstation:GetMissionProfile", + "groundstation:ListConfigs", + "groundstation:ListMissionProfiles", + "groundstation:ListTagsForResource", + "healthlake:DescribeFHIRDatastore", + "healthlake:ListTagsForResource", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", + "ivs:GetPlaybackKeyPair", + "ivs:ListPlaybackKeyPairs", + "ivs:ListTagsForResource", "kendra-ranking:DescribeRescoreExecutionPlan", "kendra-ranking:ListTagsForResource", "kinesis:DescribeStreamSummary", @@ -51140,6 +53709,7 @@ "kinesisvideo:DescribeStream", "kinesisvideo:ListTagsForStream", "kms:DescribeKey", + "kms:GetKeyPolicy", "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:GetFunctionCodeSigningConfig", @@ -51151,8 +53721,16 @@ "logs:DescribeResourcePolicies", "logs:GetDataProtectionPolicy", "mediaconnect:DescribeFlow", + "organizations:DescribeOrganization", "panorama:DescribeDevice", "panorama:ListTagsForResource", + "partnercentral:GetBenefitApplication", + "partnercentral:ListTagsForResource", + "profile:GetDomain", + "profile:GetProfileObjectType", + "profile:ListDomains", + "profile:ListProfileObjectTypes", + "profile:ListTagsForResource", "ram:GetPermission", "rds:ListTagsForResource", "redshift:DescribeTags", @@ -51183,8 +53761,12 @@ "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:ListTagsForResource", + "s3vectors:GetIndex", + "s3vectors:GetVectorBucket", "sagemaker:DescribeEndpoint", "sagemaker:ListTags", + "schemas:DescribeDiscoverer", + "schemas:ListDiscoverers", "secretsmanager:DescribeSecret", "sns:GetDataProtectionPolicy", "sns:GetTopicAttributes", @@ -51192,6 +53774,7 @@ "sns:ListTagsForResource", "sqs:GetQueueAttributes", "sqs:ListQueueTags", + "vpc-lattice:GetAccessLogSubscription", "xray:ListTagsForResource" ], "Effect":"Allow", @@ -51203,7 +53786,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-27T12:12:07+00:00" + "UpdateDate":"2026-07-31T20:57:12+00:00" }, "AWSResourceGroupsReadOnlyAccess":{ "CreateDate":"2018-03-07T10:27:04+00:00", @@ -51267,6 +53850,87 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2019-02-05T17:56:25+00:00" }, + "AWSRevenueAttributionManagement":{ + "CreateDate":"2026-06-30T16:57:13+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "partnercentral:CreateRevenueAttribution" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"RevenueAttributionCreation" + }, + { + "Action":[ + "partnercentral:ListRevenueAttributions" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"RevenueAttributionListing" + }, + { + "Action":[ + "partnercentral:GetRevenueAttribution", + "partnercentral:UpdateRevenueAttribution" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/revenue-attribution/*", + "Sid":"RevenueAttributionManagement" + }, + { + "Action":[ + "partnercentral:TagResource", + "partnercentral:UntagResource", + "partnercentral:ListTagsForResource" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:partnercentral:*:*:catalog/*/revenue-attribution/*" + ], + "Sid":"TaggingAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-30T16:57:13+00:00" + }, "AWSRoboMakerReadOnlyAccess":{ "CreateDate":"2018-11-26T05:30:50+00:00", "DefaultVersionId":"v2", @@ -51797,6 +54461,142 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2023-10-03T20:32:36+00:00" }, + "AWSSDMPServiceRolePolicy":{ + "CreateDate":"2026-07-24T20:57:19+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "cloudtrail:CreateServiceLinkedChannel", + "cloudtrail:GetServiceLinkedChannel", + "cloudtrail:UpdateServiceLinkedChannel", + "cloudtrail:DeleteServiceLinkedChannel" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:cloudtrail:*:*:channel/aws-service-channel/sdmp/*", + "Sid":"ManageServiceLinkedChannel" + }, + { + "Action":[ + "cloudtrail:ListServiceLinkedChannels", + "iam:ListPolicies", + "iam:ListPolicyTags", + "iam:ListRoles", + "account:ListRegions" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListOperations" + }, + { + "Action":[ + "iam:AttachRolePolicy", + "iam:CreateRole", + "iam:PutRolePolicy" + ], + "Condition":{ + "ArnEquals":{ + "iam:PermissionsBoundary":"arn:aws:iam::aws:policy/AWSDenyAll" + }, + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "aws:ResourceTag/CreatedBy":"arn:aws:iam::*:role/SDMPServiceRole*" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/SDMP-*", + "Sid":"CreateRoleWithConditions" + }, + { + "Action":"iam:TagRole", + "Condition":{ + "ForAllValues:StringEquals":{ + "aws:TagKeys":[ + "CreatedBy" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/SDMP-*", + "Sid":"AllowSDMPRoleTagging" + }, + { + "Action":"iam:AttachRolePolicy", + "Condition":{ + "ArnEquals":{ + "iam:PolicyARN":"arn:aws:iam::aws:policy/AWSDenyAll" + }, + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "aws:ResourceTag/CreatedBy":"arn:aws:iam::*:role/SDMPServiceRole*" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/SDMP-*", + "Sid":"AttachAWSDenyAll" + }, + { + "Action":[ + "iam:GetRole", + "iam:GetRolePolicy", + "iam:ListRoleTags", + "iam:ListRolePolicies", + "iam:ListAttachedRolePolicies" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/SDMP-*", + "arn:aws:iam::*:role/SDMPServiceRole*" + ], + "Sid":"ReadSDMPRoles" + }, + { + "Action":[ + "iam:GetPolicy", + "iam:GetPolicyVersion", + "iam:ListPolicyVersions" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:policy/SDMP*" + ], + "Sid":"ReadSDMPPolicies" + }, + { + "Action":[ + "guardduty:ListDetectors", + "guardduty:GetDetector", + "macie2:GetMacieSession", + "config:DescribeConfigurationRecorders", + "config:DescribeConfigurationRecorderStatus", + "securityhub:DescribeHub", + "securityhub:ListFindingAggregators", + "inspector2:BatchGetAccountStatus", + "detective:ListGraphs", + "cloudtrail:DescribeTrails", + "cloudtrail:GetTrailStatus" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowSecurityServiceVerification" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-24T20:57:19+00:00" + }, "AWSSSMForSAPServiceLinkedRolePolicy":{ "CreateDate":"2022-11-16T01:18:21+00:00", "DefaultVersionId":"v21", @@ -52774,7 +55574,7 @@ }, "AWSSecretsManagerClientReadOnlyAccess":{ "CreateDate":"2025-11-05T20:04:08+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -52786,6 +55586,15 @@ "Resource":"arn:aws:secretsmanager:*:*:secret:*", "Sid":"SecretsManagerGetAndDescribeSecret" }, + { + "Action":[ + "secretsmanager:BatchGetSecretValue", + "secretsmanager:ListSecrets" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SecretsManagerBatchGetSecrets" + }, { "Action":[ "kms:Decrypt" @@ -52805,11 +55614,96 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:00:42+00:00" + "UpdateDate":"2026-06-02T20:42:11+00:00" + }, + "AWSSecurityAgentServiceRolePolicy":{ + "CreateDate":"2026-06-11T23:42:19+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "vpc-lattice:CreateResourceGateway" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/AWSSecurityAgentManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:vpc-lattice:*:*:resourcegateway/*", + "Sid":"LatticeCreateResourceGateway" + }, + { + "Action":[ + "vpc-lattice:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/AWSSecurityAgentManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:vpc-lattice:*:*:resourcegateway/*", + "Sid":"LatticeTagResourceGateway" + }, + { + "Action":[ + "vpc-lattice:DeleteResourceGateway" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/AWSSecurityAgentManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:vpc-lattice:*:*:resourcegateway/*", + "Sid":"LatticeManageTaggedResourceGateways" + }, + { + "Action":[ + "vpc-lattice:GetResourceGateway" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/AWSSecurityAgentManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:vpc-lattice:*:*:resourcegateway/*", + "Sid":"LatticeGetResourceGateway" + }, + { + "Action":[ + "ec2:DescribeVpcs", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"DescribeApis" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringLike":{ + "iam:AWSServiceName":"vpc-lattice.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/aws-service-role/vpc-lattice.amazonaws.com/AWSServiceRoleForVpcLattice", + "Sid":"CreateLatticeServiceLinkedRole" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-11T23:42:19+00:00" }, "AWSSecurityAgentWebAppPolicy":{ "CreateDate":"2026-02-05T23:19:09+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -52831,48 +55725,63 @@ { "Action":[ "securityagent:AddArtifact", - "securityagent:BatchDeletePentests", + "securityagent:CreateThreat", "securityagent:BatchDeleteCodeReviews", + "securityagent:BatchDeletePentests", + "securityagent:BatchDeleteThreatModels", "securityagent:BatchGetAgentSpaces", "securityagent:BatchGetArtifactMetadata", - "securityagent:BatchGetFindings", - "securityagent:BatchGetPentestJobs", "securityagent:BatchGetCodeReviewJobs", - "securityagent:BatchGetPentests", + "securityagent:BatchGetCodeReviewJobTasks", "securityagent:BatchGetCodeReviews", + "securityagent:BatchGetFindings", "securityagent:BatchGetPentestJobContentMetadata", + "securityagent:BatchGetPentestJobs", "securityagent:BatchGetPentestJobTasks", - "securityagent:BatchGetCodeReviewJobTasks", + "securityagent:BatchGetPentests", + "securityagent:BatchGetThreatModelJobs", + "securityagent:BatchGetThreatModelJobTasks", + "securityagent:BatchGetThreatModels", + "securityagent:BatchGetThreats", + "securityagent:CreateCodeReview", "securityagent:CreateDesignReview", "securityagent:CreatePentest", - "securityagent:CreateCodeReview", + "securityagent:CreateThreatModel", "securityagent:DeleteArtifact", - "securityagent:GetArtifact", "securityagent:DeleteDesignReview", + "securityagent:GetArtifact", "securityagent:GetDesignReview", "securityagent:GetDesignReviewArtifact", + "securityagent:GetDesignReviewFeedback", "securityagent:ListArtifacts", - "securityagent:ListDiscoveredEndpoints", + "securityagent:ListCodeReviewJobsForCodeReview", + "securityagent:ListCodeReviewJobTasks", + "securityagent:ListCodeReviews", "securityagent:ListDesignReviewComments", "securityagent:ListDesignReviews", + "securityagent:ListDiscoveredEndpoints", "securityagent:ListFindings", "securityagent:ListIntegratedResources", "securityagent:ListPentestJobsForPentest", - "securityagent:ListCodeReviewJobsForCodeReview", - "securityagent:ListPentests", - "securityagent:ListCodeReviews", "securityagent:ListPentestJobTasks", - "securityagent:ListCodeReviewJobTasks", + "securityagent:ListPentests", + "securityagent:ListThreatModelJobs", + "securityagent:ListThreatModelJobTasks", + "securityagent:ListThreatModels", + "securityagent:ListThreats", + "securityagent:PutDesignReviewFeedback", "securityagent:StartCodeRemediation", - "securityagent:StartPentestJob", "securityagent:StartCodeReviewJob", - "securityagent:StopPentestJob", + "securityagent:StartPentestJob", + "securityagent:StartThreatModelJob", "securityagent:StopCodeReviewJob", + "securityagent:StopPentestJob", + "securityagent:StopThreatModelJob", + "securityagent:UpdateCodeReview", "securityagent:UpdateFinding", "securityagent:UpdatePentest", - "securityagent:UpdateCodeReview", - "securityagent:GetDesignReviewFeedback", - "securityagent:PutDesignReviewFeedback" + "securityagent:UpdateThreat", + "securityagent:UpdateThreatModel" ], "Condition":{ "StringEquals":{ @@ -52888,7 +55797,7 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-08T17:57:21+00:00" + "UpdateDate":"2026-06-11T18:27:14+00:00" }, "AWSSecurityHubFullAccess":{ "CreateDate":"2018-11-27T23:54:34+00:00", @@ -53089,7 +55998,7 @@ }, "AWSSecurityHubServiceRolePolicy":{ "CreateDate":"2018-11-27T23:47:51+00:00", - "DefaultVersionId":"v15", + "DefaultVersionId":"v16", "Document":{ "Statement":[ { @@ -53172,6 +56081,7 @@ { "Action":[ "config:PutServiceLinkedConfigurationRecorder", + "config:PutThirdPartyServiceLinkedConfigurationRecorder", "config:DeleteServiceLinkedConfigurationRecorder", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus" @@ -53182,6 +56092,15 @@ ], "Sid":"SecurityHubCSPMServiceRoleConfig" }, + { + "Action":[ + "config:ListConfigurationRecorders", + "config:GetConnector" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SecurityHubCSPMServiceRoleConfigListAndGet" + }, { "Action":[ "iam:CreateServiceLinkedRole" @@ -53194,17 +56113,23 @@ "Effect":"Allow", "Resource":"arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig", "Sid":"SecurityHubCSPMServiceRoleIamPermissions" + }, + { + "Action":"cloudwatch:GetMetricData", + "Effect":"Allow", + "Resource":"*", + "Sid":"SecurityHubCSPMServiceRoleConfigMetricsPermissions" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-29T14:27:11+00:00" + "UpdateDate":"2026-06-27T00:42:14+00:00" }, "AWSSecurityHubV2ServiceRolePolicy":{ "CreateDate":"2025-06-10T17:37:06+00:00", - "DefaultVersionId":"v7", + "DefaultVersionId":"v8", "Document":{ "Statement":[ { @@ -53212,15 +56137,22 @@ "config:DeleteServiceLinkedConfigurationRecorder", "config:DescribeConfigurationRecorders", "config:DescribeConfigurationRecorderStatus", - "config:PutServiceLinkedConfigurationRecorder" + "config:PutServiceLinkedConfigurationRecorder", + "config:PutThirdPartyServiceLinkedConfigurationRecorder" ], "Effect":"Allow", - "Resource":[ - "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForSecurityHubAssets/*", - "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForSecurityHubAssetsGlobal/*" - ], + "Resource":"arn:aws:config:*:*:configuration-recorder/*ConfigurationRecorderForSecurityHubAssets*", "Sid":"SecurityHubV2ServiceRoleAssetsConfig" }, + { + "Action":[ + "config:ListConfigurationRecorders", + "config:GetConnector" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SecurityHubV2ServiceRoleAssetsConfigListAndGet" + }, { "Action":[ "iam:CreateServiceLinkedRole" @@ -53238,7 +56170,9 @@ "Action":[ "securityhub:DisableSecurityHubV2", "securityhub:EnableSecurityHubV2", - "securityhub:DescribeSecurityHubV2" + "securityhub:DescribeSecurityHubV2", + "securityhub:EnableSecurityHubFeatureV2", + "securityhub:DisableSecurityHubFeatureV2" ], "Condition":{ "StringEquals":{ @@ -53307,7 +56241,7 @@ ], "Effect":"Allow", "Resource":"*", - "Sid":"SecurityHubV2ServiceRoleLambdaMetricPermissions" + "Sid":"SecurityHubV2ServiceRoleLambdaAndConfigMetricPermissions" }, { "Action":[ @@ -53383,13 +56317,72 @@ "arn:aws:iam::*:user/*" ], "Sid":"SecurityHubV2ServiceRoleAPIPolicyPermissions" + }, + { + "Action":[ + "securityhub:CreateConnector", + "securityhub:UpdateConnector", + "securityhub:DeleteConnector" + ], + "Condition":{ + "StringLikeIfExists":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:securityhub:*:*:connector/*", + "Sid":"SecurityHubConnectorPermissions" + }, + { + "Action":[ + "inspector2:CreateConnector", + "inspector2:DeleteConnector", + "inspector2:ListConnectors", + "inspector2:ListConnectorScanConfigurations", + "inspector2:UpdateConnector", + "inspector2:UpdateConnectorScanConfiguration" + ], + "Condition":{ + "StringLikeIfExists":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SecurityHubV2ServiceRoleInspectorConnectorPermissions" + }, + { + "Action":[ + "iam:CreateServiceLinkedRole" + ], + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":"thirdparty.inspector2.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/aws-service-role/thirdparty.inspector2.amazonaws.com/*", + "Sid":"SecurityHubV2ServiceRoleInspectorIamPermissions" + }, + { + "Action":"sts:GetWebIdentityToken", + "Condition":{ + "ForAnyValue:StringLike":{ + "sts:IdentityTokenAudience":[ + "api://AzureADTokenExchange" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SecurityHubV2ServiceRoleOutboundIdentityFederationPermission" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-05T20:57:18+00:00" + "UpdateDate":"2026-06-27T00:42:11+00:00" }, "AWSSecurityIncidentResponseCaseFullAccess":{ "CreateDate":"2024-12-01T23:21:05+00:00", @@ -54788,7 +57781,7 @@ }, "AWSServiceRoleForAmazonQDeveloper":{ "CreateDate":"2024-04-25T07:40:41+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -54805,13 +57798,21 @@ "Effect":"Allow", "Resource":"*", "Sid":"sid1" + }, + { + "Action":[ + "identitystore:ListGroupMembershipsForMember" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"sid2" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-04-25T07:40:41+00:00" + "UpdateDate":"2026-07-20T20:27:30+00:00" }, "AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicy":{ "CreateDate":"2020-10-01T09:49:01+00:00", @@ -55048,7 +58049,7 @@ }, "AWSServiceRoleForImageBuilder":{ "CreateDate":"2019-11-29T22:02:13+00:00", - "DefaultVersionId":"v27", + "DefaultVersionId":"v28", "Document":{ "Statement":[ { @@ -55423,6 +58424,18 @@ "arn:aws:ec2:*:*:launch-template/*" ] }, + { + "Action":[ + "ec2:AttachImageWatermark" + ], + "Condition":{ + "StringEquals":{ + "ec2:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*::image/*" + }, { "Action":[ "inspector2:ListCoverage", @@ -55520,7 +58533,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-03-17T20:42:10+00:00" + "UpdateDate":"2026-07-09T15:27:28+00:00" }, "AWSServiceRoleForIoTSiteWise":{ "CreateDate":"2018-11-14T19:19:17+00:00", @@ -56132,7 +59145,7 @@ }, "AWSServiceRoleForUserSubscriptions":{ "CreateDate":"2024-04-25T16:14:06+00:00", - "DefaultVersionId":"v7", + "DefaultVersionId":"v8", "Document":{ "Statement":[ { @@ -56145,7 +59158,8 @@ "sso:DescribeApplication", "sso:DescribeInstance", "sso:ListInstances", - "sso-directory:DescribeUser" + "sso-directory:DescribeUser", + "sso:ListApplicationAssignments" ], "Effect":"Allow", "Resource":[ @@ -56190,7 +59204,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:58:18+00:00" + "UpdateDate":"2026-06-22T08:27:22+00:00" }, "AWSServiceRolePolicyForBackupReports":{ "CreateDate":"2021-08-19T21:16:45+00:00", @@ -56373,18 +59387,56 @@ }, "AWSServiceRolePolicyForWorkspacesInstances":{ "CreateDate":"2025-06-11T20:37:06+00:00", - "DefaultVersionId":"v2", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { "Action":[ + "ec2:DescribeCapacityReservations", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeTags", "ec2:DescribeVolumes" ], "Effect":"Allow", - "Resource":"*" + "Resource":"*", + "Sid":"DescribeResources" + }, + { + "Action":"ec2:CreateCapacityReservation", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/ManagedBy":"workspaces-instances" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CreateCapacityReservation" + }, + { + "Action":[ + "ec2:ModifyCapacityReservation", + "ec2:CancelCapacityReservation" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/ManagedBy":"workspaces-instances" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"ManageTaggedCapacityReservations" + }, + { + "Action":"ec2:CreateTags", + "Condition":{ + "StringEquals":{ + "aws:RequestTag/ManagedBy":"workspaces-instances" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:capacity-reservation/*", + "Sid":"TagRemediation" }, { "Action":[ @@ -56400,14 +59452,15 @@ } }, "Effect":"Allow", - "Resource":"*" + "Resource":"*", + "Sid":"ManagedInstanceOperations" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-07T17:27:17+00:00" + "UpdateDate":"2026-06-29T23:42:20+00:00" }, "AWSShieldDRTAccessPolicy":{ "CreateDate":"2018-06-05T22:29:39+00:00", @@ -57062,9 +60115,37 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-09-09T21:21:02+00:00" }, + "AWSSupportPlansServiceRolePolicy":{ + "CreateDate":"2026-07-31T17:12:23+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "supportplans:AcceptSupportAgreement", + "supportplans:CancelSupportAgreement", + "supportplans:CreateSupportAgreement", + "supportplans:GetSupportAgreement", + "supportplans:ListSupportAgreements", + "supportplans:ListSupportAgreementRevisions", + "supportplans:RejectSupportAgreement", + "supportplans:StartSupportPlanUpdate", + "supportplans:UpdateSupportAgreement", + "organizations:ListAccounts" + ], + "Effect":"Allow", + "Resource":"*" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-31T17:12:23+00:00" + }, "AWSSupportServiceRolePolicy":{ "CreateDate":"2018-04-19T18:04:44+00:00", - "DefaultVersionId":"v57", + "DefaultVersionId":"v58", "Document":{ "Statement":[ { @@ -57164,6 +60245,25 @@ "acm:getCertificate", "acm:listCertificates", "acm:listTagsForCertificate", + "acm:searchCertificates", + "aidevops:describePrivateConnection", + "aidevops:getAccountUsage", + "aidevops:getAgentSpace", + "aidevops:getAssociation", + "aidevops:getBacklogTask", + "aidevops:getOperatorApp", + "aidevops:getRecommendation", + "aidevops:getService", + "aidevops:listAgentSpaces", + "aidevops:listAssociations", + "aidevops:listBacklogTasks", + "aidevops:listChats", + "aidevops:listExecutions", + "aidevops:listGoals", + "aidevops:listPrivateConnections", + "aidevops:listRecommendations", + "aidevops:listServices", + "aidevops:listWebHooks", "aiops:getInvestigationGroup", "aiops:getInvestigationGroupPolicy", "aiops:listInvestigationGroups", @@ -57188,19 +60288,34 @@ "amplify:listBranches", "amplify:listDomainAssociations", "amplify:listJobs", + "amplify:listResourcesForWebACL", "amplify:listWebhooks", "amplifyuibuilder:exportComponents", "amplifyuibuilder:exportThemes", + "apigateway:getPortal", + "apigateway:getPortalProduct", + "apigateway:getPortalProductSharingPolicy", + "apigateway:getProductPage", + "apigateway:getProductRestEndpointPage", + "apigateway:getRoutingRule", + "apigateway:listPortalProducts", + "apigateway:listPortals", + "apigateway:listProductPages", + "apigateway:listProductRestEndpointPages", + "apigateway:listRoutingRules", "aoss:batchGetCollection", + "aoss:batchGetCollectionGroup", "aoss:batchGetEffectiveLifecyclePolicy", "aoss:batchGetLifecyclePolicy", "aoss:batchGetVpcEndpoint", "aoss:getAccessPolicy", "aoss:getAccountSettings", + "aoss:getIndex", "aoss:getPoliciesStats", "aoss:getSecurityConfig", "aoss:getSecurityPolicy", "aoss:listAccessPolicies", + "aoss:listCollectionGroups", "aoss:listCollections", "aoss:listLifecyclePolicies", "aoss:listSecurityConfigs", @@ -57280,6 +60395,7 @@ "apprunner:listConnections", "apprunner:listObservabilityConfigurations", "apprunner:listOperations", + "apprunner:listAssociatedServicesForWebAcl", "apprunner:listServices", "apprunner:listTagsForResource", "apprunner:listVpcConnectors", @@ -57398,6 +60514,10 @@ "autoscaling:describeTerminationPolicyTypes", "autoscaling:describeTrafficSources", "autoscaling:describeWarmPool", + "aws-marketplace:describeAgreement", + "aws-marketplace:describeEntity", + "aws-marketplace:listEntities", + "aws-marketplace:searchAgreements", "backup-gateway:getBandwidthRateLimitSchedule", "backup-gateway:getGateway", "backup-gateway:getHypervisor", @@ -57460,16 +60580,28 @@ "backup:listTags", "backup:listTieringConfigurations", "batch:describeComputeEnvironments", + "batch:describeConsumableResource", "batch:describeJobDefinitions", "batch:describeJobQueues", "batch:describeJobs", "batch:describeSchedulingPolicies", + "batch:describeServiceEnvironments", + "batch:describeServiceJob", + "batch:getJobQueueSnapshot", + "batch:listConsumableResources", "batch:listJobs", + "batch:listJobsByConsumableResource", + "batch:listSchedulingPolicies", + "batch:listServiceJobs", + "batch:listTagsForResource", + "bedrock:exportAutomatedReasoningPolicyVersion", "bedrock:getAgent", "bedrock:getAgentActionGroup", "bedrock:getAgentAlias", "bedrock:getAgentKnowledgeBase", + "bedrock:getAgentMemory", "bedrock:getAgentVersion", + "bedrock:getAsyncInvoke", "bedrock:getAutomatedReasoningPolicy", "bedrock:getAutomatedReasoningPolicyAnnotations", "bedrock:getAutomatedReasoningPolicyBuildWorkflow", @@ -57477,17 +60609,25 @@ "bedrock:getAutomatedReasoningPolicyNextScenario", "bedrock:getAutomatedReasoningPolicyTestCase", "bedrock:getAutomatedReasoningPolicyTestResult", + "bedrock:getBlueprint", "bedrock:getCustomModel", + "bedrock:getCustomModelDeployment", + "bedrock:getDataAutomationProject", + "bedrock:getDataAutomationStatus", "bedrock:getDataSource", "bedrock:getEvaluationJob", + "bedrock:getExecutionFlowSnapshot", "bedrock:getFlow", "bedrock:getFlowAlias", + "bedrock:getFlowExecution", "bedrock:getFlowVersion", "bedrock:getFoundationModel", + "bedrock:getFoundationModelAvailability", "bedrock:getGuardrail", "bedrock:getImportedModel", "bedrock:getInferenceProfile", "bedrock:getIngestionJob", + "bedrock:getInvocationStep", "bedrock:getKnowledgeBase", "bedrock:getMarketplaceModelEndpoint", "bedrock:getModelCopyJob", @@ -57498,27 +60638,37 @@ "bedrock:getPrompt", "bedrock:getPromptRouter", "bedrock:getProvisionedModelThroughput", + "bedrock:getSession", + "bedrock:getUseCaseForModelAccess", "bedrock:listAgentActionGroups", "bedrock:listAgentAliases", "bedrock:listAgentKnowledgeBases", "bedrock:listAgents", "bedrock:listAgentVersions", + "bedrock:listAsyncInvokes", "bedrock:listAutomatedReasoningPolicies", "bedrock:listAutomatedReasoningPolicyBuildWorkflows", "bedrock:listAutomatedReasoningPolicyTestCases", "bedrock:listAutomatedReasoningPolicyTestResults", + "bedrock:listBlueprints", + "bedrock:listCustomModelDeployments", "bedrock:listCustomModels", + "bedrock:listDataAutomationProjects", "bedrock:listDataSources", + "bedrock:listEnforcedGuardrailsConfiguration", "bedrock:listEvaluationJobs", - "bedrock:exportAutomatedReasoningPolicyVersion", "bedrock:listFlowAliases", + "bedrock:listFlowExecutionEvents", + "bedrock:listFlowExecutions", "bedrock:listFlows", "bedrock:listFlowVersions", + "bedrock:listFoundationModelAgreementOffers", "bedrock:listFoundationModels", "bedrock:listGuardrails", "bedrock:listImportedModels", "bedrock:listInferenceProfiles", "bedrock:listIngestionJobs", + "bedrock:listInvocationSteps", "bedrock:listKnowledgeBases", "bedrock:listMarketplaceModelEndpoints", "bedrock:listModelCopyJobs", @@ -57528,6 +60678,7 @@ "bedrock:listPromptRouters", "bedrock:listPrompts", "bedrock:listProvisionedModelThroughputs", + "bedrock:listSessions", "bedrock-agentcore:getAgentCard", "bedrock-agentcore:getAgentRuntime", "bedrock-agentcore:getAgentRuntimeEndpoint", @@ -57661,6 +60812,7 @@ "cloudformation:describeAccountLimits", "cloudformation:describeChangeSet", "cloudformation:describeChangeSetHooks", + "cloudformation:describeEvents", "cloudformation:describePublisher", "cloudformation:describeStackDriftDetectionStatus", "cloudformation:describeStackEvents", @@ -57691,6 +60843,7 @@ "cloudformation:listTypeRegistrations", "cloudformation:listTypes", "cloudformation:listTypeVersions", + "cloudfront:describeConnectionFunction", "cloudfront:describeFunction", "cloudfront:describeKeyValueStore", "cloudfront:getAnycastIpList", @@ -57698,13 +60851,20 @@ "cloudfront:getCachePolicyConfig", "cloudfront:getCloudFrontOriginAccessIdentity", "cloudfront:getCloudFrontOriginAccessIdentityConfig", + "cloudfront:getConnectionFunction", + "cloudfront:getConnectionGroup", + "cloudfront:getConnectionGroupByRoutingEndpoint", "cloudfront:getContinuousDeploymentPolicy", "cloudfront:getContinuousDeploymentPolicyConfig", "cloudfront:getDistribution", "cloudfront:getDistributionConfig", + "cloudfront:getDistributionTenant", + "cloudfront:getDistributionTenantByDomain", "cloudfront:getInvalidation", + "cloudfront:getInvalidationForDistributionTenant", "cloudfront:getKeyGroup", "cloudfront:getKeyGroupConfig", + "cloudfront:getManagedCertificateDetails", "cloudfront:getMonitoringSubscription", "cloudfront:getOriginAccessControl", "cloudfront:getOriginAccessControlConfig", @@ -57713,27 +60873,38 @@ "cloudfront:getPublicKey", "cloudfront:getPublicKeyConfig", "cloudfront:getRealtimeLogConfig", + "cloudfront:getResourcePolicy", "cloudfront:getResponseHeadersPolicy", "cloudfront:getResponseHeadersPolicyConfig", "cloudfront:getStreamingDistribution", "cloudfront:getStreamingDistributionConfig", + "cloudfront:getTrustStore", "cloudfront:getVpcOrigin", "cloudfront:listAnycastIpLists", "cloudfront:listCachePolicies", "cloudfront:listCloudFrontOriginAccessIdentities", + "cloudfront:listConnectionFunctions", + "cloudfront:listConnectionGroups", "cloudfront:listConflictingAliases", "cloudfront:listContinuousDeploymentPolicies", "cloudfront:listDistributions", "cloudfront:listDistributionsByAnycastIpListId", "cloudfront:listDistributionsByCachePolicyId", + "cloudfront:listDistributionsByConnectionFunction", + "cloudfront:listDistributionsByConnectionMode", "cloudfront:listDistributionsByKeyGroup", "cloudfront:listDistributionsByOriginRequestPolicyId", "cloudfront:listDistributionsByRealtimeLogConfig", "cloudfront:listDistributionsByResponseHeadersPolicyId", + "cloudfront:listDistributionsByTrustStore", "cloudfront:listDistributionsByVpcOriginId", "cloudfront:listDistributionsByWebACLId", + "cloudfront:listDistributionTenants", + "cloudfront:listDistributionTenantsByCustomization", + "cloudfront:listDomainConflicts", "cloudfront:listFunctions", "cloudfront:listInvalidations", + "cloudfront:listInvalidationsForDistributionTenant", "cloudfront:listKeyGroups", "cloudfront:listKeyValueStores", "cloudfront:listOriginAccessControls", @@ -57742,6 +60913,8 @@ "cloudfront:listRealtimeLogConfigs", "cloudfront:listResponseHeadersPolicies", "cloudfront:listStreamingDistributions", + "cloudfront:listTagsForResource", + "cloudfront:listTrustStores", "cloudfront:listVpcOrigins", "cloudhsm:describeBackups", "cloudhsm:describeClusters", @@ -57759,6 +60932,7 @@ "cloudtrail:getInsightSelectors", "cloudtrail:getTrail", "cloudtrail:getTrailStatus", + "cloudtrail:listEventDataStores", "cloudtrail:listPublicKeys", "cloudtrail:listTags", "cloudtrail:listTrails", @@ -57873,6 +61047,8 @@ "cognito-identity:listIdentityPools", "cognito-identity:lookupDeveloperIdentity", "cognito-idp:describeIdentityProvider", + "cognito-idp:describeManagedLoginBranding", + "cognito-idp:describeManagedLoginBrandingByClient", "cognito-idp:describeResourceServer", "cognito-idp:describeRiskConfiguration", "cognito-idp:describeUserImportJob", @@ -57884,9 +61060,11 @@ "cognito-idp:getLogDeliveryConfiguration", "cognito-idp:getUICustomization", "cognito-idp:getUserPoolMfaConfig", + "cognito-idp:getWebACLForResource", "cognito-idp:listGroups", "cognito-idp:listIdentityProviders", "cognito-idp:listResourceServers", + "cognito-idp:listResourcesForWebACL", "cognito-idp:listUserImportJobs", "cognito-idp:listUserPoolClients", "cognito-idp:listUserPools", @@ -58014,6 +61192,7 @@ "connect:searchRoutingProfiles", "connect:searchUsers", "connect-campaigns:describeCampaign", + "controlcatalog:getControl", "controltower:describeAccountFactoryConfig", "controltower:describeCoreService", "controltower:describeGuardrail", @@ -58028,6 +61207,7 @@ "controltower:getHomeRegion", "controltower:getLandingZone", "controltower:getLandingZoneStatus", + "controltower:listBaselines", "controltower:listDirectoryGroups", "controltower:listEnabledControls", "controltower:listEnabledBaselines", @@ -58158,10 +61338,14 @@ "devicefarm:getTestGridProject", "devicefarm:getTestGridSession", "devicefarm:getUpload", + "devicefarm:getVPCEConfiguration", "devicefarm:listArtifacts", "devicefarm:listDevicePools", "devicefarm:listDevices", "devicefarm:listJobs", + "devicefarm:listNetworkProfiles", + "devicefarm:listOfferingPromotions", + "devicefarm:listOfferingTransactions", "devicefarm:listProjects", "devicefarm:listRemoteAccessSessions", "devicefarm:listRuns", @@ -58174,6 +61358,7 @@ "devicefarm:listTests", "devicefarm:listUniqueProblems", "devicefarm:listUploads", + "devicefarm:listVPCEConfigurations", "directconnect:describeConnectionLoa", "directconnect:describeConnections", "directconnect:describeConnectionsOnInterconnect", @@ -58412,6 +61597,7 @@ "ec2:describeVerifiedAccessGroups", "ec2:describeVerifiedAccessInstanceLoggingConfigurations", "ec2:describeVerifiedAccessInstances", + "ec2:describeVerifiedAccessInstanceWebAclAssociations", "ec2:describeVerifiedAccessTrustProviders", "ec2:describeVolumeAttribute", "ec2:describeVolumes", @@ -58429,6 +61615,7 @@ "ec2:describeVpcEndpointServiceConfigurations", "ec2:describeVpcEndpointServicePermissions", "ec2:describeVpcEndpointServices", + "ec2:describeVpcEncryptionControls", "ec2:describeVpcPeeringConnections", "ec2:describeVpcs", "ec2:describeVpnConnections", @@ -58476,6 +61663,7 @@ "ec2:getTransitGatewayRouteTablePropagations", "ec2:getVerifiedAccessEndpointPolicy", "ec2:getVerifiedAccessGroupPolicy", + "ec2:getVpcResourcesBlockingEncryptionEnforcement", "ec2:listImagesInRecycleBin", "ec2:listSnapshotsInRecycleBin", "ec2:searchLocalGatewayRoutes", @@ -58490,19 +61678,27 @@ "ecr-public:getRepositoryPolicy", "ecr-public:listTagsForResource", "ecr:batchCheckLayerAvailability", + "ecr:batchGetImage", "ecr:batchGetRepositoryScanningConfiguration", "ecr:describeImageReplicationStatus", "ecr:describeImages", "ecr:describeImageScanFindings", + "ecr:describeImageSigningStatus", "ecr:describePullThroughCacheRules", "ecr:describeRegistry", "ecr:describeRepositories", + "ecr:describeRepositoryCreationTemplates", + "ecr:getAccountSetting", + "ecr:getAuthorizationToken", + "ecr:getDownloadUrlForLayer", "ecr:getLifecyclePolicy", "ecr:getLifecyclePolicyPreview", "ecr:getRegistryPolicy", "ecr:getRegistryScanningConfiguration", "ecr:getRepositoryPolicy", + "ecr:getSigningConfiguration", "ecr:listImages", + "ecr:listPullTimeUpdateExclusions", "ecr:listTagsForResource", "ecs:describeCapacityProviders", "ecs:describeClusters", @@ -58598,6 +61794,7 @@ "elasticbeanstalk:listAvailableSolutionStacks", "elasticbeanstalk:listPlatformBranches", "elasticbeanstalk:listPlatformVersions", + "elasticbeanstalk:listTagsForResource", "elasticbeanstalk:describeConfigurationSettings", "elasticbeanstalk:validateConfigurationSettings", "elasticfilesystem:describeAccessPoints", @@ -58661,6 +61858,20 @@ "emr-serverless:getApplication", "emr-serverless:getJobRun", "emr-serverless:listApplications", + "emr-serverless:listJobRunAttempts", + "emr-serverless:listJobRuns", + "entityresolution:getIdMappingJob", + "entityresolution:getIdMappingWorkflow", + "entityresolution:getMatchingJob", + "entityresolution:getMatchingWorkflow", + "entityresolution:getProviderService", + "entityresolution:getSchemaMapping", + "entityresolution:listIdMappingJobs", + "entityresolution:listIdMappingWorkflows", + "entityresolution:listMatchingJobs", + "entityresolution:listMatchingWorkflows", + "entityresolution:listProviderServices", + "entityresolution:listSchemaMappings", "es:describeDomain", "es:describeDomainAutoTunes", "es:describeDomainChangeProgress", @@ -58675,6 +61886,7 @@ "es:getDomainMaintenanceStatus", "es:describeInboundConnections", "es:describeInstanceTypeLimits", + "es:describeInsightDetails", "es:describeOutboundConnections", "es:describePackages", "es:describeReservedInstanceOfferings", @@ -58688,6 +61900,7 @@ "es:listDomainNames", "es:listDomainsForPackage", "es:listInstanceTypeDetails", + "es:listInsights", "es:listPackagesForDomain", "es:listScheduledActions", "es:listTags", @@ -58717,6 +61930,12 @@ "events:listRules", "events:listTargetsByRule", "events:testEventPattern", + "evs:getEnvironment", + "evs:getVersions", + "evs:listEnvironmentHosts", + "evs:listEnvironments", + "evs:listEnvironmentVlans", + "evs:listTagsForResource", "firehose:describeDeliveryStream", "firehose:listDeliveryStreams", "fis:getAction", @@ -59097,6 +62316,7 @@ "iam:simulatePrincipalPolicy", "identitystore:describeGroup", "identitystore:describeGroupMembership", + "identitystore:describeUser", "identitystore:getGroupId", "identitystore:getGroupMembershipId", "identitystore:getUserId", @@ -59104,6 +62324,7 @@ "identitystore:listGroupMemberships", "identitystore:listGroupMembershipsForMember", "identitystore:listGroups", + "identitystore:listUsers", "imagebuilder:getComponent", "imagebuilder:getComponentPolicy", "imagebuilder:getContainerRecipe", @@ -59331,6 +62552,8 @@ "kafka:describeConfiguration", "kafka:describeConfigurationRevision", "kafka:describeReplicator", + "kafka:describeTopic", + "kafka:describeTopicPartitions", "kafka:describeVpcConnection", "kafka:getBootstrapBrokers", "kafka:getClusterPolicy", @@ -59344,6 +62567,8 @@ "kafka:listNodes", "kafka:listReplicators", "kafka:listScramSecrets", + "kafka:listTagsForResource", + "kafka:listTopics", "kafka:listVpcConnections", "kafkaconnect:describeConnector", "kafkaconnect:describeCustomPlugin", @@ -59351,12 +62576,27 @@ "kafkaconnect:listConnectors", "kafkaconnect:listCustomPlugins", "kafkaconnect:listWorkerConfigurations", + "kendra:describeAccessControlConfiguration", "kendra:describeDataSource", + "kendra:describeExperience", "kendra:describeFaq", + "kendra:describeFeaturedResultsSet", "kendra:describeIndex", + "kendra:describePrincipalMapping", + "kendra:describeQuerySuggestionsBlockList", + "kendra:describeQuerySuggestionsConfig", + "kendra:describeThesaurus", + "kendra:listAccessControlConfigurations", + "kendra:listDataSourceSyncJobs", "kendra:listDataSources", + "kendra:listEntityPersonas", + "kendra:listExperienceEntities", + "kendra:listExperiences", "kendra:listFaqs", + "kendra:listFeaturedResultsSets", "kendra:listIndices", + "kendra:listQuerySuggestionsBlockLists", + "kendra:listThesauri", "kinesis:describeStream", "kinesis:describeStreamConsumer", "kinesis:describeStreamSummary", @@ -59384,12 +62624,14 @@ "kinesisvideo:listSignalingChannels", "kinesisvideo:listEdgeAgentConfigurations", "kinesisvideo:listStreams", + "kms:describeCustomKeyStores", "kms:describeKey", "kms:getKeyPolicy", "kms:getKeyRotationStatus", "kms:listAliases", "kms:listGrants", "kms:listKeyPolicies", + "kms:listKeyRotations", "kms:listKeys", "kms:listResourceTags", "kms:listRetirableGrants", @@ -59414,6 +62656,9 @@ "lambda:getAccountSettings", "lambda:getAlias", "lambda:getCodeSigningConfig", + "lambda:getDurableExecution", + "lambda:getDurableExecutionHistory", + "lambda:getDurableExecutionState", "lambda:getEventSourceMapping", "lambda:getFunction", "lambda:getFunctionCodeSigningConfig", @@ -59432,6 +62677,7 @@ "lambda:listAliases", "lambda:listCapacityProviders", "lambda:listCodeSigningConfigs", + "lambda:listDurableExecutionsByFunction", "lambda:listEventSourceMappings", "lambda:listFunctionEventInvokeConfigs", "lambda:listFunctions", @@ -59992,6 +63238,12 @@ "payment-cryptography:getKey", "payment-cryptography:listAliases", "payment-cryptography:listKeys", + "pca-connector-ad:listConnectors", + "pca-connector-ad:listDirectoryRegistrations", + "pca-connector-ad:listServicePrincipalNames", + "pca-connector-ad:listTagsForResource", + "pca-connector-ad:listTemplateGroupAccessControlEntries", + "pca-connector-ad:listTemplates", "pcs:getCluster", "pcs:getComputeNodeGroup", "pcs:getQueue", @@ -60002,6 +63254,7 @@ "personalize:describeBatchInferenceJob", "personalize:describeBatchSegmentJob", "personalize:describeCampaign", + "personalize:describeDataInsightsJob", "personalize:describeDataset", "personalize:describeDatasetExportJob", "personalize:describeDatasetGroup", @@ -60009,6 +63262,7 @@ "personalize:describeEventTracker", "personalize:describeFeatureTransformation", "personalize:describeFilter", + "personalize:describeMetricAttribution", "personalize:describeRecipe", "personalize:describeRecommender", "personalize:describeSchema", @@ -60020,11 +63274,13 @@ "personalize:listBatchInferenceJobs", "personalize:listBatchSegmentJobs", "personalize:listCampaigns", + "personalize:listDataInsightsJobs", "personalize:listDatasetExportJobs", "personalize:listDatasetGroups", "personalize:listDatasetImportJobs", "personalize:listDatasets", "personalize:listEventTrackers", + "personalize:listMetricAttributions", "personalize:listRecipes", "personalize:listRecommenders", "personalize:listSchemas", @@ -60422,9 +63678,12 @@ "rum:listAppMonitors", "rum:listRumMetricsDestinations", "s3-outposts:getLifecycleConfiguration", + "s3-outposts:getAccessPoint", + "s3-outposts:getAccessPointPolicy", "s3-outposts:getBucketPolicy", "s3-outposts:getBucketVersioning", "s3-outposts:getReplicationConfiguration", + "s3-outposts:listAccessPoints", "s3-outposts:listEndpoints", "s3-outposts:listOutpostsWithS3", "s3-outposts:listRegionalBuckets", @@ -60492,12 +63751,20 @@ "s3tables:getTableBucket", "s3tables:getTableBucketEncryption", "s3tables:getTableBucketMaintenanceConfiguration", + "s3tables:getTableBucketMetricsConfiguration", "s3tables:getTableBucketPolicy", + "s3tables:getTableBucketReplication", + "s3tables:getTableBucketStorageClass", "s3tables:getTableEncryption", "s3tables:getTableMaintenanceConfiguration", "s3tables:getTableMaintenanceJobStatus", "s3tables:getTableMetadataLocation", "s3tables:getTablePolicy", + "s3tables:getTableRecordExpirationConfiguration", + "s3tables:getTableRecordExpirationJobStatus", + "s3tables:getTableReplication", + "s3tables:getTableReplicationStatus", + "s3tables:getTableStorageClass", "s3tables:listNamespaces", "s3tables:listTableBuckets", "s3tables:listTables", @@ -60512,10 +63779,14 @@ "sagemaker:describeAppImageConfig", "sagemaker:describeArtifact", "sagemaker:describeAutoMLJob", + "sagemaker:describeAutoMLJobV2", "sagemaker:describeCluster", "sagemaker:describeClusterNode", + "sagemaker:describeClusterEvent", + "sagemaker:describeClusterSchedulerConfig", "sagemaker:describeCodeRepository", "sagemaker:describeCompilationJob", + "sagemaker:describeComputeQuota", "sagemaker:describeContext", "sagemaker:describeDataQualityJobDefinition", "sagemaker:describeDevice", @@ -60539,6 +63810,8 @@ "sagemaker:describeInferenceExperiment", "sagemaker:describeInferenceRecommendationsJob", "sagemaker:describeLabelingJob", + "sagemaker:describeLineageGroup", + "sagemaker:describeMlflowApp", "sagemaker:describeMlflowTrackingServer", "sagemaker:describeModel", "sagemaker:describeModelBiasJobDefinition", @@ -60551,16 +63824,19 @@ "sagemaker:describeMonitoringSchedule", "sagemaker:describeNotebookInstance", "sagemaker:describeNotebookInstanceLifecycleConfig", + "sagemaker:describeOptimizationJob", "sagemaker:describePipeline", "sagemaker:describePipelineDefinitionForExecution", "sagemaker:describePipelineExecution", "sagemaker:describePartnerApp", "sagemaker:describeProcessingJob", "sagemaker:describeProject", + "sagemaker:describeReservedCapacity", "sagemaker:describeSpace", "sagemaker:describeStudioLifecycleConfig", "sagemaker:describeSubscribedWorkteam", "sagemaker:describeTrainingJob", + "sagemaker:describeTrainingPlan", "sagemaker:describeTransformJob", "sagemaker:describeTrial", "sagemaker:describeTrialComponent", @@ -60569,6 +63845,7 @@ "sagemaker:describeWorkteam", "sagemaker:getDeviceFleetReport", "sagemaker:getModelPackageGroupPolicy", + "sagemaker:getLineageGroupPolicy", "sagemaker:getSagemakerServicecatalogPortfolioStatus", "sagemaker:listActions", "sagemaker:listAlgorithms", @@ -60581,8 +63858,11 @@ "sagemaker:listCandidatesForAutoMLJob", "sagemaker:listClusterNodes", "sagemaker:listClusters", + "sagemaker:listClusterEvents", + "sagemaker:listClusterSchedulerConfigs", "sagemaker:listCodeRepositories", "sagemaker:listCompilationJobs", + "sagemaker:listComputeQuotas", "sagemaker:listContexts", "sagemaker:listDataQualityJobDefinitions", "sagemaker:listDeviceFleets", @@ -60609,6 +63889,7 @@ "sagemaker:listLabelingJobs", "sagemaker:listLabelingJobsForWorkteam", "sagemaker:listLineageGroups", + "sagemaker:listMlflowApps", "sagemaker:listMlflowTrackingServers", "sagemaker:listModelBiasJobDefinitions", "sagemaker:listModelCardExportJobs", @@ -60626,13 +63907,16 @@ "sagemaker:listMonitoringSchedules", "sagemaker:listNotebookInstanceLifecycleConfigs", "sagemaker:listNotebookInstances", + "sagemaker:listOptimizationJobs", "sagemaker:listPartnerApps", "sagemaker:listPipelineExecutions", "sagemaker:listPipelineExecutionSteps", "sagemaker:listPipelineParametersForExecution", "sagemaker:listPipelines", + "sagemaker:listPipelineVersions", "sagemaker:listProcessingJobs", "sagemaker:listProjects", + "sagemaker:listResourceCatalogs", "sagemaker:listSpaces", "sagemaker:listStageDevices", "sagemaker:listStudioLifecycleConfigs", @@ -60640,12 +63924,15 @@ "sagemaker:listTags", "sagemaker:listTrainingJobs", "sagemaker:listTrainingJobsForHyperParameterTuningJob", + "sagemaker:listTrainingPlans", "sagemaker:listTransformJobs", "sagemaker:listTrialComponents", "sagemaker:listTrials", "sagemaker:listUserProfiles", + "sagemaker:listUltraServersByReservedCapacity", "sagemaker:listWorkforces", "sagemaker:listWorkteams", + "sagemaker:search", "savingsplans:describeSavingsPlans", "scheduler:getSchedule", "scheduler:getScheduleGroup", @@ -60668,6 +63955,10 @@ "secretsmanager:getResourcePolicy", "secretsmanager:listSecrets", "secretsmanager:listSecretVersionIds", + "security-ir:batchGetMemberAccountDetails", + "security-ir:getMembership", + "security-ir:listCases", + "security-ir:listMemberships", "securityhub:batchGetAutomationRules", "securityhub:batchGetConfigurationPolicyAssociations", "securityhub:describeHub", @@ -61072,6 +64363,8 @@ "swf:listDomains", "swf:listOpenWorkflowExecutions", "swf:listWorkflowTypes", + "sustainability:getEstimatedCarbonEmissions", + "sustainability:getEstimatedCarbonEmissionsDimensionValues", "synthetics:describeCanaries", "synthetics:describeCanariesLastRun", "synthetics:describeRuntimeVersions", @@ -61169,6 +64462,7 @@ "verifiedpermissions:listPolicyTemplates", "vpc-lattice:getAccessLogSubscription", "vpc-lattice:getAuthPolicy", + "vpc-lattice:getDomainVerification", "vpc-lattice:getListener", "vpc-lattice:getResourceConfiguration", "vpc-lattice:getResourceGateway", @@ -61181,14 +64475,17 @@ "vpc-lattice:getServiceNetworkVpcAssociation", "vpc-lattice:getTargetGroup", "vpc-lattice:listAccessLogSubscriptions", + "vpc-lattice:listDomainVerifications", "vpc-lattice:listListeners", "vpc-lattice:listResourceConfigurations", + "vpc-lattice:listResourceEndpointAssociations", "vpc-lattice:listResourceGateways", "vpc-lattice:listRules", "vpc-lattice:listServiceNetworks", "vpc-lattice:listServiceNetworkResourceAssociations", "vpc-lattice:listServiceNetworkServiceAssociations", "vpc-lattice:listServiceNetworkVpcAssociations", + "vpc-lattice:listServiceNetworkVpcEndpointAssociations", "vpc-lattice:listServices", "vpc-lattice:listTargetGroups", "vpc-lattice:listTargets", @@ -61334,7 +64631,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-22T18:27:07+00:00" + "UpdateDate":"2026-06-22T22:42:15+00:00" }, "AWSSystemsManagerAccountDiscoveryServicePolicy":{ "CreateDate":"2019-10-24T17:21:05+00:00", @@ -63300,7 +66597,7 @@ }, "AWSThinkboxDeadlineResourceTrackerAdminPolicy":{ "CreateDate":"2020-05-27T19:29:09+00:00", - "DefaultVersionId":"v8", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { @@ -63528,8 +66825,8 @@ ], "Effect":"Allow", "Resource":[ - "arn:aws:s3:::*/deadline_aws_resource_tracker-*.zip", - "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate-*.yaml" + "arn:aws:s3:::*/deadline_aws_resource_tracker*.zip", + "arn:aws:s3:::*/DeadlineAWSResourceTrackerTemplate*.yaml" ], "Sid":"AWSThinkboxDeadlineResourceTracker16" }, @@ -63554,7 +66851,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-11-12T19:29:09+00:00" + "UpdateDate":"2026-07-16T17:42:11+00:00" }, "AWSThinkboxDeadlineSpotEventPluginAdminPolicy":{ "CreateDate":"2020-05-27T19:38:34+00:00", @@ -64690,6 +67987,630 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-04-27T19:27:10+00:00" }, + "AWSTransformInfrastructureExecutorAccessBatch":{ + "CreateDate":"2026-07-20T20:12:13+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "lambda:InvokeFunction", + "lambda:GetFunctionConfiguration" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:lambda:*:*:function:atx-trigger-job-*", + "arn:aws:lambda:*:*:function:atx-trigger-batch-jobs-*", + "arn:aws:lambda:*:*:function:atx-get-job-status-*", + "arn:aws:lambda:*:*:function:atx-get-batch-status-*", + "arn:aws:lambda:*:*:function:atx-list-jobs-*", + "arn:aws:lambda:*:*:function:atx-list-batches-*" + ], + "Sid":"LambdaInvokeATXFunctions" + }, + { + "Action":[ + "s3:PutObject", + "s3:GetObject", + "s3:ListBucket", + "s3:AbortMultipartUpload" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-source-code-*", + "arn:aws:s3:::atx-source-code-*/*" + ], + "Sid":"S3UploadSourceCode" + }, + { + "Action":[ + "s3:GetObject", + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-custom-output-*", + "arn:aws:s3:::atx-custom-output-*/*", + "arn:aws:s3:::atx-ct-output-*", + "arn:aws:s3:::atx-ct-output-*/*" + ], + "Sid":"S3DownloadResults" + }, + { + "Action":[ + "s3:PutObject", + "s3:AbortMultipartUpload" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-custom-output-*/*" + ], + "Sid":"S3WriteBatchSidecar" + }, + { + "Action":[ + "kms:Encrypt", + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Condition":{ + "ForAnyValue:StringLike":{ + "kms:ResourceAliases":[ + "alias/atx-encryption-key", + "alias/atx-encryption-key-*" + ] + }, + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"KMSEncryptDecrypt" + }, + { + "Action":[ + "logs:GetLogEvents", + "logs:FilterLogEvents", + "logs:DescribeLogStreams" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:logs:*:*:log-group:/aws/batch/atx-transform*", + "arn:aws:logs:*:*:log-group:/aws/batch/job*", + "arn:aws:logs:*:*:log-group:AtxVpc*", + "arn:aws:logs:*:*:log-group:/aws/lambda/atx-*" + ], + "Sid":"CloudWatchReadLogs" + }, + { + "Action":[ + "cloudwatch:GetDashboard", + "cloudwatch:ListDashboards" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard", + "arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard-*" + ], + "Sid":"CloudWatchDashboard" + }, + { + "Action":[ + "batch:DescribeComputeEnvironments", + "batch:DescribeJobQueues", + "batch:DescribeJobDefinitions", + "batch:DescribeJobs", + "batch:ListJobs" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"BatchDescribe" + }, + { + "Action":"cloudformation:DescribeStacks", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack/*", + "arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack-*/*", + "arn:aws:cloudformation:*:*:stack/atx-*", + "arn:aws:cloudformation:*:*:stack/atx-*/*", + "arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*" + ], + "Sid":"CheckInfrastructureStatus" + }, + { + "Action":[ + "secretsmanager:GetSecretValue", + "secretsmanager:DescribeSecret" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:secretsmanager:*:*:secret:atx/*", + "Sid":"SecretsManagerATXSecrets" + }, + { + "Action":[ + "scheduler:CreateSchedule", + "scheduler:DeleteSchedule", + "scheduler:GetSchedule", + "scheduler:UpdateSchedule", + "scheduler:GetScheduleGroup", + "scheduler:ListSchedules" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:scheduler:*:*:schedule-group/atx-ct", + "arn:aws:scheduler:*:*:schedule-group/atx-ct-*", + "arn:aws:scheduler:*:*:schedule/atx-ct/*", + "arn:aws:scheduler:*:*:schedule/atx-ct-*/*" + ], + "Sid":"SchedulerManage" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "iam:PassedToService":"scheduler.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/AtxSchedulerInvocationRole", + "arn:aws:iam::*:role/AtxSchedulerInvocationRole-*" + ], + "Sid":"PassSchedulerRole" + }, + { + "Action":[ + "ec2:DescribeVpcs", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups", + "ec2:DescribeRouteTables", + "ec2:DescribeNatGateways" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2NetworkDiscovery" + }, + { + "Action":[ + "iam:GetRole", + "iam:ListAttachedRolePolicies", + "iam:GetRolePolicy" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/ATX*", + "arn:aws:iam::*:role/Atx*" + ], + "Sid":"IAMReadRoles" + }, + { + "Action":"tag:GetResources", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TagGetATXStacks" + }, + { + "Action":"cloudformation:ListStacks", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CFNListStacksForDetect" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-28T15:42:28+00:00" + }, + "AWSTransformInfrastructureExecutorAccessEC2":{ + "CreateDate":"2026-07-20T20:12:18+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "cloudformation:DescribeStacks", + "cloudformation:DescribeStackEvents", + "cloudformation:DescribeStackResources", + "cloudformation:DescribeStackDriftDetectionStatus" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:cloudformation:*:*:stack/atx-*/*", + "arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*" + ], + "Sid":"CFNRead" + }, + { + "Action":"cloudformation:ValidateTemplate", + "Effect":"Allow", + "Resource":"*", + "Sid":"CFNValidateTemplate" + }, + { + "Action":[ + "ec2:DescribeInstances", + "ec2:DescribeImages", + "ec2:DescribeVpcs", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups", + "ec2:DescribeKeyPairs", + "ec2:DescribeRouteTables", + "ec2:DescribeNatGateways", + "ec2:DescribeInternetGateways" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2Desc" + }, + { + "Action":[ + "ec2:StartInstances", + "ec2:StopInstances" + ], + "Condition":{ + "StringEquals":{ + "ec2:ResourceTag/atx-remote-infra":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:instance/*", + "Sid":"EC2PowerState" + }, + { + "Action":[ + "ssm:GetCommandInvocation", + "ssm:ListCommands", + "ssm:ListCommandInvocations", + "ssm:DescribeInstanceInformation", + "ssm:DescribeSessions" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SSMRead" + }, + { + "Action":[ + "ssm:SendCommand", + "ssm:StartSession" + ], + "Condition":{ + "StringEquals":{ + "ssm:resourceTag/atx-remote-infra":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:instance/*", + "Sid":"SSMTgt" + }, + { + "Action":"ssm:SendCommand", + "Effect":"Allow", + "Resource":"arn:aws:ssm:*::document/AWS-RunShellScript", + "Sid":"SSMDocs" + }, + { + "Action":[ + "s3:GetObject", + "s3:PutObject", + "s3:DeleteObject", + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-source-code-*", + "arn:aws:s3:::atx-source-code-*/*", + "arn:aws:s3:::atx-ct-output-*", + "arn:aws:s3:::atx-ct-output-*/*" + ], + "Sid":"S3Data" + }, + { + "Action":[ + "kms:Encrypt", + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Condition":{ + "ForAnyValue:StringLike":{ + "kms:ResourceAliases":[ + "alias/atx-encryption-key", + "alias/atx-encryption-key-*" + ] + }, + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"KMSEncryptDecrypt" + }, + { + "Action":[ + "secretsmanager:GetSecretValue", + "secretsmanager:DescribeSecret" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:secretsmanager:*:*:secret:atx/*", + "Sid":"SM" + }, + { + "Action":"secretsmanager:ListSecrets", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SMList" + }, + { + "Action":[ + "scheduler:CreateSchedule", + "scheduler:DeleteSchedule", + "scheduler:GetSchedule", + "scheduler:UpdateSchedule" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:scheduler:*:*:schedule/atx-ct/*", + "arn:aws:scheduler:*:*:schedule/atx-ct-*/*" + ], + "Sid":"SchedLifecycle" + }, + { + "Action":"scheduler:GetScheduleGroup", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:scheduler:*:*:schedule-group/atx-ct", + "arn:aws:scheduler:*:*:schedule-group/atx-ct-*" + ], + "Sid":"SchedGroupRead" + }, + { + "Action":[ + "scheduler:ListSchedules", + "scheduler:ListScheduleGroups" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SchedList" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "iam:PassedToService":"ec2.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/atx-transform-role", + "arn:aws:iam::*:role/atx-transform-role-*" + ], + "Sid":"IAMPassEC2InstanceRole" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "iam:PassedToService":"scheduler.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/AtxSchedulerInvocationRole", + "arn:aws:iam::*:role/AtxSchedulerInvocationRole-*" + ], + "Sid":"IAMPassSchedulerRole" + }, + { + "Action":[ + "iam:GetRole", + "iam:ListAttachedRolePolicies", + "iam:ListRolePolicies", + "iam:GetRolePolicy" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/atx-*", + "arn:aws:iam::*:role/Atx*", + "arn:aws:iam::*:role/ATX*" + ], + "Sid":"IAMReadRoles" + }, + { + "Action":"iam:GetInstanceProfile", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:instance-profile/atx-*", + "arn:aws:iam::*:instance-profile/Atx*", + "arn:aws:iam::*:instance-profile/ATX*" + ], + "Sid":"IAMReadInstanceProfile" + }, + { + "Action":"tag:GetResources", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"TagGetATXStacks" + }, + { + "Action":"cloudformation:ListStacks", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CFNListStacksForDetect" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-28T15:42:16+00:00" + }, + "AWSTransformRevenueAttributionPolicy":{ + "CreateDate":"2026-07-07T16:42:19+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "partnercentral:GetRevenueAttribution", + "partnercentral:UpdateRevenueAttribution", + "partnercentral:CreateRevenueAttribution", + "partnercentral:ListRevenueAttributions" + ], + "Condition":{ + "StringEquals":{ + "partnercentral:Catalog":[ + "AWS", + "Sandbox" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:partnercentral:*:*:catalog/*/revenue-attribution/*", + "Sid":"PartnerCentralRevenueManagementAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-07T16:42:19+00:00" + }, "AWSTransformSecretsManagerConnectorPolicy":{ "CreateDate":"2026-03-04T21:12:11+00:00", "DefaultVersionId":"v1", @@ -64746,6 +68667,99 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-03-04T21:12:11+00:00" }, + "AWSTransformSecurityAgentExecutorAccess":{ + "CreateDate":"2026-06-30T21:27:39+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "securityagent:ListAgentSpaces", + "securityagent:CreateCodeReview", + "securityagent:StartCodeReviewJob", + "securityagent:ListCodeReviewJobsForCodeReview", + "securityagent:ListFindings", + "securityagent:BatchGetFindings", + "securityagent:StartCodeRemediation" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:securityagent:*:*:agent-space*", + "Sid":"SecurityAgentApi" + }, + { + "Action":[ + "s3:GetObject", + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "s3:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-security-agent-*", + "arn:aws:s3:::atx-security-agent-*/*" + ], + "Sid":"S3SecurityAgentBucketRead" + }, + { + "Action":"s3:PutObject", + "Condition":{ + "StringEquals":{ + "s3:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:s3:::atx-security-agent-*/security-scans/*", + "Sid":"S3SecurityAgentUpload" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "iam:PassedToService":"securityagent.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/security-agent-*", + "Sid":"IAMPassSecurityAgentRole" + }, + { + "Action":"cloudformation:ListStacks", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CFNDiscoverSecurityAgentStack" + }, + { + "Action":"cloudformation:DescribeStacks", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*", + "Sid":"CFNDescribeSecurityAgentStack" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-28T15:42:11+00:00" + }, "AWSTrustedAdvisorPriorityFullAccess":{ "CreateDate":"2022-08-16T16:08:24+00:00", "DefaultVersionId":"v1", @@ -65661,7 +69675,7 @@ }, "AWSWAFConsoleFullAccess":{ "CreateDate":"2020-04-06T18:38:38+00:00", - "DefaultVersionId":"v21", + "DefaultVersionId":"v22", "Document":{ "Statement":[ { @@ -66033,17 +70047,37 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowListActionsForPricingPlanManager" + }, + { + "Action":[ + "bedrock-agentcore:GatewayAssociateWebACL", + "bedrock-agentcore:GatewayDisassociateWebACL", + "bedrock-agentcore:GatewayGetWebACLForResource", + "bedrock-agentcore:GetGateway" + ], + "Effect":"Allow", + "Resource":"arn:aws:bedrock-agentcore:*:*:gateway/*", + "Sid":"AllowActionsForAgentCoreGateway" + }, + { + "Action":[ + "bedrock-agentcore:GatewayListResourcesForWebACL", + "bedrock-agentcore:ListGateways" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListActionsForAgentCoreGateway" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T22:12:10+00:00" + "UpdateDate":"2026-07-01T04:12:13+00:00" }, "AWSWAFConsoleReadOnlyAccess":{ "CreateDate":"2020-04-06T18:43:24+00:00", - "DefaultVersionId":"v20", + "DefaultVersionId":"v21", "Document":{ "Statement":[ { @@ -66349,17 +70383,35 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowListSubscriptionsForPricingPlanManager" + }, + { + "Action":[ + "bedrock-agentcore:GatewayGetWebACLForResource", + "bedrock-agentcore:GetGateway" + ], + "Effect":"Allow", + "Resource":"arn:aws:bedrock-agentcore:*:*:gateway/*", + "Sid":"AllowGetActionForAgentCoreGateway" + }, + { + "Action":[ + "bedrock-agentcore:GatewayListResourcesForWebACL", + "bedrock-agentcore:ListGateways" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListActionsForAgentCoreGateway" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T22:27:11+00:00" + "UpdateDate":"2026-07-01T04:12:24+00:00" }, "AWSWAFFullAccess":{ "CreateDate":"2015-10-06T20:44:00+00:00", - "DefaultVersionId":"v15", + "DefaultVersionId":"v17", "Document":{ "Statement":[ { @@ -66588,19 +70640,37 @@ } }, "Effect":"Allow", - "Resource":"*", + "Resource":"arn:aws:logs:*:*:log-group:*", "Sid":"GrantLogDeliveryPermissionForCloudWatchLogGroup" + }, + { + "Action":[ + "bedrock-agentcore:GatewayAssociateWebACL", + "bedrock-agentcore:GatewayDisassociateWebACL", + "bedrock-agentcore:GatewayGetWebACLForResource" + ], + "Effect":"Allow", + "Resource":"arn:aws:bedrock-agentcore:*:*:gateway/*", + "Sid":"AllowActionsForAgentCoreGateway" + }, + { + "Action":[ + "bedrock-agentcore:GatewayListResourcesForWebACL" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListActionsForAgentCoreGateway" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T22:27:12+00:00" + "UpdateDate":"2026-07-28T21:42:26+00:00" }, "AWSWAFReadOnlyAccess":{ "CreateDate":"2015-10-06T20:43:45+00:00", - "DefaultVersionId":"v12", + "DefaultVersionId":"v13", "Document":{ "Statement":[ { @@ -66762,13 +70832,29 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowListActionsForELB" + }, + { + "Action":[ + "bedrock-agentcore:GatewayGetWebACLForResource" + ], + "Effect":"Allow", + "Resource":"arn:aws:bedrock-agentcore:*:*:gateway/*", + "Sid":"AllowReadActionsForAgentCoreGateway" + }, + { + "Action":[ + "bedrock-agentcore:GatewayListResourcesForWebACL" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowListActionsForAgentCoreGateway" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T22:27:09+00:00" + "UpdateDate":"2026-07-01T04:27:31+00:00" }, "AWSWellArchitectedDiscoveryServiceRolePolicy":{ "CreateDate":"2023-04-26T18:36:40+00:00", @@ -67104,16 +71190,18 @@ }, "AWS_ConfigRole":{ "CreateDate":"2020-09-15T20:30:30+00:00", - "DefaultVersionId":"v70", + "DefaultVersionId":"v71", "Document":{ "Statement":[ { "Action":[ + "access-analyzer:CheckNoPublicAccess", "access-analyzer:GetAnalyzer", "access-analyzer:GetArchiveRule", "access-analyzer:ListAnalyzers", "access-analyzer:ListArchiveRules", "access-analyzer:ListTagsForResource", + "access-analyzer:ValidatePolicy", "account:GetAlternateContact", "acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificateAuthorityCertificate", @@ -67347,8 +71435,11 @@ "bedrock-agentcore:GetMemory", "bedrock-agentcore:GetOauth2CredentialProvider", "bedrock-agentcore:GetOnlineEvaluationConfig", + "bedrock-agentcore:GetPaymentManager", "bedrock-agentcore:GetPolicy", "bedrock-agentcore:GetPolicyEngine", + "bedrock-agentcore:GetPolicyEngineSummary", + "bedrock-agentcore:GetPolicySummary", "bedrock-agentcore:GetTokenVault", "bedrock-agentcore:GetWorkloadIdentity", "bedrock-agentcore:ListAgentRuntimeEndpoints", @@ -67362,8 +71453,11 @@ "bedrock-agentcore:ListMemories", "bedrock-agentcore:ListOauth2CredentialProviders", "bedrock-agentcore:ListOnlineEvaluationConfigs", + "bedrock-agentcore:ListPaymentManagers", "bedrock-agentcore:ListPolicies", "bedrock-agentcore:ListPolicyEngines", + "bedrock-agentcore:ListPolicyEngineSummaries", + "bedrock-agentcore:ListPolicySummaries", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:ListWorkloadIdentities", "bedrock:GetAgent", @@ -67394,6 +71488,7 @@ "bedrock:ListBlueprints", "bedrock:ListDataAutomationProjects", "bedrock:ListDataSources", + "bedrock:ListEnforcedGuardrailsConfiguration", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlows", @@ -68668,8 +72763,12 @@ "notifications:GetEventRule", "notifications:ListEventRules", "notifications:ListManagedNotificationChannelAssociations", + "notifications:ListNotificationConfigurations", "notifications:ListNotificationHubs", "notifications:ListOrganizationalUnits", + "notifications:ListTagsForResource", + "nova-act:GetWorkflowDefinition", + "nova-act:ListWorkflowDefinitions", "oam:GetSink", "oam:GetSinkPolicy", "oam:ListSinks", @@ -69045,17 +73144,21 @@ "s3tables:GetTableBucketStorageClass", "s3tables:ListTableBuckets", "s3tables:ListTagsForResource", + "s3vectors:GetIndex", "s3vectors:GetVectorBucket", "s3vectors:GetVectorBucketPolicy", + "s3vectors:ListIndexes", "s3vectors:ListTagsForResource", "s3vectors:ListVectorBuckets", "sagemaker:DescribeAction", + "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeAutoMLJobV2", "sagemaker:DescribeCluster", + "sagemaker:DescribeClusterSchedulerConfig", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", @@ -69065,12 +73168,16 @@ "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", + "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHub", + "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeInferenceExperiment", + "sagemaker:DescribeLabelingJob", + "sagemaker:DescribeMlflowApp", "sagemaker:DescribeMlflowTrackingServer", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", @@ -69083,12 +73190,14 @@ "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", + "sagemaker:DescribeOptimizationJob", "sagemaker:DescribePartnerApp", "sagemaker:DescribePipeline", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSpace", "sagemaker:DescribeStudioLifecycleConfig", + "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", @@ -69096,11 +73205,13 @@ "sagemaker:DescribeWorkteam", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:ListActions", + "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAutoMLJobs", "sagemaker:ListClusters", + "sagemaker:ListClusterSchedulerConfigs", "sagemaker:ListCodeRepositories", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", @@ -69110,12 +73221,16 @@ "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", + "sagemaker:ListFlowDefinitions", "sagemaker:ListHubs", + "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImages", "sagemaker:ListImageVersions", "sagemaker:ListInferenceComponents", "sagemaker:ListInferenceExperiments", + "sagemaker:ListLabelingJobs", + "sagemaker:ListMlflowApps", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelCardExportJobs", @@ -69130,6 +73245,7 @@ "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", + "sagemaker:ListOptimizationJobs", "sagemaker:ListPartnerApps", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", @@ -69137,6 +73253,7 @@ "sagemaker:ListSpaces", "sagemaker:ListStudioLifecycleConfigs", "sagemaker:ListTags", + "sagemaker:ListTrainingJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", @@ -69448,7 +73565,7 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-05T22:42:19+00:00" + "UpdateDate":"2026-07-30T23:27:21+00:00" }, "AWSrePostPrivateCloudWatchAccess":{ "CreateDate":"2023-11-15T16:37:33+00:00", @@ -69592,6 +73709,36 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T17:59:49+00:00" }, + "AccountAccessManagerServiceRolePolicy":{ + "CreateDate":"2026-06-29T19:12:30+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "organizations:ListAccounts", + "organizations:ListAWSServiceAccessForOrganization" + ], + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":"organizations:DescribeAccount", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:organizations::*:account/o-*/*" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-29T19:12:30+00:00" + }, "AccountManagementFromVercel":{ "CreateDate":"2025-12-11T16:34:19+00:00", "DefaultVersionId":"v4", @@ -71873,7 +76020,7 @@ }, "AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy":{ "CreateDate":"2025-07-16T13:37:07+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -71890,14 +76037,32 @@ "Resource":[ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*" - ] + ], + "Sid":"BedrockInvokeModel" + }, + { + "Action":"bedrock-mantle:CreateInference", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:bedrock-mantle:*:*:project/*", + "Sid":"BedrockMantleInference" + }, + { + "Action":"bedrock-mantle:CallWithBearerToken", + "Effect":"Allow", + "Resource":"*", + "Sid":"BedrockMantleCallWithBearerToken" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:59:11+00:00" + "UpdateDate":"2026-07-17T17:12:16+00:00" }, "AmazonBedrockFullAccess":{ "CreateDate":"2023-12-06T15:47:17+00:00", @@ -72777,7 +76942,7 @@ }, "AmazonBraketFullAccess":{ "CreateDate":"2020-08-06T20:12:37+00:00", - "DefaultVersionId":"v12", + "DefaultVersionId":"v13", "Document":{ "Statement":[ { @@ -72797,6 +76962,26 @@ "Effect":"Allow", "Resource":"arn:aws:s3:::amazon-braket-*" }, + { + "Action":[ + "s3:GetObject", + "s3:PutObject", + "s3:ListBucket", + "s3:CreateBucket", + "s3:PutBucketPublicAccessBlock", + "s3:PutBucketPolicy" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringEqualsIgnoreCase":{ + "aws:ResourceTag/AmazonBraket":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:s3:::*" + }, { "Action":[ "s3:ListAllMyBuckets", @@ -72957,11 +77142,11 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:01:26+00:00" + "UpdateDate":"2026-07-06T19:57:33+00:00" }, "AmazonBraketJobsExecutionPolicy":{ "CreateDate":"2021-11-26T19:34:41+00:00", - "DefaultVersionId":"v2", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { @@ -72976,6 +77161,23 @@ "Effect":"Allow", "Resource":"arn:aws:s3:::amazon-braket-*" }, + { + "Action":[ + "s3:GetObject", + "s3:PutObject", + "s3:ListBucket", + "s3:CreateBucket", + "s3:PutBucketPublicAccessBlock", + "s3:PutBucketPolicy" + ], + "Condition":{ + "StringEqualsIgnoreCase":{ + "aws:ResourceTag/AmazonBraket":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:s3:::*" + }, { "Action":[ "ecr:GetDownloadUrlForLayer", @@ -73069,11 +77271,11 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2021-11-28T05:34:55+00:00" + "UpdateDate":"2026-07-06T19:12:15+00:00" }, "AmazonBraketServiceRolePolicy":{ "CreateDate":"2020-08-04T17:12:23+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -73090,6 +77292,23 @@ "Effect":"Allow", "Resource":"arn:aws:s3:::amazon-braket-*" }, + { + "Action":[ + "s3:PutObject", + "s3:GetObject", + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringEqualsIgnoreCase":{ + "aws:ResourceTag/AmazonBraket":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:s3:::*" + }, { "Action":[ "logs:PutLogEvents", @@ -73111,7 +77330,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2025-07-11T21:37:07+00:00" + "UpdateDate":"2026-07-06T18:42:30+00:00" }, "AmazonChimeFullAccess":{ "CreateDate":"2017-11-01T22:15:43+00:00", @@ -74665,7 +78884,7 @@ }, "AmazonConnectCampaignsServiceLinkedRolePolicy":{ "CreateDate":"2021-09-23T20:54:26+00:00", - "DefaultVersionId":"v4", + "DefaultVersionId":"v5", "Document":{ "Statement":[ { @@ -74676,6 +78895,14 @@ "Resource":"*", "Sid":"ConnectCampaignAccess" }, + { + "Action":[ + "connect:GetMetricDataV2" + ], + "Effect":"Allow", + "Resource":"arn:aws:connect-campaigns:*:*:campaign/*", + "Sid":"ConnectCampaignsMetricsAccess" + }, { "Action":[ "connect:BatchPutContact", @@ -74806,7 +79033,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-27T01:42:13+00:00" + "UpdateDate":"2026-06-18T23:12:23+00:00" }, "AmazonConnectReadOnlyAccess":{ "CreateDate":"2018-10-17T21:00:44+00:00", @@ -77870,7 +82097,7 @@ }, "AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary":{ "CreateDate":"2024-04-23T23:01:14+00:00", - "DefaultVersionId":"v11", + "DefaultVersionId":"v13", "Document":{ "Statement":[ { @@ -79058,7 +83285,9 @@ }, { "Action":[ - "sagemaker:UpdateNotebookInstanceLifecycleConfig" + "sagemaker:CreateNotebookInstanceLifecycleConfig", + "sagemaker:UpdateNotebookInstanceLifecycleConfig", + "sagemaker:DeleteNotebookInstanceLifecycleConfig" ], "Effect":"Deny", "Resource":"*", @@ -79069,7 +83298,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-03-11T21:12:10+00:00" + "UpdateDate":"2026-07-17T17:42:13+00:00" }, "AmazonDataZoneSageMakerManageAccessRolePolicy":{ "CreateDate":"2024-04-23T23:34:52+00:00", @@ -83602,7 +87831,7 @@ }, "AmazonECSInstanceRolePolicyForManagedInstances":{ "CreateDate":"2025-09-26T23:49:07+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -83626,7 +87855,10 @@ "ecs:Poll" ], "Effect":"Allow", - "Resource":"arn:aws:ecs:*:*:container-instance/*", + "Resource":[ + "arn:aws:ecs:*:*:container-instance/*", + "arn:aws:ecs:*:*:task-set/*" + ], "Sid":"ECSAgentPollPermissions" }, { @@ -83652,7 +87884,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:58:24+00:00" + "UpdateDate":"2026-07-02T02:57:22+00:00" }, "AmazonECSServiceRolePolicy":{ "CreateDate":"2017-10-14T01:18:58+00:00", @@ -84893,7 +89125,7 @@ }, "AmazonEKSLoadBalancingPolicy":{ "CreateDate":"2024-10-30T20:18:06+00:00", - "DefaultVersionId":"v7", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { @@ -85078,7 +89310,8 @@ "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "elasticloadbalancing:SetWebAcl", - "elasticloadbalancing:DescribeTargetGroups" + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:SetRulePriorities" ], "Effect":"Allow", "Resource":"*" @@ -85099,7 +89332,8 @@ "ec2:DescribeCoipPools", "ec2:GetCoipPoolUsage", "ec2:GetSecurityGroupsForVpc", - "ec2:DescribeVpcPeeringConnections" + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeIpamPools" ], "Effect":"Allow", "Resource":"*" @@ -85121,7 +89355,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-27T22:12:10+00:00" + "UpdateDate":"2026-06-16T00:12:08+00:00" }, "AmazonEKSLocalOutpostClusterPolicy":{ "CreateDate":"2022-08-24T21:56:47+00:00", @@ -85709,7 +89943,7 @@ }, "AmazonEKSServiceRolePolicy":{ "CreateDate":"2020-02-21T20:10:47+00:00", - "DefaultVersionId":"v25", + "DefaultVersionId":"v26", "Document":{ "Statement":[ { @@ -85902,7 +90136,8 @@ "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStoragePolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSBlockStorageClusterPolicy", "arn:aws:eks::aws:cluster-access-policy/AmazonEKSHybridPolicy", - "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEventPolicy" + "arn:aws:eks::aws:cluster-access-policy/AmazonEKSEventPolicy", + "arn:aws:eks::aws:cluster-access-policy/AmazonEKSPodIdentityPolicy" ] } }, @@ -86045,7 +90280,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-21T22:57:08+00:00" + "UpdateDate":"2026-07-10T18:57:20+00:00" }, "AmazonEKSVPCResourceController":{ "CreateDate":"2020-08-12T00:55:34+00:00", @@ -86208,7 +90443,7 @@ }, "AmazonEMRContainersServiceRolePolicy":{ "CreateDate":"2020-12-09T00:38:19+00:00", - "DefaultVersionId":"v4", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -86224,7 +90459,9 @@ "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "eks:ListPodIdentityAssociations", - "eks:DescribePodIdentityAssociation" + "eks:DescribePodIdentityAssociation", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServicePermissions" ], "Effect":"Allow", "Resource":"*" @@ -86253,13 +90490,70 @@ }, "Effect":"Allow", "Resource":"*" + }, + { + "Action":[ + "ec2:CreateVpcEndpointServiceConfiguration" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/emr-containers:managed-endpoint-resource":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:vpc-endpoint-service/*", + "Sid":"VPCEndpointServiceCreate" + }, + { + "Action":[ + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:ModifyVpcEndpointServicePermissions" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/emr-containers:managed-endpoint-resource":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:vpc-endpoint-service/*", + "Sid":"VPCEndpointServiceManage" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "ec2:CreateAction":"CreateVpcEndpointServiceConfiguration" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:vpc-endpoint-service/*", + "Sid":"VPCEndpointServiceTagOnCreate" + }, + { + "Action":[ + "cloudwatch:PutMetricData" + ], + "Condition":{ + "StringEquals":{ + "cloudwatch:namespace":[ + "AWS/EMRContainers" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "*" + ], + "Sid":"CloudWatchPolicyStatement" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2025-02-06T21:07:07+00:00" + "UpdateDate":"2026-07-24T17:27:11+00:00" }, "AmazonEMRFullAccessPolicy_v2":{ "CreateDate":"2021-03-12T01:50:29+00:00", @@ -86503,6 +90797,165 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2024-01-25T18:21:43+00:00" }, + "AmazonEMRServicePolicyForSessions":{ + "CreateDate":"2026-06-22T19:57:31+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateTargetGroup", + "elasticloadbalancing:AddTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:elasticloadbalancing:*:*:loadbalancer/*", + "arn:aws:elasticloadbalancing:*:*:targetgroup/*", + "arn:aws:elasticloadbalancing:*:*:listener/*" + ], + "Sid":"NLBProvisioning" + }, + { + "Action":[ + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:RegisterTargets", + "elasticloadbalancing:DeregisterTargets", + "elasticloadbalancing:CreateListener", + "elasticloadbalancing:DeleteListener", + "elasticloadbalancing:AddTags", + "elasticloadbalancing:SetSecurityGroups", + "ec2:AuthorizeSecurityGroupIngress", + "ec2:DeleteSecurityGroup" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/for-use-with-amazon-emr-managed-policies":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:elasticloadbalancing:*:*:loadbalancer/*", + "arn:aws:elasticloadbalancing:*:*:targetgroup/*", + "arn:aws:elasticloadbalancing:*:*:listener/*", + "arn:aws:ec2:*:*:security-group/*" + ], + "Sid":"NLBManagement" + }, + { + "Action":[ + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeLoadBalancerAttributes", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DescribeTargetHealth", + "elasticloadbalancing:DescribeListeners", + "ec2:DescribeInternetGateways", + "ec2:DescribeVpcs" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"NLBDescribes" + }, + { + "Action":[ + "ec2:CreateVpcEndpointServiceConfiguration" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:vpc-endpoint-service/*", + "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*" + ], + "Sid":"VPCEndpointServiceProvisioning" + }, + { + "Action":[ + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:ModifyVpcEndpointServicePermissions" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/for-use-with-amazon-emr-managed-policies":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:vpc-endpoint-service/*", + "Sid":"VPCEndpointServiceManagement" + }, + { + "Action":[ + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServicePermissions" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"VPCEndpointServiceDescribes" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "ec2:CreateAction":[ + "CreateVpcEndpointServiceConfiguration" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:vpc-endpoint-service/*" + ], + "Sid":"TagOnCreateEndpointServiceResources" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringLike":{ + "iam:AWSServiceName":"elasticloadbalancing.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing", + "Sid":"CreateServiceLinkedRoleForELB" + }, + { + "Action":[ + "ec2:CreateSecurityGroup", + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:security-group/*", + "Sid":"SecurityGroupProvisioning" + }, + { + "Action":"ec2:CreateSecurityGroup", + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:vpc/*", + "Sid":"SecurityGroupCreateInVpc" + } + ], + "Version":"2012-10-17" + }, + "Path":"/service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-22T19:57:31+00:00" + }, "AmazonEMRServicePolicy_v2":{ "CreateDate":"2021-03-12T01:11:08+00:00", "DefaultVersionId":"v6", @@ -88300,7 +92753,7 @@ }, "AmazonElasticsearchServiceRolePolicy":{ "CreateDate":"2017-07-07T00:15:31+00:00", - "DefaultVersionId":"v7", + "DefaultVersionId":"v8", "Document":{ "Statement":[ { @@ -88401,6 +92854,16 @@ "Resource":"arn:aws:ec2:*:*:network-interface/*", "Sid":"Stmt1480452973150" }, + { + "Action":[ + "ec2:CreateTags" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:network-interface/*" + ], + "Sid":"Stmt1480452973194" + }, { "Action":[ "ec2:CreateTags" @@ -88419,7 +92882,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2023-10-23T06:58:31+00:00" + "UpdateDate":"2026-06-22T12:27:26+00:00" }, "AmazonEventBridgeApiDestinationsServiceRolePolicy":{ "CreateDate":"2021-02-11T20:52:05+00:00", @@ -90859,64 +95322,167 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2023-11-20T15:18:32+00:00" }, - "AmazonInspector2FullAccess":{ - "CreateDate":"2021-11-29T19:10:15+00:00", - "DefaultVersionId":"v4", + "AmazonInspector2AmiScanServiceRolePolicy":{ + "CreateDate":"2026-07-30T17:57:10+00:00", + "DefaultVersionId":"v1", "Document":{ "Statement":[ { - "Action":"inspector2:*", + "Action":[ + "events:DeleteRule", + "events:DescribeRule", + "events:ListTargetsByRule", + "events:PutRule", + "events:PutTargets", + "events:RemoveTargets" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" + ], + "Sid":"ManagedRules" + }, + { + "Action":[ + "inspector2:AssociateMember", + "inspector2:Disable", + "inspector2:Enable", + "inspector2:EnableDelegatedAdminAccount" + ], "Effect":"Allow", "Resource":"*", - "Sid":"AllowFullAccessToInspectorApis" + "Sid":"AllowInspectorEnablementForAwsOrgPolicy" }, { "Action":[ - "codeguru-security:BatchGetFindings", - "codeguru-security:GetAccountConfiguration" + "organizations:DescribeAccount", + "organizations:DescribeOrganization", + "organizations:ListAccounts" ], "Effect":"Allow", "Resource":"*", - "Sid":"AllowAccessToCodeGuruApis" + "Sid":"AllowInspectorServiceGetAwsOrg" }, { - "Action":"iam:CreateServiceLinkedRole", + "Action":[ + "organizations:ListDelegatedAdministrators" + ], "Condition":{ - "StringEquals":{ - "iam:AWSServiceName":[ - "agentless.inspector2.amazonaws.com", + "StringLikeIfExists":{ + "organizations:ServicePrincipal":[ + "ami.inspector2.amazonaws.com", "inspector2.amazonaws.com" ] } }, "Effect":"Allow", "Resource":"*", - "Sid":"AllowAccessToCreateSlr" + "Sid":"AllowInspectorServiceDelegatedAdminFromAwsOrg" }, { "Action":[ - "organizations:EnableAWSServiceAccess", - "organizations:RegisterDelegatedAdministrator", - "organizations:ListDelegatedAdministrators", - "organizations:ListAWSServiceAccessForOrganization", - "organizations:DescribeOrganizationalUnit", - "organizations:DescribeAccount", - "organizations:DescribeOrganization" + "ec2:DescribeImages", + "ec2:DescribeSnapshots", + "ec2:DescribeVolumes" ], "Effect":"Allow", "Resource":"*", - "Sid":"AllowAccessToOrganizationApis" + "Sid":"AmiIdentification" + }, + { + "Action":[ + "ebs:GetSnapshotBlock", + "ebs:ListSnapshotBlocks" + ], + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:snapshot/*", + "Sid":"GetSnapshotData" + }, + { + "Action":[ + "ebs:GetSnapshotBlock", + "ebs:ListSnapshotBlocks" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/InspectorEc2Exclusion":"true" + } + }, + "Effect":"Deny", + "Resource":"arn:aws:ec2:*:*:snapshot/*", + "Sid":"DenyGetSnapshotDataOnExcludedSnapshots" + }, + { + "Action":"kms:Decrypt", + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/InspectorEc2Exclusion":"true" + } + }, + "Effect":"Deny", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DenyKmsDecryptForExcludedKeys" + }, + { + "Action":"kms:Decrypt", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:EncryptionContext:aws:ebs:id":"vol-*", + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DecryptSnapshotBlocksVolContext" + }, + { + "Action":"kms:Decrypt", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:EncryptionContext:aws:ebs:id":"snap-*", + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DecryptSnapshotBlocksSnapContext" + }, + { + "Action":"kms:DescribeKey", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DescribeKeysForEbsOperations" + }, + { + "Action":"kms:ListResourceTags", + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"ListKeyResourceTags" } ], "Version":"2012-10-17" }, - "Path":"/", + "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-04-25T13:21:03+00:00" + "UpdateDate":"2026-07-30T17:57:10+00:00" }, - "AmazonInspector2FullAccess_v2":{ - "CreateDate":"2025-07-03T16:07:07+00:00", - "DefaultVersionId":"v6", + "AmazonInspector2FullAccess":{ + "CreateDate":"2021-11-29T19:10:15+00:00", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -90948,6 +95514,62 @@ "Resource":"*", "Sid":"AllowAccessToCreateSlr" }, + { + "Action":[ + "organizations:EnableAWSServiceAccess", + "organizations:RegisterDelegatedAdministrator", + "organizations:ListDelegatedAdministrators", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:DescribeOrganizationalUnit", + "organizations:DescribeAccount", + "organizations:DescribeOrganization" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowAccessToOrganizationApis" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2024-04-25T13:21:03+00:00" + }, + "AmazonInspector2FullAccess_v2":{ + "CreateDate":"2025-07-03T16:07:07+00:00", + "DefaultVersionId":"v9", + "Document":{ + "Statement":[ + { + "Action":"inspector2:*", + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowFullAccessToInspectorApis" + }, + { + "Action":[ + "codeguru-security:BatchGetFindings", + "codeguru-security:GetAccountConfiguration" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowAccessToCodeGuruApis" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":[ + "agentless.inspector2.amazonaws.com", + "inspector2.amazonaws.com", + "thirdparty.inspector2.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowAccessToCreateSlr" + }, { "Action":[ "organizations:EnableAWSServiceAccess", @@ -90958,7 +95580,8 @@ "StringEquals":{ "organizations:ServicePrincipal":[ "inspector2.amazonaws.com", - "agentless.inspector2.amazonaws.com" + "agentless.inspector2.amazonaws.com", + "thirdparty.inspector2.amazonaws.com" ] } }, @@ -91022,13 +95645,39 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowDescribeEffectivePolicyForInspector" + }, + { + "Action":[ + "config:PutConnector", + "config:ListConnectors" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowConfigConnectorWriteAndList" + }, + { + "Action":"config:GetConnector", + "Effect":"Allow", + "Resource":"arn:aws:config:*:*:connector/*", + "Sid":"AllowConfigConnectorRead" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":"thirdparty.config.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/aws-service-role/thirdparty.config.amazonaws.com/AWSServiceRoleForConfigThirdParty", + "Sid":"AllowCreateConfigThirdPartySLR" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:03:17+00:00" + "UpdateDate":"2026-07-08T19:12:18+00:00" }, "AmazonInspector2ManagedCisPolicy":{ "CreateDate":"2024-01-24T16:31:43+00:00", @@ -91078,7 +95727,7 @@ }, "AmazonInspector2ReadOnlyAccess":{ "CreateDate":"2022-01-21T14:45:14+00:00", - "DefaultVersionId":"v8", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { @@ -91130,17 +95779,31 @@ "Effect":"Allow", "Resource":"*", "Sid":"AllowDescribeEffectivePolicyForInspector" + }, + { + "Action":[ + "config:DescribeConfigurationRecorders", + "config:DescribeConfigurationRecorderStatus", + "config:ListConfigurationRecorders", + "config:GetConnector", + "config:ListConnectors", + "ssm:GetCloudConnector", + "ssm:ListCloudConnectors" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowCrossServiceReadsForConnectorHealth" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:58:22+00:00" + "UpdateDate":"2026-07-07T18:57:19+00:00" }, "AmazonInspector2ServiceRolePolicy":{ "CreateDate":"2021-11-16T20:27:48+00:00", - "DefaultVersionId":"v26", + "DefaultVersionId":"v27", "Document":{ "Statement":[ { @@ -91169,6 +95832,7 @@ "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", + "ec2:DescribeTransitGatewayPolicyTables", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", @@ -91179,6 +95843,9 @@ "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", + "ec2:GetSecurityGroupsForVpc", + "ec2:GetTransitGatewayPolicyTableAssociations", + "ec2:GetTransitGatewayPolicyTableEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", @@ -91488,7 +96155,208 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-13T17:12:07+00:00" + "UpdateDate":"2026-06-16T19:27:15+00:00" + }, + "AmazonInspector2ThirdPartyServiceRolePolicy":{ + "CreateDate":"2026-06-26T15:27:27+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "resource-explorer-2:Search" + ], + "Effect":"Allow", + "Resource":"arn:aws:resource-explorer-2:*:*:view/ServiceViewForInspector*/service-view", + "Sid":"MultiCloudResourceDiscovery" + }, + { + "Action":[ + "resource-explorer-2:CreateStreamingAccessForService", + "resource-explorer-2:ListStreamingAccessForServices", + "resource-explorer-2:DeleteStreamingAccessForService" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"MultiCloudStreamingAccess" + }, + { + "Action":[ + "ssm:CreateAssociation", + "ssm:UpdateAssociation", + "ssm:DeleteAssociation", + "ssm:StartAssociationsOnce" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*", + "arn:aws:ssm:*:*:association/*" + ], + "Sid":"MultiCloudSsmAssociationWrite" + }, + { + "Action":[ + "ssm:DescribeAssociation" + ], + "Effect":"Allow", + "Resource":"arn:aws:ssm:*:*:association/*", + "Sid":"MultiCloudSsmAssociationDescribe" + }, + { + "Action":[ + "ssm:ListAssociations", + "ssm:DescribeAssociationExecutions", + "ssm:DescribeAssociationExecutionTargets" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"MultiCloudSsmAssociationList" + }, + { + "Action":[ + "ssm:GetDocument" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:document/AmazonInspector2-*", + "arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*" + ], + "Sid":"MultiCloudSsmGetDocument" + }, + { + "Action":[ + "ssm:StartAutomationExecution", + "ssm:GetAutomationExecution", + "ssm:DescribeAutomationExecutions", + "ssm:DescribeAutomationStepExecutions", + "ssm:StopAutomationExecution" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*", + "arn:aws:ssm:*:*:automation-execution/*" + ], + "Sid":"MultiCloudSsmAutomation" + }, + { + "Action":[ + "ssm:CreateCloudConnector", + "ssm:UpdateCloudConnector", + "ssm:DeleteCloudConnector", + "ssm:GetCloudConnector", + "ssm:ListCloudConnectors", + "ssm:AddTagsToResource", + "ssm:RemoveTagsFromResource", + "ssm:ListTagsForResource" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ssm:*:*:cloud-connector/*", + "Sid":"MultiCloudCloudConnectorManagement" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "iam:PassedToService":"ssm.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/Inspector2SSMFederationRole*", + "arn:aws:iam::*:role/Inspector2SSMDispatchRole*", + "arn:aws:iam::*:role/Inspector2SSMAssumeRole*", + "arn:aws:iam::*:role/Inspector2VmScannerRole*" + ], + "Sid":"MultiCloudSsmPassRole" + }, + { + "Action":"iam:GetRole", + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/Inspector2SSMFederationRole*", + "arn:aws:iam::*:role/Inspector2SSMDispatchRole*", + "arn:aws:iam::*:role/Inspector2SSMAssumeRole*", + "arn:aws:iam::*:role/Inspector2VmScannerRole*" + ], + "Sid":"MultiCloudIamGetRole" + }, + { + "Action":[ + "config:PutThirdPartyServiceLinkedConfigurationRecorder", + "config:DeleteServiceLinkedConfigurationRecorder", + "config:DescribeConfigurationRecorders" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"MultiCloudConfigSLRecWrite" + }, + { + "Action":[ + "config:ListConfigurationRecorders", + "config:GetConnector" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"MultiCloudConfigConnectorRead" + }, + { + "Action":[ + "cloudwatch:GetMetricData" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"MultiCloudConfigMetrics" + }, + { + "Action":"sts:GetWebIdentityToken", + "Condition":{ + "ForAnyValue:StringLike":{ + "sts:IdentityTokenAudience":[ + "api://AzureADTokenExchange" + ] + }, + "Null":{ + "sts:IdentityTokenAudience":"false" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowGetWebIdentityToken" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" + ], + "Sid":"MultiCloudSsmSLRCreation" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-26T15:27:27+00:00" }, "AmazonInspectorFullAccess":{ "CreateDate":"2015-10-07T17:08:04+00:00", @@ -95167,6 +100035,134 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2023-09-22T17:45:14+00:00" }, + "AmazonODBFullAccess":{ + "CreateDate":"2026-07-23T22:57:25+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "odb:GetOciOnboardingStatus", + "odb:InitializeService", + "odb:CreateCloudExadataInfrastructure", + "odb:GetCloudExadataInfrastructure", + "odb:UpdateCloudExadataInfrastructure", + "odb:GetCloudExadataInfrastructureUnallocatedResources", + "odb:DeleteCloudExadataInfrastructure", + "odb:ListCloudExadataInfrastructures", + "odb:CreateCloudVmCluster", + "odb:GetCloudVmCluster", + "odb:DeleteCloudVmCluster", + "odb:ListCloudVmClusters", + "odb:CreateCloudAutonomousVmCluster", + "odb:GetCloudAutonomousVmCluster", + "odb:DeleteCloudAutonomousVmCluster", + "odb:ListCloudAutonomousVmClusters", + "odb:CreateAutonomousDatabase", + "odb:GetAutonomousDatabase", + "odb:UpdateAutonomousDatabase", + "odb:DeleteAutonomousDatabase", + "odb:ListAutonomousDatabases", + "odb:ListAutonomousDatabaseClones", + "odb:ListAutonomousDatabasePeers", + "odb:StartAutonomousDatabase", + "odb:StopAutonomousDatabase", + "odb:RebootAutonomousDatabase", + "odb:ShrinkAutonomousDatabase", + "odb:SwitchoverAutonomousDatabase", + "odb:FailoverAutonomousDatabase", + "odb:RestoreAutonomousDatabase", + "odb:CreateAutonomousDatabaseWallet", + "odb:GetAutonomousDatabaseWalletDetails", + "odb:CreateAutonomousDatabaseBackup", + "odb:GetAutonomousDatabaseBackup", + "odb:UpdateAutonomousDatabaseBackup", + "odb:DeleteAutonomousDatabaseBackup", + "odb:ListAutonomousDatabaseBackups", + "odb:CreateDbNode", + "odb:GetDbNode", + "odb:RebootDbNode", + "odb:StartDbNode", + "odb:StopDbNode", + "odb:DeleteDbNode", + "odb:ListDbNodes", + "odb:GetDbServer", + "odb:ListDbServers", + "odb:CreateOdbNetwork", + "odb:GetOdbNetwork", + "odb:UpdateOdbNetwork", + "odb:DeleteOdbNetwork", + "odb:ListOdbNetworks", + "odb:CreateOdbPeeringConnection", + "odb:GetOdbPeeringConnection", + "odb:UpdateOdbPeeringConnection", + "odb:DeleteOdbPeeringConnection", + "odb:ListOdbPeeringConnections", + "odb:ListAutonomousVirtualMachines", + "odb:ListDbSystemShapes", + "odb:ListGiVersions", + "odb:ListSystemVersions", + "odb:ListAutonomousDatabaseVersions", + "odb:ListAutonomousDatabaseCharacterSets", + "odb:PutResourcePolicy", + "odb:GetResourcePolicy", + "odb:DeleteResourcePolicy", + "odb:CreateOutboundIntegration", + "odb:TagResource", + "odb:UntagResource", + "odb:ListTagsForResource" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowODBActions" + }, + { + "Action":[ + "ec2:DescribeAvailabilityZones", + "ec2:DescribeVpcs" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowEC2Actions" + }, + { + "Action":[ + "ec2:CreateOdbNetworkPeering", + "ec2:ModifyOdbNetworkPeering", + "ec2:DeleteOdbNetworkPeering" + ], + "Condition":{ + "ForAnyValue:StringEquals":{ + "aws:CalledVia":"odb.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowOdbNetworkPeeringActions" + }, + { + "Action":[ + "iam:CreateServiceLinkedRole" + ], + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":[ + "odb.amazonaws.com", + "vpc-lattice.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowSLRActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-23T22:57:25+00:00" + }, "AmazonODBServiceRolePolicy":{ "CreateDate":"2024-11-13T18:21:41+00:00", "DefaultVersionId":"v10", @@ -96123,7 +101119,7 @@ }, "AmazonPrometheusScraperServiceRolePolicy":{ "CreateDate":"2023-11-26T14:19:52+00:00", - "DefaultVersionId":"v2", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { @@ -96215,13 +101211,24 @@ "Effect":"Allow", "Resource":"arn:aws:aps:*:*:workspace/*", "Sid":"APSWriting" + }, + { + "Action":"cloudwatch:PutMetricData", + "Condition":{ + "StringEquals":{ + "aws:PrincipalAccount":"${aws:ResourceAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:cloudwatch:*:*:dataset/*", + "Sid":"CloudWatchMetricsWriting" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-04-26T20:25:54+00:00" + "UpdateDate":"2026-07-17T08:27:27+00:00" }, "AmazonQDeveloperAccess":{ "CreateDate":"2024-07-09T08:35:15+00:00", @@ -98792,7 +103799,7 @@ }, "AmazonRDSPerformanceInsightsFullAccess":{ "CreateDate":"2023-08-15T23:41:34+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -98812,6 +103819,7 @@ "Action":[ "pi:CreatePerformanceAnalysisReport", "pi:GetPerformanceAnalysisReport", + "pi:ListPerformanceAnalysisReportRecommendations", "pi:ListPerformanceAnalysisReports", "pi:DeletePerformanceAnalysisReport" ], @@ -98859,11 +103867,11 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:02:39+00:00" + "UpdateDate":"2026-07-23T00:27:08+00:00" }, "AmazonRDSPerformanceInsightsReadOnly":{ "CreateDate":"2022-04-05T00:02:08+00:00", - "DefaultVersionId":"v6", + "DefaultVersionId":"v7", "Document":{ "Statement":[ { @@ -98936,6 +103944,12 @@ "Resource":"arn:aws:pi:*:*:perf-reports/rds/*/*", "Sid":"AmazonRDSPerformanceInsightsGetPerformanceAnalysisReport" }, + { + "Action":"pi:ListPerformanceAnalysisReportRecommendations", + "Effect":"Allow", + "Resource":"arn:aws:pi:*:*:perf-reports/rds/*/*", + "Sid":"AmazonRDSPerformanceInsightsListPerformanceAnalysisReportRecommendations" + }, { "Action":"pi:ListPerformanceAnalysisReports", "Effect":"Allow", @@ -98953,7 +103967,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:02:56+00:00" + "UpdateDate":"2026-07-22T23:42:28+00:00" }, "AmazonRDSPreviewServiceRolePolicy":{ "CreateDate":"2018-05-31T18:02:00+00:00", @@ -102815,7 +107829,7 @@ }, "AmazonSSMServiceRolePolicy":{ "CreateDate":"2017-11-13T19:20:08+00:00", - "DefaultVersionId":"v16", + "DefaultVersionId":"v17", "Document":{ "Statement":[ { @@ -102830,7 +107844,8 @@ "ssm:StartAutomationExecution", "ssm:StopAutomationExecution", "ssm:ListTagsForResource", - "ssm:GetCalendarState" + "ssm:GetCalendarState", + "ssm:ListCloudConnectors" ], "Effect":"Allow", "Resource":[ @@ -103058,7 +108073,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2025-07-15T17:22:08+00:00" + "UpdateDate":"2026-06-26T19:12:18+00:00" }, "AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy":{ "CreateDate":"2020-11-27T18:48:07+00:00", @@ -106087,7 +111102,7 @@ }, "AmazonSageMakerHyperPodInferenceAccess":{ "CreateDate":"2026-01-27T20:34:09+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -106138,6 +111153,52 @@ ], "Sid":"S3PutObjectAccess" }, + { + "Action":"s3:PutObject", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::hyperpod-tls*/data-capture/*" + ], + "Sid":"DataCaptureS3" + }, + { + "Action":[ + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::hyperpod-tls*" + ], + "Sid":"S3ListBucketAccess" + }, + { + "Action":[ + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:EncryptionContext:aws:s3:arn":"arn:aws:s3:::hyperpod-tls*", + "kms:ViaService":"s3.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DataCaptureKMS" + }, { "Action":[ "ecr:GetAuthorizationToken" @@ -106176,7 +111237,8 @@ { "Action":[ "ec2:CreateNetworkInterface", - "ec2:CreateNetworkInterfacePermission" + "ec2:CreateNetworkInterfacePermission", + "ec2:DeleteNetworkInterface" ], "Condition":{ "StringEquals":{ @@ -106219,6 +111281,19 @@ "Resource":"arn:aws:eks:*:*:access-entry/*", "Sid":"EKSAccessEntryPolicyAssociation" }, + { + "Action":[ + "eks:ListAssociatedAccessPolicies" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:eks:*:*:access-entry/*", + "Sid":"EKSAccessEntryListPolicies" + }, { "Action":[ "elasticloadbalancing:DescribeLoadBalancers" @@ -106410,7 +111485,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:01:18+00:00" + "UpdateDate":"2026-07-20T20:57:13+00:00" }, "AmazonSageMakerHyperPodObservabilityAdminAccess":{ "CreateDate":"2025-07-10T14:37:07+00:00", @@ -106758,6 +111833,375 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T17:58:35+00:00" }, + "AmazonSageMakerInferenceServiceRolePolicy":{ + "CreateDate":"2026-07-30T19:42:26+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:CreateNetworkInterface" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/AmazonSageMakerManaged":"true", + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"CreateENIWithTag" + }, + { + "Action":[ + "ec2:CreateNetworkInterface" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:subnet/*", + "arn:aws:ec2:*:*:security-group/*" + ], + "Sid":"CreateENIInSubnetAndSG" + }, + { + "Action":[ + "ec2:CreateNetworkInterfacePermission" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/AmazonSageMakerManaged":"true", + "ec2:AuthorizedService":"sagemaker.amazonaws.com", + "ec2:Permission":"INSTANCE-ATTACH" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"CreateENIPermission" + }, + { + "Action":[ + "ec2:DeleteNetworkInterface" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/AmazonSageMakerManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"DeleteENITagScoped" + }, + { + "Action":[ + "ec2:DeleteNetworkInterfacePermission" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/AmazonSageMakerManaged":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"DeleteENIPermissionTagScoped" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/AmazonSageMakerManaged":"true", + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "ec2:CreateAction":"CreateNetworkInterface" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:network-interface/*" + ], + "Sid":"TagOnCreateSageMakerResourcesForENI" + }, + { + "Action":[ + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeVpcs", + "ec2:DescribeDhcpOptions", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"DescribeNetworkResources" + } + ], + "Version":"2012-10-17" + }, + "Path":"/aws-service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-30T19:42:26+00:00" + }, + "AmazonSageMakerJobFullAccess":{ + "CreateDate":"2026-06-03T02:42:30+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "s3:GetObject", + "s3:PutObject", + "s3:ListBucket" + ], + "Condition":{ + "StringEquals":{ + "s3:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"S3Permissions" + }, + { + "Action":[ + "kms:Decrypt", + "kms:GenerateDataKey" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:ViaService":"s3.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"KMSPermissions" + }, + { + "Action":"kms:DescribeKey", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"KMSDescribeKey" + }, + { + "Action":[ + "sagemaker:DescribeHubContent" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sagemaker:*:*:hub/*", + "arn:aws:sagemaker:*:*:hub-content/*" + ], + "Sid":"SageMakerHubPermissions" + }, + { + "Action":[ + "sagemaker:AccessModelPackage", + "sagemaker:CreateModelPackage", + "sagemaker:DescribeModelPackage", + "sagemaker:DescribeModelPackageGroup" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sagemaker:*:*:model-package/*", + "arn:aws:sagemaker:*:*:model-package-group/*" + ], + "Sid":"SageMakerModelPackagePermissions" + }, + { + "Action":[ + "sagemaker:DescribeMlflowApp", + "sagemaker:CallMlflowAppApi", + "sagemaker-mlflow:CreateExperiment", + "sagemaker-mlflow:CreateRun", + "sagemaker-mlflow:UpdateRun", + "sagemaker-mlflow:LogBatch", + "sagemaker-mlflow:GetExperimentByName", + "sagemaker-mlflow:GetMetricHistory", + "sagemaker-mlflow:GetRun", + "sagemaker-mlflow:StartTrace", + "sagemaker-mlflow:EndTrace", + "sagemaker-mlflow:SearchTraces", + "sagemaker-mlflow:ListArtifacts" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sagemaker:*:*:mlflow-app/*" + ], + "Sid":"MLflowPermissions" + }, + { + "Action":[ + "bedrock-agentcore:InvokeAgentRuntime", + "bedrock-agentcore:StopRuntimeSession", + "bedrock-agentcore:GetAgentRuntime" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:bedrock-agentcore:*:*:runtime/*", + "Sid":"BedrockAgentCorePermissions" + }, + { + "Action":[ + "ec2:CreateNetworkInterface", + "ec2:CreateNetworkInterfacePermission", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeVpcs", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups", + "ec2:DescribeDhcpOptions" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2NetworkPermissions" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "ec2:CreateAction":"CreateNetworkInterface" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:network-interface/*", + "Sid":"EC2NetworkInterfaceTagPermissions" + }, + { + "Action":[ + "ec2:DeleteNetworkInterface", + "ec2:DeleteNetworkInterfacePermission" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2NetworkInterfaceDeletePermissions" + }, + { + "Action":[ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:logs:*:*:log-group:/aws/sagemaker/*", + "Sid":"CloudWatchLogsPermissions" + }, + { + "Action":[ + "lambda:InvokeFunction" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:lambda:*:*:function:*", + "Sid":"LambdaPermissions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T02:42:30+00:00" + }, + "AmazonSageMakerJobRuntimeAccess":{ + "CreateDate":"2026-06-03T02:42:10+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "sagemaker:Sample", + "sagemaker:SampleWithResponseStream", + "sagemaker:CompleteRollout", + "sagemaker:UpdateReward" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:sagemaker:*:*:job/*", + "Sid":"SageMakerJobRuntimePermissions" + }, + { + "Action":[ + "sagemaker:CallWithBearerToken" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"BearerTokenPermissions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T02:42:10+00:00" + }, "AmazonSageMakerMechanicalTurkAccess":{ "CreateDate":"2019-12-03T16:19:36+00:00", "DefaultVersionId":"v1", @@ -106780,7 +112224,7 @@ }, "AmazonSageMakerModelCustomizationCoreAccess":{ "CreateDate":"2026-05-26T18:57:29+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { @@ -107081,7 +112525,8 @@ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", - "ec2:DescribeVpcs" + "ec2:DescribeVpcs", + "servicequotas:ListServiceQuotas" ], "Condition":{ "StringEquals":{ @@ -107262,7 +112707,10 @@ } }, "Effect":"Allow", - "Resource":"arn:aws:iam::*:role/SageMakerForLambda*", + "Resource":[ + "arn:aws:iam::*:role/SageMakerForLambda*", + "arn:aws:iam::*:role/service-role/SageMakerForLambda*" + ], "Sid":"PassRoleForAWSLambda" }, { @@ -107276,7 +112724,10 @@ } }, "Effect":"Allow", - "Resource":"arn:aws:iam::*:role/SageMakerForBedrock*", + "Resource":[ + "arn:aws:iam::*:role/SageMakerForBedrock*", + "arn:aws:iam::*:role/service-role/SageMakerForBedrock*" + ], "Sid":"PassRoleForBedrock" } ], @@ -107284,7 +112735,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-26T18:57:29+00:00" + "UpdateDate":"2026-07-21T19:57:28+00:00" }, "AmazonSageMakerModelGovernanceUseAccess":{ "CreateDate":"2022-11-30T08:58:19+00:00", @@ -111108,7 +116559,7 @@ }, "AmazonTimestreamInfluxDBServiceRolePolicy":{ "CreateDate":"2024-03-14T18:53:21+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -111210,13 +116661,45 @@ "arn:aws:secretsmanager:*:*:secret:READONLY-InfluxDB-auth-parameters-*" ], "Sid":"ManageSecretStatement" + }, + { + "Action":[ + "secretsmanager:GetSecretValue" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:secretsmanager:*:*:secret:InfluxDB-RepoToken-*" + ], + "Sid":"RetrievePluginSecretStatement" + }, + { + "Action":[ + "kms:Decrypt" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:EncryptionContext:SecretARN":"arn:*:secretsmanager:*:*:secret:InfluxDB-RepoToken-*", + "kms:ViaService":"secretsmanager.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:*:kms:*:${aws:PrincipalAccount}:key/*", + "Sid":"DecryptPluginSecretStatement" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-03-14T18:53:21+00:00" + "UpdateDate":"2026-07-20T18:27:24+00:00" }, "AmazonTimestreamReadOnlyAccess":{ "CreateDate":"2020-09-30T21:47:08+00:00", @@ -113046,7 +118529,7 @@ }, "AnthropicLimitedAccess":{ "CreateDate":"2026-04-01T04:57:18+00:00", - "DefaultVersionId":"v5", + "DefaultVersionId":"v6", "Document":{ "Statement":[ { @@ -113070,6 +118553,7 @@ "aws-external-anthropic:CreateSkill", "aws-external-anthropic:CreateUserProfile", "aws-external-anthropic:CreateVault", + "aws-external-anthropic:CreateWebhook", "aws-external-anthropic:DeleteBatchInference", "aws-external-anthropic:DeleteEnvironment", "aws-external-anthropic:DeleteFile", @@ -113077,13 +118561,17 @@ "aws-external-anthropic:DeleteSession", "aws-external-anthropic:DeleteSkill", "aws-external-anthropic:DeleteVault", + "aws-external-anthropic:DeleteWebhook", + "aws-external-anthropic:ProcessEnvironmentWork", + "aws-external-anthropic:RotateWebhookSecret", "aws-external-anthropic:UpdateAgent", "aws-external-anthropic:UpdateEnvironment", "aws-external-anthropic:UpdateMemoryStore", "aws-external-anthropic:UpdateSession", "aws-external-anthropic:UpdateSkill", "aws-external-anthropic:UpdateUserProfile", - "aws-external-anthropic:UpdateVault" + "aws-external-anthropic:UpdateVault", + "aws-external-anthropic:UpdateWebhook" ], "Effect":"Allow", "Resource":"arn:aws:aws-external-anthropic:*:*:workspace/*", @@ -113137,7 +118625,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-08T22:27:10+00:00" + "UpdateDate":"2026-06-12T16:57:32+00:00" }, "AnthropicReadOnlyAccess":{ "CreateDate":"2026-04-01T04:57:09+00:00", @@ -113192,6 +118680,38 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-04-01T22:42:18+00:00" }, + "AnthropicSelfHostedEnvironmentAccess":{ + "CreateDate":"2026-06-12T17:12:29+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "aws-external-anthropic:GetEnvironment", + "aws-external-anthropic:GetSession", + "aws-external-anthropic:GetSkill", + "aws-external-anthropic:ProcessEnvironmentWork", + "aws-external-anthropic:UpdateSession" + ], + "Effect":"Allow", + "Resource":"arn:aws:aws-external-anthropic:*:*:workspace/*", + "Sid":"AnthropicSelfHostedEnvironmentWorkspace" + }, + { + "Action":[ + "aws-external-anthropic:CallWithBearerToken" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AnthropicSelfHostedEnvironmentResourceless" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-12T17:12:29+00:00" + }, "AppIntegrationsServiceLinkedRolePolicy":{ "CreateDate":"2022-09-30T19:42:56+00:00", "DefaultVersionId":"v1", @@ -115072,7 +120592,7 @@ }, "BedrockAgentCoreFullAccess":{ "CreateDate":"2025-07-16T13:37:07+00:00", - "DefaultVersionId":"v17", + "DefaultVersionId":"v18", "Document":{ "Statement":[ { @@ -115475,13 +120995,30 @@ "Effect":"Allow", "Resource":"arn:aws:lambda:*:*:function:*", "Sid":"AgentCoreEvaluationLambdaAccess" + }, + { + "Action":"bedrock-mantle:CreateInference", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:bedrock-mantle:*:*:project/*", + "Sid":"AgentCoreEvaluationBedrockMantleInference" + }, + { + "Action":"bedrock-mantle:CallWithBearerToken", + "Effect":"Allow", + "Resource":"*", + "Sid":"AgentCoreEvaluationBedrockMantleCallWithBearerToken" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-21T17:42:20+00:00" + "UpdateDate":"2026-07-28T16:57:19+00:00" }, "BedrockAgentCoreNetworkServiceRolePolicy":{ "CreateDate":"2025-09-19T22:04:06+00:00", @@ -115594,7 +121131,7 @@ }, "Billing":{ "CreateDate":"2016-11-10T17:33:18+00:00", - "DefaultVersionId":"v28", + "DefaultVersionId":"v30", "Document":{ "Statement":[ { @@ -115681,6 +121218,8 @@ "invoicing:GetInvoiceCorrection", "invoicing:ListInvoiceSummaries", "invoicing:ListInvoiceUnits", + "invoicing:ListProcurementPortals", + "invoicing:ListProcurementPortalSuppliers", "invoicing:CreateProcurementPortalPreference", "invoicing:GetProcurementPortalPreference", "invoicing:PutProcurementPortalPreference", @@ -115691,9 +121230,11 @@ "invoicing:ListInvoiceCorrections", "invoicing:StartInvoiceCorrection", "invoicing:PutInvoiceEmailDeliveryPreferences", + "invoicing:SendProcurementPortalValidation", "invoicing:TagResource", "invoicing:UntagResource", "invoicing:UpdateInvoiceUnit", + "invoicing:VerifyProcurementPortalValidation", "mapcredits:ListQuarterSpend", "mapcredits:ListAssociatedPrograms", "mapcredits:ListQuarterCredits", @@ -115758,7 +121299,7 @@ }, "Path":"/job-function/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-08T17:12:18+00:00" + "UpdateDate":"2026-07-30T22:12:16+00:00" }, "BudgetsServiceRolePolicy":{ "CreateDate":"2025-07-30T21:07:06+00:00", @@ -115886,15 +121427,41 @@ }, "CloudFormationStackSetsOrgMemberServiceRolePolicy":{ "CreateDate":"2019-12-09T23:52:37+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ + { + "Action":[ + "cloudformation:CreateStack", + "cloudformation:DescribeStackEvents", + "cloudformation:UpdateStack", + "cloudformation:DeleteStack", + "cloudformation:DescribeStacks" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:cloudformation:*:*:stack/stacksets-exec-role-stack-*" + ] + }, { "Action":[ "iam:CreateRole", "iam:DeleteRole", - "iam:GetRole" + "iam:GetRole", + "iam:GetRolePolicy", + "iam:DeleteRolePolicy", + "iam:PutRolePolicy" ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, "Effect":"Allow", "Resource":[ "arn:aws:iam::*:role/stacksets-exec-*" @@ -115920,11 +121487,11 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2019-12-09T23:52:37+00:00" + "UpdateDate":"2026-07-22T20:12:14+00:00" }, "CloudFrontFullAccess":{ "CreateDate":"2015-02-06T18:39:50+00:00", - "DefaultVersionId":"v14", + "DefaultVersionId":"v15", "Document":{ "Statement":[ { @@ -115954,7 +121521,10 @@ "ec2:DescribeIpamPools", "ec2:GetIpamPoolCidrs", "pricingplanmanager:ListSubscriptions", - "pricingplanmanager:CreateSubscription" + "pricingplanmanager:CreateSubscription", + "cloudwatch:GetMetricData", + "freetier:GetAccountPlanState", + "shield:ListProtections" ], "Effect":"Allow", "Resource":"*", @@ -115991,6 +121561,7 @@ }, { "Action":[ + "pricingplanmanager:ApprovePaidSubscription", "pricingplanmanager:AssociateResourcesToSubscription", "pricingplanmanager:CancelSubscription", "pricingplanmanager:CancelSubscriptionChange", @@ -116007,7 +121578,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:59:45+00:00" + "UpdateDate":"2026-07-30T16:42:27+00:00" }, "CloudFrontReadOnlyAccess":{ "CreateDate":"2015-02-06T18:39:55+00:00", @@ -116281,7 +121852,7 @@ }, "CloudWatchAPIKeyAccess":{ "CreateDate":"2026-05-08T08:57:08+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -116290,14 +121861,29 @@ "cloudwatch:PutMetricData" ], "Effect":"Allow", - "Resource":"*" + "Resource":"*", + "Sid":"CloudWatchMetricsAPIs" + }, + { + "Action":[ + "kms:Decrypt" + ], + "Condition":{ + "StringLike":{ + "kms:EncryptionContext:aws:cloudwatch:arn":"arn:aws:cloudwatch:*:*:dataset/*", + "kms:ViaService":"cloudwatch.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"KMSDecryptForCMKDatasets" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-08T08:57:08+00:00" + "UpdateDate":"2026-06-04T20:42:29+00:00" }, "CloudWatchActionsEC2Access":{ "CreateDate":"2015-07-07T00:00:33+00:00", @@ -117380,7 +122966,7 @@ }, "CloudWatchFullAccessV2":{ "CreateDate":"2023-08-01T11:32:57+00:00", - "DefaultVersionId":"v15", + "DefaultVersionId":"v16", "Document":{ "Statement":[ { @@ -117596,13 +123182,41 @@ ], "Effect":"Allow", "Resource":"arn:aws:s3tables:*:*:bucket/aws-cloudwatch" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "ArnLike":{ + "iam:AssociatedResourceArn":"arn:aws:logs:*:*:scheduled-query:*" + }, + "StringEquals":{ + "iam:PassedToService":"logs.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"LogAlarmScheduledQueryPassRolePermissions" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "ArnLike":{ + "iam:AssociatedResourceArn":"arn:aws:cloudwatch:*:*:alarm:*" + }, + "StringEquals":{ + "iam:PassedToService":"cloudwatch.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"LogAlarmLogLinesPassRolePermissions" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T18:00:06+00:00" + "UpdateDate":"2026-06-08T13:27:16+00:00" }, "CloudWatchInternetMonitorFullAccess":{ "CreateDate":"2024-10-22T21:02:59+00:00", @@ -120815,6 +126429,191 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-03-25T20:42:12+00:00" }, + "DBModVirtualSource":{ + "CreateDate":"2026-07-06T23:12:26+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:DescribeInstances", + "ec2:DescribeSubnets", + "ec2:DescribeVpcs", + "ec2:DescribeSecurityGroups", + "ec2:DescribeAvailabilityZones", + "ec2:DescribeVpcEndpoints", + "ec2:DescribeInternetGateways", + "rds:DescribeDBInstances", + "rds:DescribeDBClusters", + "rds:DescribeDBSubnetGroups", + "secretsmanager:ListSecrets", + "kms:ListAliases", + "kms:DescribeKey" + ], + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":"rds:ModifyDBSubnetGroup", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:rds:*:*:subgrp:*" + }, + { + "Action":[ + "rds:EnableHttpEndpoint", + "rds:DisableHttpEndpoint", + "rds-data:ExecuteStatement" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/Owner":"database-connector", + "aws:ResourceTag/Project":"atx-db-modernization" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:rds:*:*:cluster:*" + }, + { + "Action":[ + "iam:GetPolicy", + "iam:GetPolicyVersion" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:policy/*" + }, + { + "Action":"kms:Decrypt", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "kms:EncryptionContext:SecretArn":"arn:aws:secretsmanager:*:${aws:PrincipalAccount}:secret:*", + "kms:ViaService":"secretsmanager.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*" + }, + { + "Action":"secretsmanager:UpdateSecret", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/Owner":"database-connector", + "aws:ResourceTag/Project":"atx-db-modernization" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:secretsmanager:*:*:secret:atx-db-modernization-*" + }, + { + "Action":[ + "secretsmanager:CreateSecret", + "secretsmanager:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/Owner":"database-connector", + "aws:RequestTag/Project":"atx-db-modernization", + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/Owner":"database-connector", + "aws:ResourceTag/Project":"atx-db-modernization" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:secretsmanager:*:*:secret:atx-db-modernization-*" + }, + { + "Action":[ + "s3:CreateBucket", + "s3:PutBucketTagging", + "s3:PutBucketVersioning", + "s3:ListBucket", + "s3:GetObject", + "s3:GetBucketLocation", + "s3:PutObject", + "s3:DeleteObject", + "s3:GetBucketVersioning" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:s3:::atx-db-modernization-*", + "arn:aws:s3:::atx-db-modernization-*/*" + ] + }, + { + "Action":[ + "rds:CreateDBSubnetGroup", + "rds:CreateDBCluster", + "rds:CreateDBInstance", + "rds:AddTagsToResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/Owner":"database-connector", + "aws:RequestTag/Project":"atx-db-modernization", + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:rds:*:*:subgrp:*", + "arn:aws:rds:*:*:cluster:*", + "arn:aws:rds:*:*:db:*" + ] + }, + { + "Action":[ + "secretsmanager:GetSecretValue", + "secretsmanager:DescribeSecret" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "aws:ResourceTag/Owner":"database-connector", + "aws:ResourceTag/Project":"atx-db-modernization" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:secretsmanager:*:*:secret:*" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + }, + "StringLike":{ + "iam:AWSServiceName":"rds.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-06T23:12:26+00:00" + }, "DataScientist":{ "CreateDate":"2016-11-10T17:28:48+00:00", "DefaultVersionId":"v5", @@ -121100,7 +126899,7 @@ }, "DeclarativePoliciesEC2Report":{ "CreateDate":"2024-11-30T13:21:06+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ { @@ -121111,7 +126910,8 @@ "ec2:GetImageBlockPublicAccessState", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetAllowedImagesSettings", - "ec2:DescribeVpcBlockPublicAccessOptions" + "ec2:DescribeVpcBlockPublicAccessOptions", + "ec2:DescribeAccountVpcEncryptionControl" ], "Effect":"Allow", "Resource":[ @@ -121124,7 +126924,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-11-30T13:21:06+00:00" + "UpdateDate":"2026-07-03T10:57:26+00:00" }, "DynamoDBCloudWatchContributorInsightsServiceRolePolicy":{ "CreateDate":"2019-11-15T21:13:58+00:00", @@ -121289,12 +127089,13 @@ }, "EC2ApplicationStatusChecksServiceRolePolicy":{ "CreateDate":"2026-04-27T23:42:19+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { "Action":[ - "ec2:DeleteNetworkInterface" + "ec2:DeleteNetworkInterface", + "ec2:AssignIpv6Addresses" ], "Condition":{ "StringEquals":{ @@ -121316,13 +127117,23 @@ ], "Effect":"Allow", "Resource":"*" + }, + { + "Action":"cloudwatch:PutMetricData", + "Condition":{ + "StringEquals":{ + "cloudwatch:namespace":"AWS/Usage" + } + }, + "Effect":"Allow", + "Resource":"*" } ], "Version":"2012-10-17" }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-27T23:42:19+00:00" + "UpdateDate":"2026-07-15T17:12:31+00:00" }, "EC2FastLaunchFullAccess":{ "CreateDate":"2024-05-13T22:45:26+00:00", @@ -121958,6 +127769,679 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2019-12-23T19:47:15+00:00" }, + "EC2ImageBuilderExecutionPolicy":{ + "CreateDate":"2026-06-04T17:12:14+00:00", + "DefaultVersionId":"v2", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:RunInstances" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*", + "arn:aws:ec2:*::snapshot/*", + "arn:aws:ec2:*:*:key-pair/*", + "arn:aws:ec2:*:*:launch-template/*", + "arn:aws:ec2:*:*:network-interface/*", + "arn:aws:ec2:*:*:security-group/*", + "arn:aws:ec2:*:*:subnet/*", + "arn:aws:license-manager:*:*:license-configuration:*" + ], + "Sid":"RunInstancesPermissions" + }, + { + "Action":[ + "ec2:RunInstances" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":[ + "EC2 Image Builder", + "EC2 Fast Launch" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*", + "arn:aws:ec2:*:*:volume/*" + ], + "Sid":"RunInstancesWithEC2ImageBuilderRequestTagsPermissions" + }, + { + "Action":[ + "iam:PassRole" + ], + "Condition":{ + "StringEquals":{ + "iam:PassedToService":[ + "ec2.amazonaws.com", + "ec2.amazonaws.com.cn", + "vmie.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/*" + ], + "Sid":"IAMPassRolePermissions" + }, + { + "Action":[ + "ec2:StartInstances", + "ec2:StopInstances", + "ec2:TerminateInstances" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2InstanceStateChangePermissions" + }, + { + "Action":[ + "ec2:DescribeExportImageTasks", + "ec2:DescribeHosts", + "ec2:DescribeImages", + "ec2:DescribeImportImageTasks", + "ec2:DescribeInstanceAttribute", + "ec2:DescribeInstances", + "ec2:DescribeInstanceStatus", + "ec2:DescribeInstanceTypes", + "ec2:DescribeInstanceTypeOfferings", + "ec2:DescribeSnapshots", + "ec2:DescribeSubnets", + "ec2:DescribeTags" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2ReadOnlyPermissions" + }, + { + "Action":[ + "ec2:CopyImage" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2CopyPermissions" + }, + { + "Action":[ + "ec2:CreateImage" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*", + "arn:aws:ec2:*::snapshot/*" + ], + "Sid":"EC2CreateImagePermissionsForImage" + }, + { + "Action":[ + "ec2:CreateImage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*" + ], + "Sid":"EC2CreateImagePermissionsForInstance" + }, + { + "Action":[ + "ec2:DeregisterImage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*" + ], + "Sid":"EC2DeregisterImagePermissions" + }, + { + "Action":[ + "ec2:RegisterImage" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*" + ], + "Sid":"EC2RegisterImagePermissionsForImage" + }, + { + "Action":[ + "ec2:RegisterImage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::snapshot/*" + ], + "Sid":"EC2RegisterImagePermissionsForSnapshot" + }, + { + "Action":[ + "ec2:ModifyImageAttribute" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"EC2ModifyImageAttributePermissions" + }, + { + "Action":[ + "ec2:ModifySnapshotAttribute" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::snapshot/*" + ], + "Sid":"EC2SnapshotAttributeModificationPermissions" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":[ + "EC2 Image Builder", + "EC2 Fast Launch" + ], + "ec2:CreateAction":[ + "CreateImage", + "RunInstances" + ] + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CreateTagsOnCreatePermissions" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*", + "arn:aws:ec2:*:*:export-image-task/*" + ], + "Sid":"CreateCustomerTagsPermissions" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":[ + "EC2 Image Builder", + "EC2 Fast Launch" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::snapshot/*", + "arn:aws:ec2:*:*:launch-template/*" + ], + "Sid":"CreateEC2ImageBuilderTagsPermissions" + }, + { + "Action":[ + "ec2:AttachImageWatermark" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*" + ], + "Sid":"AttachImageWatermarkPermissions" + }, + { + "Action":[ + "license-manager:UpdateLicenseSpecificationsForResource" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:license-manager:*:*:license-configuration:*" + ], + "Sid":"UpdateCustomerLicensePermissions" + }, + { + "Action":[ + "sns:Publish" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sns:*:*:*" + ], + "Sid":"PublishNotificationToCustomerSNSPermissions" + }, + { + "Action":[ + "ssm:DescribeInstanceInformation", + "ssm:GetCommandInvocation", + "ssm:ListCommandInvocations", + "ssm:ListInventoryEntries" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"SystemsManagerPermissions" + }, + { + "Action":[ + "ssm:DescribeAssociationExecutions" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:association/*" + ], + "Sid":"SystemsManagerPermissionsForAssociation" + }, + { + "Action":[ + "ssm:DescribeInstanceAssociationsStatus" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*" + ], + "Sid":"SystemsManagerPermissionsForInstance" + }, + { + "Action":[ + "ssm:SendCommand" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript", + "arn:aws:ssm:*:*:document/AWS-RunShellScript", + "arn:aws:ssm:*:*:document/AWSEC2-RunSysprep" + ], + "Sid":"SendCommandDocumentPermissions" + }, + { + "Action":[ + "ssm:SendCommand" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*" + ], + "Sid":"SendCommandEC2ImageBuilderInstancePermissions" + }, + { + "Action":[ + "ssm:CreateAssociation" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:association/*", + "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory" + ], + "Sid":"InventoryCollectionAssociationPermissions" + }, + { + "Action":[ + "ssm:CreateAssociation" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*" + ], + "Sid":"InventoryCollectionInstancePermissions" + }, + { + "Action":[ + "ssm:AddTagsToResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:association/*" + ], + "Sid":"InventoryCollectionTagPermissions" + }, + { + "Action":[ + "ssm:DeleteAssociation" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:association/*" + ], + "Sid":"DeleteInventoryCollectionAssociationPermissions" + }, + { + "Action":[ + "kms:Encrypt", + "kms:Decrypt", + "kms:ReEncryptFrom", + "kms:ReEncryptTo", + "kms:GenerateDataKeyWithoutPlaintext" + ], + "Condition":{ + "ForAllValues:StringEquals":{ + "kms:EncryptionContextKeys":[ + "aws:ebs:id" + ] + }, + "StringLike":{ + "kms:ViaService":[ + "ec2.*.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:kms:*:*:key/*" + ], + "Sid":"EC2KMSPermissions" + }, + { + "Action":[ + "kms:DescribeKey" + ], + "Condition":{ + "StringLike":{ + "kms:ViaService":[ + "ec2.*.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:kms:*:*:key/*" + ], + "Sid":"EC2KMSDescribeKeyPermissions" + }, + { + "Action":[ + "kms:CreateGrant" + ], + "Condition":{ + "Bool":{ + "kms:GrantIsForAWSResource":true + }, + "StringLike":{ + "kms:ViaService":[ + "ec2.*.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:kms:*:*:key/*" + ], + "Sid":"EC2KMSGrantKeyPermissions" + }, + { + "Action":[ + "sts:AssumeRole" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole" + ], + "Sid":"CrossAccountAssumeRolePermissions" + }, + { + "Action":[ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*" + ], + "Sid":"CloudWatchLogsPermissions" + }, + { + "Action":[ + "ec2:CreateLaunchTemplateVersion", + "ec2:DescribeLaunchTemplateVersions", + "ec2:DescribeLaunchTemplates", + "ec2:ModifyLaunchTemplate" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"LaunchTemplatePermissions" + }, + { + "Action":[ + "ec2:ExportImage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*" + ], + "Sid":"ExportImageBuilderImagePermissions" + }, + { + "Action":[ + "ec2:ExportImage" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:export-image-task/*" + ], + "Sid":"CreateExportImageTaskPermissions" + }, + { + "Action":[ + "ec2:CancelExportTask" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:export-image-task/*" + ], + "Sid":"CancelExportImageTaskPermissions" + }, + { + "Action":[ + "iam:CreateServiceLinkedRole" + ], + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":[ + "ssm.amazonaws.com", + "ec2fastlaunch.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:role/*" + ], + "Sid":"CreateSLRForOtherServicesPermissions" + }, + { + "Action":[ + "ec2:EnableFastLaunch" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*::image/*", + "arn:aws:ec2:*:*:launch-template/*" + ], + "Sid":"EnableFastLaunchPermissions" + }, + { + "Action":[ + "inspector2:ListCoverage", + "inspector2:ListFindings" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ListInspectorFindingsPermissions" + }, + { + "Action":[ + "ecr:CreateRepository", + "ecr:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ecr:*:*:repository/image-builder-*" + ], + "Sid":"CreateECRImageForInspectorScanningPermissions" + }, + { + "Action":[ + "ecr:BatchDeleteImage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/CreatedBy":"EC2 Image Builder" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ecr:*:*:repository/image-builder-*" + ], + "Sid":"DeleteECRImageForInspectorScanningPermissions" + }, + { + "Action":[ + "events:DeleteRule", + "events:DescribeRule", + "events:PutRule", + "events:PutTargets", + "events:RemoveTargets" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:events:*:*:rule/ImageBuilder-*" + ], + "Sid":"EventBridgePermissionsForInspectorScanning" + }, + { + "Action":[ + "ssm:GetParameter", + "ssm:PutParameter" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*:*:parameter/imagebuilder/*" + ], + "Sid":"ParameterStorePermissionsForImageBuilderParameters" + }, + { + "Action":[ + "ssm:GetParameter" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ssm:*::parameter/aws/service/*" + ], + "Sid":"ParameterStorePermissionsForServiceManagedParameters" + }, + { + "Action":[ + "imagebuilder:StartImagePipelineExecution", + "imagebuilder:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:imagebuilder:*:*:image-pipeline/*" + ], + "Sid":"StartImagePipelineExecutionPermissions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-08T16:27:23+00:00" + }, "EC2ImageBuilderLifecycleExecutionPolicy":{ "CreateDate":"2023-11-16T23:23:09+00:00", "DefaultVersionId":"v1", @@ -123532,6 +130016,181 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2018-11-28T10:40:24+00:00" }, + "FinOpsAgentAgentPolicy":{ + "CreateDate":"2026-06-03T19:57:12+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ce:GetCostAndUsage", + "ce:GetCostAndUsageWithResources", + "ce:GetCostForecast", + "ce:GetUsageForecast", + "ce:GetDimensionValues", + "ce:GetTags", + "ce:GetCostCategories", + "ce:GetCostAndUsageComparisons", + "ce:GetCostComparisonDrivers", + "ce:GetSavingsPlansCoverage", + "ce:GetSavingsPlansUtilization", + "ce:GetSavingsPlansUtilizationDetails", + "ce:GetSavingsPlansPurchaseRecommendation", + "ce:GetReservationCoverage", + "ce:GetReservationUtilization", + "ce:GetReservationPurchaseRecommendation", + "ce:GetAnomalies", + "ce:GetAnomalyMonitors", + "ce:ListCostAllocationTags", + "ce:ListCostAllocationTagBackfillHistory", + "ce:DescribeCostCategoryDefinition", + "ce:ListCostCategoryDefinitions", + "budgets:ViewBudget", + "cost-optimization-hub:GetRecommendation", + "cost-optimization-hub:ListRecommendations", + "cost-optimization-hub:ListRecommendationSummaries", + "compute-optimizer:DescribeRecommendationExportJobs", + "compute-optimizer:GetEnrollmentStatus", + "compute-optimizer:GetEnrollmentStatusesForOrganization", + "compute-optimizer:GetRecommendationSummaries", + "compute-optimizer:GetEC2InstanceRecommendations", + "compute-optimizer:GetEC2RecommendationProjectedMetrics", + "compute-optimizer:GetAutoScalingGroupRecommendations", + "compute-optimizer:GetEBSVolumeRecommendations", + "compute-optimizer:GetLambdaFunctionRecommendations", + "compute-optimizer:GetRecommendationPreferences", + "compute-optimizer:GetEffectiveRecommendationPreferences", + "compute-optimizer:GetECSServiceRecommendations", + "compute-optimizer:GetECSServiceRecommendationProjectedMetrics", + "compute-optimizer:GetLicenseRecommendations", + "compute-optimizer:GetRDSDatabaseRecommendations", + "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics", + "compute-optimizer:GetIdleRecommendations", + "ec2:DescribeInstances", + "ec2:DescribeVolumes", + "ecs:ListServices", + "ecs:ListClusters", + "autoscaling:DescribeAutoScalingGroups", + "autoscaling:DescribeAutoScalingInstances", + "lambda:ListFunctions", + "lambda:ListProvisionedConcurrencyConfigs", + "organizations:ListAccounts", + "organizations:DescribeOrganization", + "organizations:DescribeAccount", + "rds:DescribeDBInstances", + "rds:DescribeDBClusters", + "pricing:DescribeServices", + "pricing:GetAttributeValues", + "pricing:GetProducts", + "freetier:GetFreeTierUsage", + "bcm-pricing-calculator:GetPreferences", + "bcm-pricing-calculator:GetWorkloadEstimate", + "bcm-pricing-calculator:ListWorkloadEstimateUsage", + "bcm-pricing-calculator:ListWorkloadEstimates", + "cloudtrail:LookupEvents", + "cloudtrail:DescribeTrails", + "cloudtrail:GetTrailStatus", + "cloudtrail:GetEventSelectors", + "cloudwatch:GetMetricData", + "cloudwatch:GetMetricStatistics", + "cloudwatch:ListMetrics", + "logs:StartQuery", + "logs:GetQueryResults" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"FinOpsAgentDataAccess" + }, + { + "Action":[ + "events:PutRule", + "events:PutTargets", + "events:DeleteRule", + "events:RemoveTargets", + "events:EnableRule", + "events:DisableRule" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}", + "events:ManagedBy":"finops-agent.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:events:*:*:rule/*", + "Sid":"EventBridgeManagedRuleManagementWritePermissions" + }, + { + "Action":[ + "events:DescribeRule", + "events:ListTargetsByRule" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceAccount":"${aws:PrincipalAccount}" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:events:*:*:rule/*", + "Sid":"EventBridgeManagedRuleManagementReadPermissions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T19:57:12+00:00" + }, + "FinOpsAgentOperatorPolicy":{ + "CreateDate":"2026-06-03T19:57:09+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "finops-agent:CreateConversation", + "finops-agent:ListConversations", + "finops-agent:CreateTurn", + "finops-agent:GetTurn", + "finops-agent:ListTurns", + "finops-agent:CancelTurn", + "finops-agent:AcceptAgentRequest", + "finops-agent:RejectAgentRequest", + "finops-agent:GetAgentRequest", + "finops-agent:CreateTask", + "finops-agent:GetTask", + "finops-agent:ListTasks", + "finops-agent:CancelTask", + "finops-agent:CreateAutomation", + "finops-agent:GetAutomation", + "finops-agent:ListAutomations", + "finops-agent:UpdateAutomation", + "finops-agent:DeleteAutomation", + "finops-agent:CreateDocument", + "finops-agent:GetDocumentContent", + "finops-agent:GetDocumentMetadata", + "finops-agent:ListDocuments", + "finops-agent:UpdateDocument", + "finops-agent:DeleteDocument", + "finops-agent:RestoreDocument", + "finops-agent:GetArtifactContent", + "finops-agent:GetArtifactMetadata", + "finops-agent:DeleteArtifact", + "finops-agent:ListArtifacts", + "finops-agent:ListRecords", + "finops-agent:SendFeedback" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"FinOpsAgentOperatorAccess" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-03T19:57:09+00:00" + }, "GameLiftContainerFleetPolicy":{ "CreateDate":"2024-11-12T19:28:49+00:00", "DefaultVersionId":"v4", @@ -125673,7 +132332,7 @@ }, "NetworkAdministrator":{ "CreateDate":"2016-11-10T17:31:35+00:00", - "DefaultVersionId":"v15", + "DefaultVersionId":"v16", "Document":{ "Statement":[ { @@ -125828,6 +132487,19 @@ "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:*", + "interconnect:AcceptConnectionProposal", + "interconnect:CreateConnection", + "interconnect:DeleteConnection", + "interconnect:DescribeConnectionProposal", + "interconnect:GetConnection", + "interconnect:GetEnvironment", + "interconnect:ListAttachPoints", + "interconnect:ListConnections", + "interconnect:ListEnvironments", + "interconnect:ListTagsForResource", + "interconnect:TagResource", + "interconnect:UntagResource", + "interconnect:UpdateConnection", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", @@ -125977,7 +132649,7 @@ }, "Path":"/job-function/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:59:36+00:00" + "UpdateDate":"2026-07-09T14:42:15+00:00" }, "NetworkSecurityDirectorServiceLinkedRolePolicy":{ "CreateDate":"2025-06-13T20:07:06+00:00", @@ -126540,6 +133212,58 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T17:59:14+00:00" }, + "PricingPlanManagerFullAccess":{ + "CreateDate":"2026-07-30T16:42:14+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "pricingplanmanager:GetSubscription", + "pricingplanmanager:ListSubscriptions", + "pricingplanmanager:CreateSubscription", + "pricingplanmanager:ApprovePaidSubscription", + "pricingplanmanager:UpdateSubscription", + "pricingplanmanager:CancelSubscription", + "pricingplanmanager:CancelSubscriptionChange", + "pricingplanmanager:AssociateResourcesToSubscription", + "pricingplanmanager:DisassociateResourcesFromSubscription", + "freetier:GetAccountPlanState", + "cloudwatch:GetMetricData", + "shield:ListProtections" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ppmglobalactions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-30T16:42:14+00:00" + }, + "PricingPlanManagerReadonlyAccess":{ + "CreateDate":"2026-07-30T16:42:18+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "pricingplanmanager:ListSubscriptions", + "pricingplanmanager:GetSubscription" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ppmglobalactions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-30T16:42:18+00:00" + }, "QAppsServiceRolePolicy":{ "CreateDate":"2024-09-26T19:22:22+00:00", "DefaultVersionId":"v1", @@ -126895,7 +133619,7 @@ }, "ROSAControlPlaneOperatorPolicy":{ "CreateDate":"2023-04-24T23:02:49+00:00", - "DefaultVersionId":"v6", + "DefaultVersionId":"v7", "Document":{ "Statement":[ { @@ -126903,6 +133627,7 @@ "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcs", "ec2:DescribeSecurityGroups", + "ec2:DescribeSubnets", "route53:ListHostedZones" ], "Effect":"Allow", @@ -127084,23 +133809,34 @@ }, { "Action":[ - "ec2:CreateTags" + "ec2:CreateTags", + "ec2:DeleteTags" ], "Condition":{ + "ForAllValues:StringNotEquals":{ + "aws:TagKeys":[ + "red-hat-managed" + ] + }, + "Null":{ + "aws:TagKeys":"false" + }, "StringEquals":{ "aws:ResourceTag/red-hat-managed":"true" } }, "Effect":"Allow", - "Resource":"arn:aws:ec2:*:*:security-group/*", - "Sid":"AddTagsToRedHatManagedSecurityGroups" + "Resource":[ + "arn:aws:ec2:*:*:security-group/*" + ], + "Sid":"AddDeleteTagsRedHatManagedSecurityGroups" } ], "Version":"2012-10-17" }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-04-10T16:12:18+00:00" + "UpdateDate":"2026-07-28T23:12:18+00:00" }, "ROSAImageRegistryOperatorPolicy":{ "CreateDate":"2023-04-27T20:13:18+00:00", @@ -127594,6 +134330,285 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2023-04-27T20:10:20+00:00" }, + "ROSAKarpenterControllerPolicy":{ + "CreateDate":"2026-07-27T16:42:18+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "ec2:DescribeAvailabilityZones", + "ec2:DescribeCapacityReservations", + "ec2:DescribeImages", + "ec2:DescribeInstances", + "ec2:DescribeInstanceTypeOfferings", + "ec2:DescribeInstanceTypes", + "ec2:DescribeLaunchTemplates", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSnapshots", + "ec2:DescribeSpotPriceHistory", + "ec2:DescribeSubnets", + "ec2:DescribeVpcs" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ReadPermissions" + }, + { + "Action":[ + "pricing:GetProducts" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"PricingReadActions" + }, + { + "Action":"kms:DescribeKey", + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/red-hat":"true" + }, + "StringLike":{ + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"DescribeKMSKeysForEBSVolumeEncryption" + }, + { + "Action":[ + "kms:Decrypt", + "kms:ReEncryptFrom", + "kms:ReEncryptTo", + "kms:GenerateDataKeyWithoutPlaintext" + ], + "Condition":{ + "ForAllValues:StringEquals":{ + "kms:EncryptionContextKeys":[ + "aws:ebs:id" + ] + }, + "StringEquals":{ + "aws:ResourceTag/red-hat":"true" + }, + "StringLike":{ + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"CryptoOpsForEBSVolumeEncryption" + }, + { + "Action":"kms:CreateGrant", + "Condition":{ + "Bool":{ + "kms:GrantIsForAWSResource":true + }, + "ForAllValues:StringEquals":{ + "kms:EncryptionContextKeys":[ + "aws:ebs:id" + ], + "kms:GrantOperations":[ + "Decrypt", + "GenerateDataKeyWithoutPlaintext", + "ReEncryptFrom", + "ReEncryptTo" + ] + }, + "StringEquals":{ + "kms:GrantConstraintType":"EncryptionContextSubset" + }, + "StringLike":{ + "kms:ViaService":"ec2.*.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:kms:*:*:key/*", + "Sid":"CreateGrantForEBSVolumeEncryption" + }, + { + "Action":[ + "ec2:RunInstances", + "ec2:CreateFleet" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:security-group/*", + "arn:aws:ec2:*:*:subnet/*", + "arn:aws:ec2:*:*:capacity-reservation/*" + ], + "Sid":"CreateEC2Resources" + }, + { + "Action":[ + "ec2:RunInstances", + "ec2:CreateFleet" + ], + "Condition":{ + "StringEquals":{ + "ec2:Owner":[ + "531415883065", + "251351625822", + "210686502322" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*::image/*", + "Sid":"CreateEC2ResourcesWithApprovedAMIs" + }, + { + "Action":[ + "ec2:RunInstances", + "ec2:CreateFleet", + "ec2:CreateLaunchTemplate" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/red-hat-managed":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:fleet/*", + "arn:aws:ec2:*:*:instance/*", + "arn:aws:ec2:*:*:volume/*", + "arn:aws:ec2:*:*:network-interface/*", + "arn:aws:ec2:*:*:launch-template/*", + "arn:aws:ec2:*:*:spot-instances-request/*" + ], + "Sid":"CreateEC2ResourcesWithTags" + }, + { + "Action":[ + "ec2:RunInstances", + "ec2:CreateFleet" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/red-hat-managed":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:launch-template/*", + "Sid":"CreateEC2ResourcesLaunchTemplate" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/red-hat-managed":"true", + "ec2:CreateAction":[ + "RunInstances", + "CreateFleet", + "CreateLaunchTemplate" + ] + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:fleet/*", + "arn:aws:ec2:*:*:instance/*", + "arn:aws:ec2:*:*:volume/*", + "arn:aws:ec2:*:*:network-interface/*", + "arn:aws:ec2:*:*:launch-template/*", + "arn:aws:ec2:*:*:spot-instances-request/*" + ], + "Sid":"CreateTagsOnResources" + }, + { + "Action":[ + "ec2:CreateTags" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/red-hat-managed":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:ec2:*:*:instance/*", + "Sid":"ManageTagsOnManagedResources" + }, + { + "Action":[ + "ec2:TerminateInstances", + "ec2:DeleteLaunchTemplate" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/red-hat-managed":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:ec2:*:*:instance/*", + "arn:aws:ec2:*:*:launch-template/*" + ], + "Sid":"TerminateManagedResources" + }, + { + "Action":[ + "iam:PassRole" + ], + "Condition":{ + "StringEquals":{ + "iam:PassedToService":[ + "ec2.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/*-ROSA-Worker-Role", + "Sid":"PassInstanceRole" + }, + { + "Action":[ + "iam:AddRoleToInstanceProfile", + "iam:RemoveRoleFromInstanceProfile", + "iam:DeleteInstanceProfile" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:instance-profile/rosa-service-managed-*" + ], + "Sid":"ManageInstanceProfiles" + }, + { + "Action":[ + "iam:CreateInstanceProfile", + "iam:TagInstanceProfile" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/red-hat-managed":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:iam::*:instance-profile/rosa-service-managed-*" + ], + "Sid":"CreateInstanceProfiles" + }, + { + "Action":[ + "iam:GetInstanceProfile", + "iam:ListInstanceProfiles" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"ReadInstanceProfiles" + } + ], + "Version":"2012-10-17" + }, + "Path":"/service-role/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-27T16:42:18+00:00" + }, "ROSAKubeControllerPolicy":{ "CreateDate":"2023-04-27T20:09:29+00:00", "DefaultVersionId":"v7", @@ -127841,7 +134856,7 @@ }, "ROSANodePoolManagementPolicy":{ "CreateDate":"2023-06-08T20:48:08+00:00", - "DefaultVersionId":"v8", + "DefaultVersionId":"v9", "Document":{ "Statement":[ { @@ -127849,6 +134864,7 @@ "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", + "ec2:DescribeInstanceTypes", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeNetworkInterfaceAttribute", @@ -128064,6 +135080,22 @@ ], "Sid":"RunInstancesRedHatAMI" }, + { + "Action":[ + "sqs:DeleteMessage", + "sqs:ReceiveMessage" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/red-hat":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sqs:*:*:*" + ], + "Sid":"NodePoolSQSActions" + }, { "Action":[ "kms:DescribeKey", @@ -128102,7 +135134,7 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:59:26+00:00" + "UpdateDate":"2026-07-29T16:57:30+00:00" }, "ROSASRESupportPolicy":{ "CreateDate":"2023-06-01T14:36:06+00:00", @@ -128680,9 +135712,30 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-02-12T17:59:37+00:00" }, + "ReInventTicketApprovalAccess":{ + "CreateDate":"2026-06-10T18:57:15+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "eventsbilltoaws:info", + "eventsbilltoaws:approve" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowBillToAWSActions" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-06-10T18:57:15+00:00" + }, "ReadOnlyAccess":{ "CreateDate":"2015-02-06T18:39:48+00:00", - "DefaultVersionId":"v185", + "DefaultVersionId":"v188", "Document":{ "Statement":[ { @@ -128997,18 +136050,24 @@ "backup:List*", "batch:Describe*", "batch:List*", + "bedrock-agentcore:GetABTest", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", "bedrock-agentcore:GetApiKeyCredentialProvider", + "bedrock-agentcore:GetBatchEvaluation", "bedrock-agentcore:GetBrowser", "bedrock-agentcore:GetBrowserProfile", "bedrock-agentcore:GetBrowserSession", "bedrock-agentcore:GetCodeInterpreter", "bedrock-agentcore:GetCodeInterpreterSession", + "bedrock-agentcore:GetConfigurationBundle", + "bedrock-agentcore:GetConfigurationBundleVersion", "bedrock-agentcore:GetEvaluator", "bedrock-agentcore:GetEvent", "bedrock-agentcore:GetGateway", "bedrock-agentcore:GetGatewayTarget", + "bedrock-agentcore:GetHarness", + "bedrock-agentcore:GetHarnessEndpoint", "bedrock-agentcore:GetMemory", "bedrock-agentcore:GetMemoryRecord", "bedrock-agentcore:GetOauth2CredentialProvider", @@ -129016,21 +136075,28 @@ "bedrock-agentcore:GetPolicy", "bedrock-agentcore:GetPolicyEngine", "bedrock-agentcore:GetPolicyGeneration", + "bedrock-agentcore:GetRecommendation", "bedrock-agentcore:GetTokenVault", "bedrock-agentcore:GetWorkloadIdentity", + "bedrock-agentcore:ListABTests", "bedrock-agentcore:ListAgentRuntimeEndpoints", "bedrock-agentcore:ListAgentRuntimes", "bedrock-agentcore:ListAgentRuntimeVersions", "bedrock-agentcore:ListApiKeyCredentialProviders", + "bedrock-agentcore:ListBatchEvaluations", "bedrock-agentcore:ListBrowserProfiles", "bedrock-agentcore:ListBrowsers", "bedrock-agentcore:ListBrowserSessions", "bedrock-agentcore:ListCodeInterpreters", "bedrock-agentcore:ListCodeInterpreterSessions", + "bedrock-agentcore:ListConfigurationBundles", + "bedrock-agentcore:ListConfigurationBundleVersions", "bedrock-agentcore:ListEvaluators", "bedrock-agentcore:ListEvents", "bedrock-agentcore:ListGateways", "bedrock-agentcore:ListGatewayTargets", + "bedrock-agentcore:ListHarnesses", + "bedrock-agentcore:ListHarnessEndpoints", "bedrock-agentcore:ListMemories", "bedrock-agentcore:ListMemoryRecords", "bedrock-agentcore:ListOauth2CredentialProviders", @@ -129039,6 +136105,7 @@ "bedrock-agentcore:ListPolicyEngines", "bedrock-agentcore:ListPolicyGenerationAssets", "bedrock-agentcore:ListPolicyGenerations", + "bedrock-agentcore:ListRecommendations", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:ListWorkloadIdentities", "bedrock-agentcore:RetrieveMemoryRecords", @@ -129095,6 +136162,7 @@ "billing:GetBillingNotifications", "billing:GetBillingPreferences", "billing:GetBillingView", + "billing:GetCreditAllocationHistory", "billing:GetContractInformation", "billing:GetCredits", "billing:GetIAMAccessPreference", @@ -129518,8 +136586,11 @@ "deadline:GetFleet", "deadline:GetJob", "deadline:GetLicenseEndpoint", + "deadline:GetLimit", "deadline:GetMonitor", + "deadline:GetMonitorSettings", "deadline:GetQueue", + "deadline:GetQueueLimitAssociation", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetSession", @@ -129529,6 +136600,7 @@ "deadline:GetStorageProfile", "deadline:GetStorageProfileForQueue", "deadline:GetTask", + "deadline:GetVolume", "deadline:GetWorker", "deadline:ListAvailableMeteredProducts", "deadline:ListBudgets", @@ -129540,10 +136612,12 @@ "deadline:ListJobParameterDefinitions", "deadline:ListJobs", "deadline:ListLicenseEndpoints", + "deadline:ListLimits", "deadline:ListMeteredProducts", "deadline:ListMonitors", "deadline:ListQueueEnvironments", "deadline:ListQueueFleetAssociations", + "deadline:ListQueueLimitAssociations", "deadline:ListQueueMembers", "deadline:ListQueues", "deadline:ListSessionActions", @@ -129556,6 +136630,7 @@ "deadline:ListStorageProfilesForQueue", "deadline:ListTagsForResource", "deadline:ListTasks", + "deadline:ListVolumes", "deadline:ListWorkers", "deadline:SearchJobs", "deadline:SearchSteps", @@ -129634,8 +136709,10 @@ "ds:Verify*", "dsql:GetCluster", "dsql:GetClusterPolicy", + "dsql:GetStream", "dsql:GetVpcEndpointServiceName", "dsql:ListClusters", + "dsql:ListStreams", "dsql:ListTagsForResource", "dynamodb:BatchGet*", "dynamodb:Describe*", @@ -129692,7 +136769,10 @@ "elastictranscoder:Read*", "elemental-appliances-software:Get*", "elemental-appliances-software:List*", + "elemental-inference:ExportDictionaryEntries", + "elemental-inference:GetDictionary", "elemental-inference:GetFeed", + "elemental-inference:ListDictionaries", "elemental-inference:ListFeeds", "emr-containers:DescribeJobRun", "emr-containers:DescribeManagedEndpoint", @@ -130943,6 +138023,11 @@ "rekognition:List*", "rekognition:RecognizeCelebrities", "rekognition:Search*", + "resiliencehub:GetFailureModeFinding", + "resiliencehub:GetPolicy", + "resiliencehub:GetService", + "resiliencehub:GetSystem", + "resiliencehub:GetUserJourney", "resiliencehub:DescribeApp", "resiliencehub:DescribeAppAssessment", "resiliencehub:DescribeAppVersion", @@ -130966,15 +138051,32 @@ "resiliencehub:ListAppVersionResourceMappings", "resiliencehub:ListAppVersionResources", "resiliencehub:ListAppVersions", + "resiliencehub:ListAssertions", + "resiliencehub:ListDependencies", + "resiliencehub:ListFailureModeAssessments", + "resiliencehub:ListFailureModeFindings", + "resiliencehub:ListInputSources", "resiliencehub:ListMetrics", + "resiliencehub:ListPolicies", "resiliencehub:ListRecommendationTemplates", + "resiliencehub:ListReports", + "resiliencehub:ListResources", "resiliencehub:ListResiliencyPolicies", "resiliencehub:ListResourceGroupingRecommendations", + "resiliencehub:ListServices", + "resiliencehub:ListServiceEvents", + "resiliencehub:ListServiceFunctions", + "resiliencehub:ListServiceEvents", + "resiliencehub:ListServiceFunctions", + "resiliencehub:ListServiceTopologyEdges", "resiliencehub:ListSopRecommendations", "resiliencehub:ListSuggestedResiliencyPolicies", + "resiliencehub:ListSystems", + "resiliencehub:ListSystemEvents", "resiliencehub:ListTagsForResource", "resiliencehub:ListTestRecommendations", "resiliencehub:ListUnsupportedAppVersionResources", + "resiliencehub:ListUserJourneys", "resource-explorer-2:BatchGetView", "resource-explorer-2:GetAccountLevelServiceConfiguration", "resource-explorer-2:GetDefaultView", @@ -131098,6 +138200,15 @@ "s3express:ListAccessPointsForDirectoryBuckets", "s3express:ListAllMyDirectoryBuckets", "s3express:ListTagsForResource", + "s3files:GetAccessPoint", + "s3files:GetFileSystem", + "s3files:GetFileSystemPolicy", + "s3files:GetMountTarget", + "s3files:GetSynchronizationConfiguration", + "s3files:ListAccessPoints", + "s3files:ListFileSystems", + "s3files:ListMountTargets", + "s3files:ListTagsForResource", "s3tables:GetNamespace", "s3tables:GetTable", "s3tables:GetTableBucket", @@ -131154,13 +138265,16 @@ "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityagent:BatchGetAgentSpaces", - "securityagent:BatchGetTargetDomains", "securityagent:BatchGetArtifactMetadata", + "securityagent:BatchGetCodeReviewJobs", + "securityagent:BatchGetCodeReviewJobTasks", + "securityagent:BatchGetCodeReviews", "securityagent:BatchGetFindings", - "securityagent:BatchGetPentestJobs", - "securityagent:BatchGetPentests", "securityagent:BatchGetPentestJobContentMetadata", + "securityagent:BatchGetPentestJobs", "securityagent:BatchGetPentestJobTasks", + "securityagent:BatchGetPentests", + "securityagent:BatchGetTargetDomains", "securityagent:GetApplication", "securityagent:GetArtifact", "securityagent:GetDesignReview", @@ -131168,13 +138282,16 @@ "securityagent:GetDesignReviewFeedback", "securityagent:GetIntegration", "securityagent:ListAgentSpaces", - "securityagent:ListTargetDomains", "securityagent:ListApplications", "securityagent:ListArtifacts", - "securityagent:ListSecurityRequirements", - "securityagent:ListDiscoveredEndpoints", + "securityagent:ListCodeReviewJobsForCodeReview", + "securityagent:ListCodeReviewJobTasks", + "securityagent:ListCodeReviews", "securityagent:ListDesignReviewComments", "securityagent:ListDesignReviews", + "securityagent:ListDiscoveredEndpoints", + "securityagent:ListSecurityRequirements", + "securityagent:ListTargetDomains", "securityagent:ListFindings", "securityagent:ListIntegratedResources", "securityagent:ListIntegrations", @@ -131355,6 +138472,8 @@ "supportplans:GetSupportPlanUpdateStatus", "supportplans:ListSupportPlanModifiers", "sustainability:GetCarbonFootprintSummary", + "sustainability:GetEstimatedCarbonEmissions", + "sustainability:GetEstimatedCarbonEmissionsDimensionValues", "swf:Count*", "swf:Describe*", "swf:Get*", @@ -131407,9 +138526,22 @@ "transform:ListConnectors", "transform:ListProfiles", "transform:ListTagsForResource", + "transform-custom:GetAnalysis", "transform-custom:GetCampaign", + "transform-custom:GetFinding", + "transform-custom:GetFindingGroups", "transform-custom:GetKnowledgeItem", + "transform-custom:GetRemediation", + "transform-custom:GetRepository", + "transform-custom:GetSource", + "transform-custom:ListAnalyses", + "transform-custom:ListCampaigns", + "transform-custom:ListCampaignRepositories", + "transform-custom:ListFindings", "transform-custom:ListKnowledgeItems", + "transform-custom:ListRemediations", + "transform-custom:ListRepositories", + "transform-custom:ListSources", "transform-custom:ListTagsForResource", "transform-custom:ListTransformationPackageMetadata", "translate:DescribeTextTranslationJob", @@ -131551,7 +138683,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-18T15:42:10+00:00" + "UpdateDate":"2026-07-21T18:42:30+00:00" }, "ResourceGroupsServiceRolePolicy":{ "CreateDate":"2023-01-05T16:57:08+00:00", @@ -132955,7 +140087,7 @@ }, "SageMakerStudioAdminIAMDefaultExecutionPolicy":{ "CreateDate":"2025-08-18T17:19:07+00:00", - "DefaultVersionId":"v21", + "DefaultVersionId":"v24", "Document":{ "Statement":[ { @@ -133013,7 +140145,8 @@ "Condition":{ "ForAllValues:StringLike":{ "aws:TagKeys":[ - "AmazonDataZone*" + "AmazonDataZone*", + "SageMakerSpacesDomainId" ] } }, @@ -133085,8 +140218,11 @@ "bedrock.amazonaws.com", "scheduler.amazonaws.com", "emr-serverless.amazonaws.com", + "elasticmapreduce.amazonaws.com", "redshift.amazonaws.com", - "airflow-serverless.amazonaws.com" + "airflow-serverless.amazonaws.com", + "events.amazonaws.com", + "pods.eks.amazonaws.com" ] } }, @@ -133178,7 +140314,9 @@ "s3:CreateBucket", "s3:DeleteBucketPolicy", "s3:Get*", - "s3:Put*" + "s3:Put*", + "s3:DeleteObject", + "s3:AbortMultipartUpload" ], "Effect":"Allow", "Resource":[ @@ -133231,6 +140369,9 @@ "Action":[ "cloudwatch:PutMetricData", "cloudwatch:GetMetricData", + "cloudwatch:DescribeAlarms", + "cloudwatch:PutMetricAlarm", + "cloudwatch:DeleteAlarms", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", @@ -133324,11 +140465,14 @@ "athena:TerminateSession", "emr-serverless:*Session*", "emr-serverless:*Dashboard*", + "emr-containers:*ManagedEndpoint*", + "elasticmapreduce:*Session*", "glue:CancelStatement", "glue:CreateSession", "glue:DeleteSession", "glue:GetDashboardUrl", "glue:GetSession", + "glue:GetSessionEndpoint", "glue:GetStatement", "glue:RunStatement", "glue:StopSession" @@ -133343,6 +140487,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyForeignSessionAccess" @@ -133352,6 +140498,9 @@ "athena:TagResource", "athena:UntagResource", "emr-serverless:*Resource", + "emr-containers:*Resource", + "elasticmapreduce:AddTags", + "elasticmapreduce:RemoveTags", "glue:TagResource", "glue:UntagResource" ], @@ -133364,6 +140513,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyTaggingUntaggingForeignSessions" @@ -133467,7 +140618,8 @@ "secretsmanager:GetSecretValue", "secretsmanager:TagResource", "secretsmanager:UpdateSecret", - "secretsmanager:PutResourcePolicy" + "secretsmanager:PutResourcePolicy", + "secretsmanager:PutSecretValue" ], "Condition":{ "Null":{ @@ -133485,7 +140637,8 @@ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource", - "secretsmanager:UpdateSecret" + "secretsmanager:UpdateSecret", + "secretsmanager:PutSecretValue" ], "Condition":{ "Null":{ @@ -133818,6 +140971,7 @@ "ForAllValues:StringLike":{ "aws:TagKeys":[ "AmazonDataZone*", + "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } @@ -133831,7 +140985,8 @@ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", - "ec2:DeleteNetworkInterfacePermission" + "ec2:DeleteNetworkInterfacePermission", + "ec2:CreateVpcEndpoint" ], "Effect":"Allow", "Resource":"*", @@ -133855,11 +141010,22 @@ "emr-serverless:Start*", "emr-serverless:Access*", "emr-serverless:Terminate*", - "emr-serverless:*Resource" + "emr-serverless:*Resource", + "emr-containers:*ManagedEndpoint*", + "emr-containers:*SecurityConfiguration*", + "emr-containers:*VirtualCluster*", + "emr-containers:*Resource", + "elasticmapreduce:*PersistentAppUI*", + "elasticmapreduce:Start*", + "elasticmapreduce:Get*", + "elasticmapreduce:Describe*", + "elasticmapreduce:List*", + "elasticmapreduce:Terminate*", + "elasticmapreduce:*Tag*" ], "Effect":"Allow", "Resource":"*", - "Sid":"EMRServerless" + "Sid":"EMR" }, { "Action":[ @@ -133976,17 +141142,49 @@ "Effect":"Allow", "Resource":"*", "Sid":"RAMAssociateResourceSharePermission" + }, + { + "Action":[ + "comprehend:*", + "textract:*", + "rekognition:*", + "sagemaker-data-science-assistant:*", + "rds:DescribeDBInstances", + "application-autoscaling:PutScalingPolicy", + "application-autoscaling:RegisterScalableTarget", + "application-autoscaling:DescribeScalingActivities", + "quicksight:ListNamespaces", + "events:PutRule", + "events:DescribeRule", + "events:PutTargets", + "events:TagResource", + "events:ListTagsForResource" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"CanvasGeneralPermissions" + }, + { + "Action":[ + "redshift:GetClusterCredentials" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", + "arn:aws:redshift:*:*:dbname:*" + ], + "Sid":"CanvasRedshiftAccess" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-11T20:42:19+00:00" + "UpdateDate":"2026-07-14T18:57:22+00:00" }, "SageMakerStudioAdminIAMPermissiveExecutionPolicy":{ "CreateDate":"2025-08-18T17:19:07+00:00", - "DefaultVersionId":"v18", + "DefaultVersionId":"v21", "Document":{ "Statement":[ { @@ -133998,7 +141196,14 @@ "redshift-serverless:*", "redshift:*", "s3:*", - "s3tables:*" + "s3tables:*", + "comprehend:*", + "textract:*", + "rekognition:*", + "sagemaker-data-science-assistant:*", + "rds:*", + "quicksight:*", + "events:*" ], "Effect":"Allow", "Resource":"*", @@ -134011,6 +141216,8 @@ "codewhisperer:*", "sagemaker-unified-studio-mcp:*", "datazone:*", + "elasticmapreduce:*", + "emr-containers:*", "q:*", "sagemaker:*", "sagemaker-mlflow:*", @@ -134018,7 +141225,8 @@ "sqlworkbench:*", "emr-serverless:*", "airflow-serverless:*", - "airflow:*" + "airflow:*", + "application-autoscaling:*" ], "Effect":"Allow", "Resource":"*", @@ -134051,11 +141259,14 @@ "athena:TerminateSession", "emr-serverless:*Session*", "emr-serverless:*Dashboard*", + "emr-containers:*ManagedEndpoint*", + "elasticmapreduce:*Session*", "glue:CancelStatement", "glue:CreateSession", "glue:DeleteSession", "glue:GetDashboardUrl", "glue:GetSession", + "glue:GetSessionEndpoint", "glue:GetStatement", "glue:RunStatement", "glue:StopSession" @@ -134070,6 +141281,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyForeignSessionAccess" @@ -134079,6 +141292,9 @@ "athena:TagResource", "athena:UntagResource", "emr-serverless:*Resource", + "emr-containers:*Resource", + "elasticmapreduce:AddTags", + "elasticmapreduce:RemoveTags", "glue:TagResource", "glue:UntagResource" ], @@ -134091,6 +141307,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyTaggingUntaggingForeignSessions" @@ -134132,7 +141350,8 @@ "Condition":{ "ForAllValues:StringLike":{ "aws:TagKeys":[ - "AmazonDataZone*" + "AmazonDataZone*", + "SageMakerSpacesDomainId" ] } }, @@ -134170,7 +141389,9 @@ "redshift.amazonaws.com", "scheduler.amazonaws.com", "emr-serverless.amazonaws.com", - "airflow-serverless.amazonaws.com" + "elasticmapreduce.amazonaws.com", + "airflow-serverless.amazonaws.com", + "pods.eks.amazonaws.com" ] } }, @@ -134277,7 +141498,8 @@ "secretsmanager:GetSecretValue", "secretsmanager:TagResource", "secretsmanager:UpdateSecret", - "secretsmanager:PutResourcePolicy" + "secretsmanager:PutResourcePolicy", + "secretsmanager:PutSecretValue" ], "Condition":{ "Null":{ @@ -134295,7 +141517,8 @@ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:TagResource", - "secretsmanager:UpdateSecret" + "secretsmanager:UpdateSecret", + "secretsmanager:PutSecretValue" ], "Condition":{ "Null":{ @@ -134614,6 +141837,7 @@ "ForAllValues:StringLike":{ "aws:TagKeys":[ "AmazonDataZone*", + "for-use-with-amazon-emr-managed-policies", "aws:cloudformation:*" ] } @@ -134627,7 +141851,8 @@ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", - "ec2:DeleteNetworkInterfacePermission" + "ec2:DeleteNetworkInterfacePermission", + "ec2:CreateVpcEndpoint" ], "Effect":"Allow", "Resource":"*", @@ -134765,7 +141990,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-11T20:42:23+00:00" + "UpdateDate":"2026-07-14T18:57:27+00:00" }, "SageMakerStudioAdminProjectUserRolePolicy":{ "CreateDate":"2025-07-09T20:52:08+00:00", @@ -135924,7 +143149,7 @@ }, "SageMakerStudioDomainExecutionRolePolicy":{ "CreateDate":"2024-11-20T21:56:55+00:00", - "DefaultVersionId":"v20", + "DefaultVersionId":"v21", "Document":{ "Statement":[ { @@ -135983,6 +143208,7 @@ "datazone:GetAssetFilter", "datazone:GetAssetType", "datazone:GetConnection", + "datazone:GetCurrentEffectivePolicy", "datazone:GetDataProduct", "datazone:GetDataSource", "datazone:GetDataSourceRun", @@ -136020,6 +143246,7 @@ "datazone:ListDataSourceRunActivities", "datazone:ListDataSourceRuns", "datazone:ListDataSources", + "datazone:ListDesignations", "datazone:ListDomainUnitsForParent", "datazone:ListEntityOwners", "datazone:ListEnvironmentActions", @@ -136193,7 +143420,7 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-26T00:42:09+00:00" + "UpdateDate":"2026-07-22T16:57:26+00:00" }, "SageMakerStudioDomainServiceRolePolicy":{ "CreateDate":"2024-11-20T21:56:22+00:00", @@ -136310,7 +143537,7 @@ }, "SageMakerStudioEMRInstanceRolePolicy":{ "CreateDate":"2025-02-27T00:22:06+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -136335,7 +143562,10 @@ "Action":"s3:GetObject", "Condition":{ "ArnLike":{ - "s3:DataAccessPointArn":"arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint" + "s3:DataAccessPointArn":[ + "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint", + "arn:aws:s3:*:*:accesspoint/env-partner-blueprint-accesspoint" + ] }, "StringNotEquals":{ "aws:ResourceAccount":"${aws:PrincipalAccount}" @@ -136344,7 +143574,9 @@ "Effect":"Allow", "Resource":[ "arn:aws:s3:::default-env-blueprint-*/*", - "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*" + "arn:aws:s3:::awssmuscompute-blueprint-bucket-*/*", + "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*", + "arn:aws:s3:*:*:accesspoint/env-partner-blueprint-accesspoint*" ], "Sid":"AccessPatchingRPMsS3Permission" }, @@ -136447,7 +143679,7 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-02-12T17:57:24+00:00" + "UpdateDate":"2026-06-01T23:27:10+00:00" }, "SageMakerStudioEMRServiceRolePolicy":{ "CreateDate":"2025-01-31T19:52:07+00:00", @@ -136989,7 +144221,7 @@ }, "SageMakerStudioProjectProvisioningRolePolicy":{ "CreateDate":"2024-11-20T21:58:39+00:00", - "DefaultVersionId":"v80", + "DefaultVersionId":"v81", "Document":{ "Statement":[ { @@ -137291,6 +144523,7 @@ "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy", "arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy", "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2", + "arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicyForSessions", "arn:aws:iam::aws:policy/service-role/AmazonS3TablesLakeFormationServiceRole", "arn:aws:iam::aws:policy/AmazonSageMakerPartnerAppsFullAccess", "arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy" @@ -137380,7 +144613,8 @@ "vpcArn", "VpcId", "CreatedForUseWithSageMakerStudio", - "SageMakerStudioQueryExecutionRole" + "SageMakerStudioQueryExecutionRole", + "SageMakerSpacesDomainId" ] }, "Null":{ @@ -139989,11 +147223,11 @@ }, "Path":"/service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-07T00:27:11+00:00" + "UpdateDate":"2026-06-04T21:27:16+00:00" }, "SageMakerStudioProjectRoleMachineLearningPolicy":{ "CreateDate":"2024-11-20T21:55:27+00:00", - "DefaultVersionId":"v40", + "DefaultVersionId":"v41", "Document":{ "Statement":[ { @@ -140360,10 +147594,13 @@ "sagemaker:ListModelMetadata", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListArtifacts", + "sagemaker:ListAssociations", "sagemaker:ListHubs", "sagemaker:ListPipelines", "sagemaker:ListContexts", - "sagemaker:ListMlflowApps" + "sagemaker:ListMlflowApps", + "sagemaker:ListFeatureGroups", + "scheduler:ListSchedules" ], "Condition":{ "StringEquals":{ @@ -140392,7 +147629,6 @@ "Action":[ "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", - "sagemaker:ListAssociations", "sagemaker:ListHubContents", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", @@ -140408,6 +147644,24 @@ "Resource":"*", "Sid":"SageMakerListPermissionsTagRestricted" }, + { + "Action":[ + "sagemaker:DescribeHub", + "sagemaker:DescribeHubContent", + "sagemaker:ListHubContents" + ], + "Condition":{ + "StringEquals":{ + "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions":"true" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub", + "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/*" + ], + "Sid":"SageMakerPublicHubReadPermissions" + }, { "Action":[ "ecr:BatchGetImage", @@ -140864,6 +148118,20 @@ ], "Sid":"SageMakerListTagsRestrictionOnSharedResources" }, + { + "Action":[ + "sagemaker:*Feature*", + "sagemaker:*Record" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/AmazonDataZoneProject":"${aws:PrincipalTag/AmazonDataZoneProject}" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"SageMakerFeatureStorePermission" + }, { "Action":[ "application-autoscaling:DeregisterScalableTarget", @@ -141253,7 +148521,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-21T16:57:25+00:00" + "UpdateDate":"2026-07-09T17:27:13+00:00" }, "SageMakerStudioProjectUserRolePermissionsBoundary":{ "CreateDate":"2024-11-20T21:57:42+00:00", @@ -143674,7 +150942,7 @@ }, "SageMakerStudioProjectUserRolePolicy":{ "CreateDate":"2024-11-20T21:59:23+00:00", - "DefaultVersionId":"v68", + "DefaultVersionId":"v73", "Document":{ "Statement":[ { @@ -143974,13 +151242,8 @@ }, { "Action":[ - "glue:CancelStatement", - "glue:GetSession", - "glue:ListStatements", - "glue:DeleteSession", - "glue:RunStatement", - "glue:GetStatement", - "glue:StopSession", + "glue:*Session*", + "glue:*Statement*", "glue:GetDashboardUrl", "glue:NotifyEvent", "glue:StartBlueprintRun", @@ -143996,21 +151259,7 @@ "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:StartJobRun", - "glue:CancelDataQualityRuleRecommendationRun", - "glue:CancelDataQualityRulesetEvaluationRun", - "glue:DeleteDataQualityRuleset", - "glue:GetDataQualityModel", - "glue:GetDataQualityModelResult", - "glue:GetDataQualityRuleRecommendationRun", - "glue:GetDataQualityRuleset", - "glue:GetDataQualityRulesetEvaluationRun", - "glue:GetDataQualityResult", - "glue:PublishDataQuality", - "glue:PutDataQualityProfileAnnotation", - "glue:PutDataQualityStatisticAnnotation", - "glue:StartDataQualityRuleRecommendationRun", - "glue:StartDataQualityRulesetEvaluationRun", - "glue:UpdateDataQualityRuleset", + "glue:*DataQuality*", "glue:GetJobRun", "glue:GetJobRuns", "glue:BatchGetJobs", @@ -144046,8 +151295,7 @@ }, { "Action":[ - "glue:GetDataQualityResult", - "glue:PublishDataQuality" + "glue:*DataQuality*" ], "Condition":{ "StringEquals":{ @@ -144362,7 +151610,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"DataLakeCrossAccountDecryptKMSPermissions" + "Sid":"XAcctKmsDecrypt" }, { "Action":[ @@ -144458,7 +151706,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", - "Sid":"AccessLevelControlS3BucketPermissions" + "Sid":"S3BucketAcl" }, { "Action":"s3:PutObjectTagging", @@ -144487,7 +151735,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/genAI/assets/evaluations/*", - "Sid":"TagS3ObjectPermissionsForBedrockEvaluation" + "Sid":"BREvalS3Tag" }, { "Action":[ @@ -144672,12 +151920,29 @@ "datazone:ListEnvironmentBlueprints", "datazone:ListProjects", "datazone:UpdateConnection", - "datazone:PostLineageEvent" + "datazone:PostLineageEvent", + "datazone:*Compute*" ], "Effect":"Allow", "Resource":"arn:aws:datazone:*:*:domain/${aws:PrincipalTag/AmazonDataZoneDomain}", "Sid":"DataZoneUserPermissions" }, + { + "Action":[ + "codeconnections:GetConnection", + "codeconnections:UseConnection", + "codestar-connections:GetConnection", + "codestar-connections:UseConnection" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/for-use-with-all-datazone-projects":"true" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CodeConnectionsUser" + }, { "Action":[ "glue:GetDatabase" @@ -145028,8 +152293,10 @@ "glue.amazonaws.com", "airflow.amazonaws.com", "emr-serverless.amazonaws.com", + "elasticmapreduce.amazonaws.com", "scheduler.amazonaws.com", - "access-grants.s3.amazonaws.com" + "access-grants.s3.amazonaws.com", + "pods.eks.amazonaws.com" ] } }, @@ -145097,7 +152364,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"RedshiftDataActionsIAMSessionRestriction" + "Sid":"RSDataIAMSession" }, { "Action":[ @@ -145168,7 +152435,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"RedshiftServerlessWorkgroupWithResourceType" + "Sid":"RSWgTagged" }, { "Action":[ @@ -145181,7 +152448,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:redshift:*:*:dbname:*/*", - "Sid":"RedshiftExistingComputeConnectToCatalog" + "Sid":"RSExistCatalog" }, { "Action":"secretsmanager:ListSecrets", @@ -145191,10 +152458,10 @@ }, { "Action":[ - "emr-containers:DescribeManagedEndpoint", + "emr-containers:*ManagedEndpoint*", + "emr-containers:TagResource", "emr-containers:DescribeSecurityConfiguration", "emr-containers:DescribeVirtualCluster", - "emr-containers:GetManagedEndpointSessionCredentials", "redshift-serverless:GetCredentials", "redshift:GetClusterCredentialsWithIAM" ], @@ -145224,7 +152491,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"RedshiftDataActionsForManagedWorkgroup" + "Sid":"RSDataMWg" }, { "Action":[ @@ -145258,7 +152525,8 @@ }, { "Action":[ - "secretsmanager:GetSecretValue" + "secretsmanager:GetSecretValue", + "secretsmanager:PutSecretValue" ], "Condition":{ "StringEquals":{ @@ -145296,7 +152564,9 @@ "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:GetManagedScalingPolicy", - "elasticmapreduce:GetOnClusterAppUIPresignedURL" + "elasticmapreduce:GetOnClusterAppUIPresignedURL", + "elasticmapreduce:*Session*", + "elasticmapreduce:AddTags" ], "Condition":{ "StringEquals":{ @@ -145611,7 +152881,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:bedrock:*:*:application-inference-profile/*", - "Sid":"BedrockInvokeModelAppInferenceProfilePermissions" + "Sid":"BRInvokeAppProfile" }, { "Action":[ @@ -145709,7 +152979,7 @@ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*" ], - "Sid":"CreateEvaluationJobForFoundationModelPermissions" + "Sid":"BREvalFM" }, { "Action":"bedrock:CreateEvaluationJob", @@ -145723,7 +152993,7 @@ "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*::foundation-model/*" ], - "Sid":"BedrockCreateEvaluationJobPermissions" + "Sid":"BRCreateEval" }, { "Action":[ @@ -145779,7 +153049,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"BedrockRetrieveAndGeneratePermissions" + "Sid":"BRRAG" }, { "Action":"bedrock:ListEvaluationJobs", @@ -145998,7 +153268,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Sid":"KmsViaSecretsManagerPermissionsForBedrock" + "Sid":"BRKmsSM" }, { "Action":"lambda:InvokeFunction", @@ -146039,7 +153309,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:cloudformation:*:*:stack/DataZone-Env-*", - "Sid":"GetDataZoneEnvironmentCFNStackPermissions" + "Sid":"DZEnvCfn" }, { "Action":[ @@ -146094,6 +153364,7 @@ { "Action":[ "secretsmanager:GetSecretValue", + "secretsmanager:PutSecretValue", "glue:GetConnections" ], "Condition":{ @@ -146119,11 +153390,17 @@ "Action":[ "dynamodb:ListTables", "glue:ManagedConnector", - "glue:TestConnection" + "glue:TestConnection", + "codeconnections:GetHost", + "codeconnections:ListConnections", + "codeconnections:ListTagsForResource", + "codestar-connections:GetHost", + "codestar-connections:ListConnections", + "codestar-connections:ListTagsForResource" ], "Effect":"Allow", "Resource":"*", - "Sid":"UnrestrictedDataConnectionPermissions" + "Sid":"DataConnOpen" }, { "Action":[ @@ -146268,7 +153545,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"CrossAccountLakeFormationResourceSharingPermissions" + "Sid":"XAcctLFCreate" }, { "Action":[ @@ -146289,7 +153566,7 @@ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], - "Sid":"CrossAccountRAMResourceSharingPermissions" + "Sid":"XAcctRAMGlue" }, { "Action":[ @@ -146313,7 +153590,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"CrossAccountRAMResourceSharingViaLakeFormationPermissions" + "Sid":"XAcctRAMLF" }, { "Action":[ @@ -146344,7 +153621,7 @@ }, "Effect":"Allow", "Resource":"arn:aws:ram:*:*:resource-share-invitation/*", - "Sid":"CrossAccountRAMResourceShareInvitationPermission" + "Sid":"XAcctRAMInvite" }, { "Action":"ram:AssociateResourceSharePermission", @@ -146360,7 +153637,7 @@ }, "Effect":"Allow", "Resource":"*", - "Sid":"CrossAccountRAMResourceSharingViaLakeFormationHybrid" + "Sid":"XAcctRAMLFHybrid" }, { "Action":[ @@ -146412,7 +153689,7 @@ "arn:aws:quicksight:*:*:folder/*", "arn:aws:quicksight:*:*:datasource/*" ], - "Sid":"ManageQuickSightFolderAndDataSourceResources" + "Sid":"QSFolderDS" }, { "Action":[ @@ -146478,23 +153755,13 @@ "Effect":"Allow", "Resource":"arn:aws:quicksight:*:*:folder/sagemaker-*-assets", "Sid":"CreateFolderMembership" - }, - { - "Action":[ - "sagemaker-unified-studio-mcp:InvokeMcp", - "sagemaker-unified-studio-mcp:CallReadOnlyTool", - "sagemaker-unified-studio-mcp:CallPrivilegedTool" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"SageMakerUnifiedStudioMcp" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-28T16:27:24+00:00" + "UpdateDate":"2026-07-29T21:12:28+00:00" }, "SageMakerStudioQueryExecutionRolePolicy":{ "CreateDate":"2025-01-31T19:52:07+00:00", @@ -146646,7 +153913,7 @@ }, "SageMakerStudioUserIAMDefaultExecutionPolicy":{ "CreateDate":"2025-08-18T17:19:07+00:00", - "DefaultVersionId":"v25", + "DefaultVersionId":"v28", "Document":{ "Statement":[ { @@ -146701,7 +153968,9 @@ "datazone:GenerateCode", "datazone:SendMessage", "datazone:CancelMessage", - "datazone:QueryGraph" + "datazone:QueryGraph", + "datazone:StartCompute", + "datazone:StopCompute" ], "Effect":"Allow", "Resource":"*", @@ -146723,16 +153992,6 @@ "Resource":"*", "Sid":"ValidateCfn" }, - { - "Action":[ - "sagemaker-unified-studio-mcp:InvokeMcp", - "sagemaker-unified-studio-mcp:CallReadOnlyTool", - "sagemaker-unified-studio-mcp:CallPrivilegedTool" - ], - "Effect":"Allow", - "Resource":"*", - "Sid":"SageMakerUnifiedStudioMcp" - }, { "Action":[ "iam:GetRole", @@ -146812,7 +154071,8 @@ "Action":[ "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", - "sagemaker:DeleteUserProfile" + "sagemaker:DeleteUserProfile", + "sagemaker:UpdateUserProfile" ], "Condition":{ "StringEquals":{ @@ -146846,6 +154106,25 @@ ], "Sid":"SageMakerPrivateSpace" }, + { + "Action":[ + "sagemaker:CreateApp", + "sagemaker:DeleteApp", + "sagemaker:CreateSpace", + "sagemaker:DeleteSpace" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/AmazonDataZoneUser":"${aws:PrincipalTag/datazone:userId}" + } + }, + "Effect":"Allow", + "Resource":[ + "arn:aws:sagemaker:*:*:app/*/Canvas/*", + "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace*" + ], + "Sid":"CanvasUserProfileApp" + }, { "Action":[ "sagemaker:StartSession" @@ -146906,7 +154185,14 @@ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", - "endpoint-has-jumpstart-model" + "endpoint-has-jumpstart-model", + "aws-jumpstart*", + "Source", + "CanvasModelName", + "Canvas", + "SageMaker", + "ProjectS3Path", + "Owner" ] }, "ForAllValues:StringNotLike":{ @@ -146924,6 +154210,9 @@ "Action":[ "cloudwatch:PutMetricData", "cloudwatch:GetMetricData", + "cloudwatch:DescribeAlarms", + "cloudwatch:PutMetricAlarm", + "cloudwatch:DeleteAlarms", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", @@ -146968,11 +154257,14 @@ "athena:TerminateSession", "emr-serverless:*Session*", "emr-serverless:*Dashboard*", + "emr-containers:*ManagedEndpoint*", + "elasticmapreduce:*Session*", "glue:CancelStatement", "glue:CreateSession", "glue:DeleteSession", "glue:GetDashboardUrl", "glue:GetSession", + "glue:GetSessionEndpoint", "glue:GetStatement", "glue:RunStatement", "glue:StopSession" @@ -146987,6 +154279,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyForeignSessionAccess" @@ -146996,6 +154290,9 @@ "athena:TagResource", "athena:UntagResource", "emr-serverless:*Resource", + "emr-containers:*Resource", + "elasticmapreduce:AddTags", + "elasticmapreduce:RemoveTags", "glue:TagResource", "glue:UntagResource" ], @@ -147008,6 +154305,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyTaggingUntaggingForeignSessions" @@ -147110,8 +154409,11 @@ "sagemaker.amazonaws.com", "scheduler.amazonaws.com", "emr-serverless.amazonaws.com", + "elasticmapreduce.amazonaws.com", "redshift.amazonaws.com", - "airflow-serverless.amazonaws.com" + "airflow-serverless.amazonaws.com", + "events.amazonaws.com", + "pods.eks.amazonaws.com" ] } }, @@ -147230,7 +154532,8 @@ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:UpdateSecret", - "secretsmanager:PutResourcePolicy" + "secretsmanager:PutResourcePolicy", + "secretsmanager:PutSecretValue" ], "Condition":{ "StringEquals":{ @@ -147246,7 +154549,8 @@ "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", - "secretsmanager:UpdateSecret" + "secretsmanager:UpdateSecret", + "secretsmanager:PutSecretValue" ], "Condition":{ "StringEquals":{ @@ -147279,20 +154583,32 @@ }, { "Action":[ - "codeconnections:UseConnection", - "codeconnections:ListConnections", "codeconnections:GetConnection", + "codeconnections:UseConnection", + "codestar-connections:GetConnection", + "codestar-connections:UseConnection" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/for-use-with-all-datazone-projects":"true" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CodeConnectionsUser" + }, + { + "Action":[ "codeconnections:GetHost", + "codeconnections:ListConnections", "codeconnections:ListTagsForResource", - "codestar-connections:UseConnection", - "codestar-connections:ListConnections", - "codestar-connections:GetConnection", "codestar-connections:GetHost", + "codestar-connections:ListConnections", "codestar-connections:ListTagsForResource" ], "Effect":"Allow", "Resource":"*", - "Sid":"CodeConnectionsUser" + "Sid":"CodeConnectionsUserList" }, { "Action":[ @@ -147523,7 +154839,8 @@ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", - "ec2:DeleteNetworkInterfacePermission" + "ec2:DeleteNetworkInterfacePermission", + "ec2:CreateVpcEndpoint" ], "Effect":"Allow", "Resource":"*", @@ -147568,22 +154885,105 @@ "emr-serverless:Start*", "emr-serverless:Access*Endpoints", "emr-serverless:Terminate*", - "emr-serverless:*Resource" + "emr-serverless:*Resource", + "emr-containers:*ManagedEndpoint*", + "emr-containers:*SecurityConfiguration*", + "emr-containers:*VirtualCluster*", + "emr-containers:*Resource", + "elasticmapreduce:*PersistentAppUI*", + "elasticmapreduce:Start*", + "elasticmapreduce:Get*", + "elasticmapreduce:Describe*", + "elasticmapreduce:List*", + "elasticmapreduce:Terminate*", + "elasticmapreduce:*Tag*" ], "Effect":"Allow", "Resource":"*", - "Sid":"EMRServerless" + "Sid":"EMR" + }, + { + "Action":[ + "comprehend:BatchDetect*", + "comprehend:Detect*", + "textract:Analyze*", + "textract:Start*", + "textract:Get*", + "rekognition:Detect*", + "sagemaker-data-science-assistant:*", + "rds:DescribeDBInstances", + "application-autoscaling:PutScalingPolicy", + "application-autoscaling:RegisterScalableTarget", + "application-autoscaling:DescribeScalingActivities", + "quicksight:ListNamespaces", + "events:ListTagsForResource" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"CanvasGeneralPermissions" + }, + { + "Action":[ + "redshift:GetClusterCredentials" + ], + "Effect":"Allow", + "Resource":[ + "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", + "arn:aws:redshift:*:*:dbname:*" + ], + "Sid":"CanvasRedshiftAccess" + }, + { + "Action":[ + "events:PutRule" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/sagemaker:is-canvas-data-prep-job":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:events:*:*:rule/*", + "Sid":"CanvasEventBridgePutOperation" + }, + { + "Action":[ + "events:DescribeRule", + "events:PutTargets" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/sagemaker:is-canvas-data-prep-job":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:events:*:*:rule/*", + "Sid":"CanvasEventBridgeOperations" + }, + { + "Action":[ + "events:TagResource" + ], + "Condition":{ + "StringEquals":{ + "aws:RequestTag/sagemaker:is-canvas-data-prep-job":"true", + "aws:ResourceTag/sagemaker:is-canvas-data-prep-job":"true" + } + }, + "Effect":"Allow", + "Resource":"arn:aws:events:*:*:rule/*", + "Sid":"CanvasEventBridgeTagBasedOperations" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-26T17:27:26+00:00" + "UpdateDate":"2026-07-14T18:57:28+00:00" }, "SageMakerStudioUserIAMPermissiveExecutionPolicy":{ "CreateDate":"2025-08-18T17:19:08+00:00", - "DefaultVersionId":"v20", + "DefaultVersionId":"v23", "Document":{ "Statement":[ { @@ -147595,7 +154995,14 @@ "redshift-serverless:*", "redshift:*", "s3:*", - "s3tables:*" + "s3tables:*", + "comprehend:*", + "textract:*", + "rekognition:*", + "sagemaker-data-science-assistant:*", + "rds:*", + "quicksight:*", + "events:*" ], "Effect":"Allow", "Resource":"*", @@ -147607,6 +155014,8 @@ "bedrock:*", "codewhisperer:*", "sagemaker-unified-studio-mcp:*", + "elasticmapreduce:*", + "emr-containers:*", "q:*", "sagemaker:*", "sagemaker-mlflow:*", @@ -147614,7 +155023,8 @@ "sqlworkbench:*", "emr-serverless:*", "airflow-serverless:*", - "airflow:*" + "airflow:*", + "application-autoscaling:*" ], "Effect":"Allow", "Resource":"*", @@ -147630,11 +155040,14 @@ "athena:TerminateSession", "emr-serverless:*Session*", "emr-serverless:*Dashboard*", + "emr-containers:*ManagedEndpoint*", + "elasticmapreduce:*Session*", "glue:CancelStatement", "glue:CreateSession", "glue:DeleteSession", "glue:GetDashboardUrl", "glue:GetSession", + "glue:GetSessionEndpoint", "glue:GetStatement", "glue:RunStatement", "glue:StopSession" @@ -147649,6 +155062,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyForeignSessionAccess" @@ -147658,6 +155073,9 @@ "athena:TagResource", "athena:UntagResource", "emr-serverless:*Resource", + "emr-containers:*Resource", + "elasticmapreduce:AddTags", + "elasticmapreduce:RemoveTags", "glue:TagResource", "glue:UntagResource" ], @@ -147670,6 +155088,8 @@ "Resource":[ "arn:aws:athena:*:*:workgroup/*/session/*", "arn:aws:emr-serverless:*:*:/applications/*/sessions/*", + "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*", + "arn:aws:elasticmapreduce:*:*:cluster/*/session/*", "arn:aws:glue:*:*:session/*" ], "Sid":"DenyTaggingUntaggingForeignSessions" @@ -147726,7 +155146,9 @@ "datazone:GenerateCode", "datazone:SendMessage", "datazone:CancelMessage", - "datazone:QueryGraph" + "datazone:QueryGraph", + "datazone:StartCompute", + "datazone:StopCompute" ], "Effect":"Allow", "Resource":"*", @@ -147800,7 +155222,9 @@ "redshift.amazonaws.com", "scheduler.amazonaws.com", "emr-serverless.amazonaws.com", - "airflow-serverless.amazonaws.com" + "elasticmapreduce.amazonaws.com", + "airflow-serverless.amazonaws.com", + "pods.eks.amazonaws.com" ] } }, @@ -147913,20 +155337,32 @@ }, { "Action":[ - "codeconnections:UseConnection", - "codeconnections:ListConnections", "codeconnections:GetConnection", + "codeconnections:UseConnection", + "codestar-connections:GetConnection", + "codestar-connections:UseConnection" + ], + "Condition":{ + "StringEquals":{ + "aws:ResourceTag/for-use-with-all-datazone-projects":"true" + } + }, + "Effect":"Allow", + "Resource":"*", + "Sid":"CodeConnectionsUser" + }, + { + "Action":[ "codeconnections:GetHost", + "codeconnections:ListConnections", "codeconnections:ListTagsForResource", - "codestar-connections:UseConnection", - "codestar-connections:ListConnections", - "codestar-connections:GetConnection", "codestar-connections:GetHost", + "codestar-connections:ListConnections", "codestar-connections:ListTagsForResource" ], "Effect":"Allow", "Resource":"*", - "Sid":"CodeConnectionsUser" + "Sid":"CodeConnectionsUserList" }, { "Action":[ @@ -148157,7 +155593,8 @@ "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateNetworkInterfacePermission", - "ec2:DeleteNetworkInterfacePermission" + "ec2:DeleteNetworkInterfacePermission", + "ec2:CreateVpcEndpoint" ], "Effect":"Allow", "Resource":"*", @@ -148179,7 +155616,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-29T20:27:23+00:00" + "UpdateDate":"2026-07-14T18:57:14+00:00" }, "SecretsManagerReadWrite":{ "CreateDate":"2018-04-04T18:05:29+00:00", @@ -148395,7 +155832,7 @@ }, "SecurityAudit":{ "CreateDate":"2015-02-06T18:41:01+00:00", - "DefaultVersionId":"v88", + "DefaultVersionId":"v91", "Document":{ "Statement":[ { @@ -148512,32 +155949,60 @@ "bedrock:ListPrompts", "bedrock:ListProvisionedModelThroughputs", "bedrock:ListTagsForResource", + "bedrock-agentcore:GetABTest", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", + "bedrock-agentcore:GetBatchEvaluation", "bedrock-agentcore:GetBrowser", "bedrock-agentcore:GetBrowserProfile", "bedrock-agentcore:GetCodeInterpreter", + "bedrock-agentcore:GetConfigurationBundle", + "bedrock-agentcore:GetConfigurationBundleVersion", + "bedrock-agentcore:GetEvaluator", "bedrock-agentcore:GetGateway", "bedrock-agentcore:GetGatewayTarget", "bedrock-agentcore:GetHarness", "bedrock-agentcore:GetMemory", + "bedrock-agentcore:GetOnlineEvaluationConfig", + "bedrock-agentcore:GetPaymentConnector", + "bedrock-agentcore:GetPaymentCredentialProvider", + "bedrock-agentcore:GetPaymentInstrument", + "bedrock-agentcore:GetPaymentManager", + "bedrock-agentcore:GetPaymentSession", "bedrock-agentcore:GetPolicy", "bedrock-agentcore:GetPolicyEngine", "bedrock-agentcore:GetPolicyGeneration", + "bedrock-agentcore:GetRecommendation", + "bedrock-agentcore:GetRegistry", + "bedrock-agentcore:GetRegistryRecord", + "bedrock-agentcore:ListABTests", "bedrock-agentcore:ListAgentRuntimeEndpoints", "bedrock-agentcore:ListAgentRuntimeVersions", "bedrock-agentcore:ListAgentRuntimes", + "bedrock-agentcore:ListBatchEvaluations", "bedrock-agentcore:ListBrowserProfiles", "bedrock-agentcore:ListBrowsers", "bedrock-agentcore:ListCodeInterpreters", + "bedrock-agentcore:ListConfigurationBundleVersions", + "bedrock-agentcore:ListConfigurationBundles", + "bedrock-agentcore:ListEvaluators", "bedrock-agentcore:ListGatewayTargets", "bedrock-agentcore:ListGateways", "bedrock-agentcore:ListHarnesses", "bedrock-agentcore:ListMemories", + "bedrock-agentcore:ListOnlineEvaluationConfigs", + "bedrock-agentcore:ListPaymentConnectors", + "bedrock-agentcore:ListPaymentCredentialProviders", + "bedrock-agentcore:ListPaymentInstruments", + "bedrock-agentcore:ListPaymentManagers", + "bedrock-agentcore:ListPaymentSessions", "bedrock-agentcore:ListPolicies", "bedrock-agentcore:ListPolicyEngines", "bedrock-agentcore:ListPolicyGenerationAssets", "bedrock-agentcore:ListPolicyGenerations", + "bedrock-agentcore:ListRecommendations", + "bedrock-agentcore:ListRegistries", + "bedrock-agentcore:ListRegistryRecords", "braket:SearchJobs", "braket:SearchQuantumTasks", "chime:List*", @@ -148754,6 +156219,7 @@ "ecr:ListTagsForResource", "ecs:Describe*", "ecs:List*", + "eks:DescribeAccessEntry", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodeGroup", @@ -149109,6 +156575,15 @@ "s3express:GetBucketPolicy", "s3express:GetEncryptionConfiguration", "s3express:ListAllMyDirectoryBuckets", + "s3files:GetAccessPoint", + "s3files:GetFileSystem", + "s3files:GetFileSystemPolicy", + "s3files:GetMountTarget", + "s3files:GetSynchronizationConfiguration", + "s3files:ListAccessPoints", + "s3files:ListFileSystems", + "s3files:ListMountTargets", + "s3files:ListTagsForResource", "s3tables:GetNamespace", "s3tables:GetTableBucketMaintenanceConfiguration", "s3tables:GetTableBucketPolicy", @@ -149150,6 +156625,16 @@ "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", + "security-ir:BatchGetMemberAccountDetails", + "security-ir:GetCase", + "security-ir:GetCaseAttachmentDownloadUrl", + "security-ir:GetMembership", + "security-ir:ListCaseEdits", + "security-ir:ListCases", + "security-ir:ListComments", + "security-ir:ListInvestigations", + "security-ir:ListMemberships", + "security-ir:ListTagsForResource", "serverlessrepo:GetApplicationPolicy", "serverlessrepo:List*", "servicequotas:GetAssociationForServiceQuotaTemplate", @@ -149397,7 +156882,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2026-05-18T15:42:13+00:00" + "UpdateDate":"2026-07-21T17:42:29+00:00" }, "SecurityLakeResourceManagementServiceRolePolicy":{ "CreateDate":"2024-11-14T22:10:14+00:00", @@ -149642,7 +157127,7 @@ }, "SecurityLakeServiceLinkedRole":{ "CreateDate":"2022-11-29T14:03:33+00:00", - "DefaultVersionId":"v3", + "DefaultVersionId":"v4", "Document":{ "Statement":[ { @@ -149685,6 +157170,16 @@ "Resource":"*", "Sid":"AllowListServiceLinkedChannel" }, + { + "Action":[ + "cloudtrail:DescribeTrails", + "cloudtrail:GetTrailStatus", + "cloudtrail:GetEventSelectors" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"AllowOrganizationTrailValidation" + }, { "Action":[ "ec2:DescribeVpcs" @@ -149764,7 +157259,7 @@ }, "Path":"/aws-service-role/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2024-04-19T16:00:05+00:00" + "UpdateDate":"2026-07-15T17:57:16+00:00" }, "ServerMigrationConnector":{ "CreateDate":"2016-10-24T21:45:56+00:00", @@ -151559,35 +159054,1283 @@ "PermissionsBoundaryUsageCount":0, "UpdateDate":"2026-05-20T18:12:21+00:00" }, + "WellArchitectedAgentResourceScanning":{ + "CreateDate":"2026-07-16T20:27:15+00:00", + "DefaultVersionId":"v1", + "Document":{ + "Statement":[ + { + "Action":[ + "access-analyzer:GetAnalyzer", + "access-analyzer:List*", + "acm-pca:Describe*", + "acm-pca:Get*", + "acm-pca:List*", + "acm:DescribeCertificate", + "aco-automation:GetAutomationRule", + "aco-automation:ListAutomationRules", + "aidevops:DescribePrivateConnection", + "aidevops:Get*", + "aidevops:List*", + "aiops:Get*", + "aiops:List*", + "airflow-serverless:GetWorkflow", + "airflow-serverless:List*", + "airflow:GetEnvironment", + "airflow:ListEnvironments", + "amplify:Get*", + "amplify:List*", + "amplifyuibuilder:Get*", + "amplifyuibuilder:List*", + "apigateway:GetRoutingRule", + "apigateway:ListRoutingRules", + "app-integrations:Get*", + "app-integrations:List*", + "appconfig:Get*", + "appconfig:List*", + "appflow:Describe*", + "appflow:List*", + "application-autoscaling:Describe*", + "application-signals:GetServiceLevelObjective", + "application-signals:List*", + "applicationinsights:Describe*", + "applicationinsights:List*", + "apprunner:Describe*", + "apprunner:List*", + "appstream:Describe*", + "appstream:List*", + "apptest:GetTestCase", + "apptest:List*", + "aps:Describe*", + "aps:List*", + "arc-region-switch:GetPlan", + "arc-region-switch:List*", + "arc-zonal-shift:Get*", + "arc-zonal-shift:ListManagedResources", + "athena:Get*", + "athena:List*", + "auditmanager:GetAssessment", + "auditmanager:List*", + "autoscaling:Describe*", + "aws-external-anthropic:GetWorkspace", + "aws-external-anthropic:List*", + "b2bi:Get*", + "b2bi:List*", + "backup-gateway:GetHypervisor", + "backup-gateway:List*", + "backup:Describe*", + "backup:Get*", + "backup:List*", + "batch:Describe*", + "batch:List*", + "bcm-data-exports:GetExport", + "bcm-data-exports:List*", + "bcm-pricing-calculator:GetBillScenario", + "bcm-pricing-calculator:List*", + "bedrock-agentcore:Get*", + "bedrock-agentcore:List*", + "bedrock-mantle:GetProject", + "bedrock-mantle:List*", + "bedrock:Get*", + "bedrock:List*", + "billing:GetBillingView", + "billing:List*", + "billingconductor:List*", + "braket:ListTagsForResource", + "braket:Search*", + "budgets:Describe*", + "budgets:ListTagsForResource", + "ce:DescribeCostCategoryDefinition", + "ce:Get*", + "ce:GetCostAndUsage", + "ce:GetCostAndUsageWithResources", + "ce:List*", + "chatbot:Describe*", + "chatbot:Get*", + "chatbot:List*", + "chime:Describe*", + "chime:List*", + "cleanrooms-ml:Get*", + "cleanrooms-ml:List*", + "cleanrooms:Get*", + "cleanrooms:List*", + "cloudformation:DescribeType", + "cloudformation:GetResource", + "cloudformation:ListResources", + "cloudformation:ListTypes", + "cloudfront:Describe*", + "cloudfront:Get*", + "cloudfront:List*", + "cloudtrail:Describe*", + "cloudtrail:Get*", + "cloudtrail:List*", + "cloudwatch:Describe*", + "cloudwatch:DescribeAlarms", + "cloudwatch:Get*", + "cloudwatch:GetMetricData", + "cloudwatch:GetMetricStatistics", + "cloudwatch:GetMetricWidgetImage", + "cloudwatch:List*", + "cloudwatch:ListMetrics", + "codeartifact:Describe*", + "codeartifact:Get*", + "codeartifact:List*", + "codebuild:BatchGetFleets", + "codebuild:ListFleets", + "codecommit:Get*", + "codeconnections:GetConnection", + "codeconnections:List*", + "codedeploy:Get*", + "codedeploy:List*", + "codeguru-profiler:DescribeProfilingGroup", + "codeguru-profiler:Get*", + "codeguru-profiler:List*", + "codeguru-reviewer:DescribeRepositoryAssociation", + "codeguru-reviewer:List*", + "codepipeline:Get*", + "codepipeline:List*", + "codestar-connections:Get*", + "codestar-connections:List*", + "codestar-notifications:DescribeNotificationRule", + "codestar-notifications:ListNotificationRules", + "cognito-identity:DescribeIdentityPool", + "cognito-identity:Get*", + "cognito-identity:ListIdentityPools", + "comprehend:Describe*", + "comprehend:List*", + "config:Describe*", + "config:GetStoredQuery", + "config:List*", + "connect-campaigns:Describe*", + "connect-campaigns:List*", + "controltower:Get*", + "controltower:List*", + "cur:Describe*", + "cur:ListTagsForResource", + "databrew:Describe*", + "databrew:List*", + "datapipeline:DescribePipelines", + "datapipeline:GetPipelineDefinition", + "datapipeline:ListPipelines", + "datasync:Describe*", + "datasync:List*", + "deadline:Get*", + "deadline:List*", + "detective:Describe*", + "detective:GetMembers", + "detective:List*", + "devicefarm:Get*", + "devicefarm:List*", + "devops-guru:Describe*", + "devops-guru:Get*", + "devops-guru:List*", + "directconnect:Describe*", + "dms:Describe*", + "dms:List*", + "ds:Describe*", + "ds:ListTagsForResource", + "dsql:Get*", + "dsql:List*", + "ecr-public:Describe*", + "ecr-public:Get*", + "ecr-public:ListTagsForResource", + "ecr:Describe*", + "ecr:Get*", + "ecr:List*", + "ecs:Describe*", + "ecs:List*", + "eks:Describe*", + "eks:List*", + "elasticbeanstalk:Describe*", + "elasticbeanstalk:List*", + "elasticfilesystem:Describe*", + "elasticloadbalancing:Describe*", + "elasticmapreduce:Describe*", + "elasticmapreduce:GetStudioSessionMapping", + "elasticmapreduce:List*", + "elemental-inference:GetFeed", + "elemental-inference:List*", + "emr-containers:Describe*", + "emr-containers:List*", + "emr-serverless:GetApplication", + "emr-serverless:ListApplications", + "entityresolution:Get*", + "entityresolution:List*", + "events:Describe*", + "events:List*", + "evidently:GetSegment", + "evidently:List*", + "evs:GetEnvironment", + "evs:List*", + "finspace:GetEnvironment", + "finspace:ListEnvironments", + "firehose:DescribeDeliveryStream", + "firehose:List*", + "fis:Get*", + "fis:List*", + "fms:Get*", + "fms:List*", + "forecast:Describe*", + "forecast:List*", + "fsx:Describe*", + "gamelift:Describe*", + "gamelift:List*", + "gamelift:ValidateMatchmakingRuleSet", + "gameliftstreams:Get*", + "gameliftstreams:List*", + "geo:Describe*", + "geo:List*", + "globalaccelerator:Describe*", + "globalaccelerator:List*", + "grafana:Describe*", + "grafana:ListWorkspaces", + "greengrass:DescribeComponent", + "greengrass:GetDeployment", + "greengrass:List*", + "groundstation:Get*", + "groundstation:List*", + "guardduty:DescribePublishingDestination", + "guardduty:Get*", + "guardduty:List*", + "healthlake:DescribeFHIRDatastore", + "healthlake:List*", + "iam:Get*", + "iam:List*", + "imagebuilder:Get*", + "imagebuilder:List*", + "inspector:Describe*", + "inspector:List*", + "inspector2:Get*", + "inspector2:List*", + "interconnect:GetConnection", + "interconnect:List*", + "internetmonitor:Get*", + "internetmonitor:List*", + "invoicing:GetInvoiceUnit", + "invoicing:List*", + "iot:Describe*", + "iot:Get*", + "iot:List*", + "iotanalytics:Describe*", + "iotanalytics:List*", + "iotdeviceadvisor:GetSuiteDefinition", + "iotdeviceadvisor:ListSuiteDefinitions", + "iotevents:Describe*", + "iotevents:List*", + "iotfleetwise:Get*", + "iotfleetwise:List*", + "iotsitewise:Describe*", + "iotsitewise:List*", + "iottwinmaker:Get*", + "iottwinmaker:List*", + "iotwireless:Get*", + "iotwireless:List*", + "ivs:Get*", + "ivs:List*", + "ivschat:Get*", + "ivschat:List*", + "kafka-cluster:Describe*", + "kafka:Describe*", + "kafka:Get*", + "kafka:List*", + "kafkaconnect:Describe*", + "kafkaconnect:List*", + "kendra-ranking:DescribeRescoreExecutionPlan", + "kendra-ranking:List*", + "kendra:Describe*", + "kendra:List*", + "kinesis:Describe*", + "kinesis:List*", + "kinesisanalytics:DescribeApplication", + "kinesisanalytics:List*", + "kinesisvideo:Describe*", + "kinesisvideo:List*", + "lakeformation:Describe*", + "lakeformation:GetLFTag", + "lakeformation:List*", + "lambda:GetFunctionConcurrency", + "launchwizard:GetDeployment", + "launchwizard:List*", + "lex:Describe*", + "lex:GetBotAlias", + "lex:List*", + "license-manager:Get*", + "license-manager:List*", + "logs:Describe*", + "logs:Get*", + "logs:List*", + "lookoutequipment:DescribeInferenceScheduler", + "lookoutequipment:ListInferenceSchedulers", + "lookoutvision:DescribeProject", + "lookoutvision:ListProjects", + "m2:Get*", + "m2:List*", + "macie2:Get*", + "macie2:List*", + "managedblockchain:GetAccessor", + "managedblockchain:ListAccessors", + "mediaconnect:Describe*", + "mediaconnect:Get*", + "mediaconnect:List*", + "medialive:Describe*", + "medialive:Get*", + "medialive:List*", + "mediapackage-vod:Describe*", + "mediapackage-vod:List*", + "mediapackage:Describe*", + "mediapackage:List*", + "mediapackagev2:Get*", + "mediapackagev2:List*", + "mediatailor:Describe*", + "mediatailor:GetPlaybackConfiguration", + "mediatailor:List*", + "medical-imaging:GetDatastore", + "medical-imaging:List*", + "mobiletargeting:Get*", + "mobiletargeting:List*", + "mpa:Get*", + "mpa:List*", + "mq:Describe*", + "mq:List*", + "network-firewall:Describe*", + "network-firewall:List*", + "networkmanager:Describe*", + "networkmanager:Get*", + "networkmanager:List*", + "nimble:GetStudio", + "nimble:ListStudios", + "notifications-contacts:GetEmailContact", + "notifications-contacts:List*", + "notifications:Get*", + "notifications:List*", + "nova-act:GetWorkflowDefinition", + "nova-act:ListWorkflowDefinitions", + "oam:Get*", + "oam:List*", + "observabilityadmin:Get*", + "observabilityadmin:List*", + "odb:Get*", + "odb:List*", + "omics:Get*", + "omics:List*", + "organizations:Describe*", + "organizations:List*", + "osis:Get*", + "osis:List*", + "panorama:Describe*", + "panorama:List*", + "payment-cryptography:Get*", + "payment-cryptography:List*", + "pca-connector-ad:Get*", + "pca-connector-ad:List*", + "pca-connector-scep:Get*", + "pca-connector-scep:List*", + "pcs:Get*", + "pcs:List*", + "personalize:Describe*", + "personalize:List*", + "pipes:DescribePipe", + "pipes:ListPipes", + "profile:Get*", + "profile:List*", + "proton:Get*", + "proton:List*", + "qbusiness:Get*", + "qbusiness:List*", + "quicksight:Describe*", + "quicksight:List*", + "ram:Get*", + "ram:List*", + "rbin:GetRule", + "rbin:List*", + "refactor-spaces:Get*", + "refactor-spaces:List*", + "rekognition:Describe*", + "rekognition:List*", + "resiliencehub:Describe*", + "resiliencehub:Get*", + "resiliencehub:List*", + "resource-explorer-2:Get*", + "resource-explorer-2:List*", + "resource-groups:Get*", + "resource-groups:List*", + "robomaker:Describe*", + "robomaker:List*", + "rolesanywhere:Get*", + "rolesanywhere:List*", + "route53-recovery-control-config:Describe*", + "route53-recovery-control-config:List*", + "route53-recovery-readiness:Get*", + "route53-recovery-readiness:List*", + "route53:Get*", + "route53:List*", + "route53profiles:Get*", + "route53profiles:List*", + "route53resolver:Get*", + "route53resolver:List*", + "rtbfabric:Get*", + "rtbfabric:List*", + "rum:BatchGetRumMetricDefinitions", + "rum:Get*", + "rum:List*", + "sagemaker:Describe*", + "sagemaker:GetModelPackageGroupPolicy", + "sagemaker:List*", + "sagemaker:ListMonitoringSchedules", + "scheduler:Get*", + "scheduler:List*", + "schemas:Describe*", + "schemas:List*", + "securitylake:Get*", + "securitylake:List*", + "servicecatalog:Describe*", + "servicecatalog:Get*", + "servicecatalog:List*", + "ses:Describe*", + "ses:Get*", + "ses:List*", + "shield:Describe*", + "shield:List*", + "signer:Get*", + "signer:List*", + "simspaceweaver:DescribeSimulation", + "simspaceweaver:ListSimulations", + "sms-voice:Describe*", + "sms-voice:Get*", + "sms-voice:List*", + "sns:Get*", + "sns:List*", + "sqs:GetQueueAttributes", + "sqs:List*", + "ssm-contacts:Get*", + "ssm-contacts:List*", + "ssm-guiconnect:Get*", + "ssm-incidents:Get*", + "ssm-incidents:List*", + "ssm-quicksetup:GetConfigurationManager", + "ssm-quicksetup:ListConfigurationManagers", + "ssm-sap:GetApplication", + "ssm-sap:List*", + "sso:Describe*", + "sso:Get*", + "sso:List*", + "states:Describe*", + "states:List*", + "supportapp:Get*", + "supportapp:List*", + "synthetics:Describe*", + "synthetics:Get*", + "synthetics:List*", + "tag:GetResources", + "thinclient:GetEnvironment", + "thinclient:List*", + "transfer:Describe*", + "transfer:List*", + "trustedadvisor:GetRecommendation", + "trustedadvisor:ListChecks", + "trustedadvisor:ListRecommendationResources", + "trustedadvisor:ListRecommendations", + "trustedadvisor:ListRecommendationsForResource", + "verifiedpermissions:Get*", + "verifiedpermissions:List*", + "voiceid:DescribeDomain", + "voiceid:List*", + "vpc-lattice:Get*", + "vpc-lattice:List*", + "wafv2:Get*", + "wafv2:List*", + "wisdom:Get*", + "wisdom:List*", + "workspaces-instances:Get*", + "workspaces-instances:List*", + "workspaces-web:Get*", + "workspaces-web:List*", + "workspaces:Describe*", + "xray:Get*", + "xray:List*" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"CloudControlDiscoveryCompact" + }, + { + "Action":[ + "aoss:BatchGetCollection", + "aoss:BatchGetCollectionGroup", + "aoss:BatchGetLifecyclePolicy", + "aoss:BatchGetVpcEndpoint", + "aoss:GetAccessPolicy", + "aoss:GetSecurityConfig", + "aoss:GetSecurityPolicy", + "aoss:ListAccessPolicies", + "aoss:ListCollectionGroups", + "aoss:ListCollections", + "aoss:ListLifecyclePolicies", + "aoss:ListSecurityConfigs", + "aoss:ListSecurityPolicies", + "aoss:ListTagsForResource", + "aoss:ListVpcEndpoints", + "appsync:GetApi", + "appsync:GetChannelNamespace", + "appsync:GetDataSource", + "appsync:GetDomainName", + "appsync:GetGraphqlApi", + "appsync:GetSourceApiAssociation", + "appsync:ListApis", + "appsync:ListChannelNamespaces", + "appsync:ListDataSources", + "appsync:ListDomainNames", + "appsync:ListFunctions", + "appsync:ListGraphqlApis", + "appsync:ListResolvers", + "appsync:ListSourceApiAssociations", + "appsync:ListTagsForResource", + "cases:BatchGetCaseRule", + "cases:BatchGetField", + "cases:GetDomain", + "cases:GetLayout", + "cases:GetTemplate", + "cases:ListCaseRules", + "cases:ListDomains", + "cases:ListFields", + "cases:ListLayouts", + "cases:ListTemplates", + "cloudformation:BatchDescribeTypeConfigurations", + "cloudformation:DescribePublisher", + "cloudformation:DescribeStackInstance", + "cloudformation:DescribeStacks", + "cloudformation:DescribeStackSet", + "cloudformation:DescribeType", + "cloudformation:GetStackPolicy", + "cloudformation:GetTemplate", + "cloudformation:ListStackInstances", + "cloudformation:ListStacks", + "cloudformation:ListStackSets", + "cloudformation:ListTypes", + "cloudformation:ListTypeVersions", + "cognito-idp:DescribeIdentityProvider", + "cognito-idp:DescribeResourceServer", + "cognito-idp:DescribeTerms", + "cognito-idp:DescribeUserPool", + "cognito-idp:DescribeUserPoolClient", + "cognito-idp:GetGroup", + "cognito-idp:GetUserPoolMfaConfig", + "cognito-idp:ListGroups", + "cognito-idp:ListIdentityProviders", + "cognito-idp:ListResourceServers", + "cognito-idp:ListTerms", + "cognito-idp:ListUserPoolClients", + "cognito-idp:ListUserPools", + "connect:DescribeAgentStatus", + "connect:DescribeContactFlow", + "connect:DescribeContactFlowModule", + "connect:DescribeContactFlowModuleAlias", + "connect:DescribeDataTable", + "connect:DescribeEvaluationForm", + "connect:DescribeHoursOfOperation", + "connect:DescribeInstance", + "connect:DescribeInstanceStorageConfig", + "connect:DescribeNotification", + "connect:DescribePhoneNumber", + "connect:DescribePredefinedAttribute", + "connect:DescribePrompt", + "connect:DescribeQueue", + "connect:DescribeQuickConnect", + "connect:DescribeRoutingProfile", + "connect:DescribeRule", + "connect:DescribeSecurityProfile", + "connect:DescribeTrafficDistributionGroup", + "connect:DescribeUserHierarchyGroup", + "connect:DescribeView", + "connect:DescribeWorkspace", + "connect:GetTaskTemplate", + "connect:ListAgentStatuses", + "connect:ListApprovedOrigins", + "connect:ListBots", + "connect:ListContactFlowModuleAliases", + "connect:ListContactFlowModules", + "connect:ListContactFlowModuleVersions", + "connect:ListContactFlows", + "connect:ListContactFlowVersions", + "connect:ListDataTableAttributes", + "connect:ListDataTables", + "connect:ListEvaluationForms", + "connect:ListEvaluationFormVersions", + "connect:ListHoursOfOperationOverrides", + "connect:ListHoursOfOperations", + "connect:ListInstanceAttributes", + "connect:ListInstances", + "connect:ListInstanceStorageConfigs", + "connect:ListIntegrationAssociations", + "connect:ListLambdaFunctions", + "connect:ListNotifications", + "connect:ListPredefinedAttributes", + "connect:ListPrompts", + "connect:ListQueueEmailAddresses", + "connect:ListQueueQuickConnects", + "connect:ListQueues", + "connect:ListQuickConnects", + "connect:ListRoutingProfileManualAssignmentQueues", + "connect:ListRoutingProfileQueues", + "connect:ListRoutingProfiles", + "connect:ListRules", + "connect:ListSecurityKeys", + "connect:ListSecurityProfileApplications", + "connect:ListSecurityProfileFlowModules", + "connect:ListSecurityProfilePermissions", + "connect:ListSecurityProfiles", + "connect:ListTagsForResource", + "connect:ListTaskTemplates", + "connect:ListTrafficDistributionGroups", + "connect:ListUserHierarchyGroups", + "connect:ListUserProficiencies", + "connect:ListUsers", + "connect:ListViews", + "connect:ListViewVersions", + "connect:ListWorkspaceMedia", + "connect:ListWorkspacePages", + "connect:ListWorkspaces", + "connect:SearchWorkspaceAssociations", + "datazone:GetDataSource", + "datazone:GetDomain", + "datazone:GetDomainUnit", + "datazone:GetEnvironment", + "datazone:GetEnvironmentAction", + "datazone:GetEnvironmentBlueprintConfiguration", + "datazone:GetEnvironmentProfile", + "datazone:GetGroupProfile", + "datazone:GetProject", + "datazone:GetProjectProfile", + "datazone:GetSubscriptionTarget", + "datazone:GetUserProfile", + "datazone:ListConnections", + "datazone:ListDataSources", + "datazone:ListDomains", + "datazone:ListDomainUnitsForParent", + "datazone:ListEntityOwners", + "datazone:ListEnvironmentActions", + "datazone:ListEnvironmentBlueprintConfigurations", + "datazone:ListEnvironmentProfiles", + "datazone:ListEnvironments", + "datazone:ListPolicyGrants", + "datazone:ListProjectMemberships", + "datazone:ListProjectProfiles", + "datazone:ListProjects", + "datazone:ListSubscriptionTargets", + "datazone:SearchGroupProfiles", + "datazone:SearchUserProfiles", + "docdb-elastic:GetCluster", + "docdb-elastic:ListClusters", + "docdb-elastic:ListTagsForResource", + "dynamodb:DescribeContinuousBackups", + "dynamodb:DescribeContributorInsights", + "dynamodb:DescribeKinesisStreamingDestination", + "dynamodb:DescribeTable", + "dynamodb:DescribeTimeToLive", + "dynamodb:GetResourcePolicy", + "dynamodb:ListTables", + "dynamodb:ListTagsOfResource", + "ec2:DescribeAccountAttributes", + "ec2:DescribeAddresses", + "ec2:DescribeAvailabilityZones", + "ec2:DescribeAwsNetworkPerformanceMetricSubscriptions", + "ec2:DescribeCapacityManagerDataExports", + "ec2:DescribeCapacityReservationFleets", + "ec2:DescribeCapacityReservations", + "ec2:DescribeCarrierGateways", + "ec2:DescribeClientVpnEndpoints", + "ec2:DescribeCustomerGateways", + "ec2:DescribeDhcpOptions", + "ec2:DescribeEgressOnlyInternetGateways", + "ec2:DescribeFleets", + "ec2:DescribeFlowLogs", + "ec2:DescribeHosts", + "ec2:DescribeInstanceAttribute", + "ec2:DescribeInstanceConnectEndpoints", + "ec2:DescribeInstanceCreditSpecifications", + "ec2:DescribeInstances", + "ec2:DescribeInstanceSqlHaStates", + "ec2:DescribeInternetGateways", + "ec2:DescribeIpamPools", + "ec2:DescribeIpamPrefixListResolvers", + "ec2:DescribeIpamPrefixListResolverTargets", + "ec2:DescribeIpamResourceDiscoveries", + "ec2:DescribeIpamResourceDiscoveryAssociations", + "ec2:DescribeIpams", + "ec2:DescribeIpamScopes", + "ec2:DescribeKeyPairs", + "ec2:DescribeLaunchTemplates", + "ec2:DescribeLocalGatewayRouteTables", + "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", + "ec2:DescribeLocalGatewayRouteTableVpcAssociations", + "ec2:DescribeLocalGatewayVirtualInterfaceGroups", + "ec2:DescribeLocalGatewayVirtualInterfaces", + "ec2:DescribeManagedPrefixLists", + "ec2:DescribeNatGateways", + "ec2:DescribeNetworkAcls", + "ec2:DescribeNetworkInsightsAccessScopeAnalyses", + "ec2:DescribeNetworkInsightsAccessScopes", + "ec2:DescribeNetworkInsightsPaths", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribePlacementGroups", + "ec2:DescribeRouteServerEndpoints", + "ec2:DescribeRouteServerPeers", + "ec2:DescribeRouteServers", + "ec2:DescribeRouteTables", + "ec2:DescribeSecurityGroupRules", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSecurityGroupVpcAssociations", + "ec2:DescribeSpotFleetRequests", + "ec2:DescribeSubnets", + "ec2:DescribeTags", + "ec2:DescribeTrafficMirrorFilterRules", + "ec2:DescribeTrafficMirrorFilters", + "ec2:DescribeTrafficMirrorSessions", + "ec2:DescribeTrafficMirrorTargets", + "ec2:DescribeTransitGatewayConnectPeers", + "ec2:DescribeTransitGatewayConnects", + "ec2:DescribeTransitGatewayMeteringPolicies", + "ec2:DescribeTransitGatewayMulticastDomains", + "ec2:DescribeTransitGatewayPeeringAttachments", + "ec2:DescribeTransitGatewayRouteTables", + "ec2:DescribeTransitGateways", + "ec2:DescribeTransitGatewayVpcAttachments", + "ec2:DescribeVerifiedAccessEndpoints", + "ec2:DescribeVerifiedAccessGroups", + "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations", + "ec2:DescribeVerifiedAccessInstances", + "ec2:DescribeVerifiedAccessTrustProviders", + "ec2:DescribeVolumeAttribute", + "ec2:DescribeVolumes", + "ec2:DescribeVpcAttribute", + "ec2:DescribeVpcBlockPublicAccessExclusions", + "ec2:DescribeVpcEncryptionControls", + "ec2:DescribeVpcEndpointAssociations", + "ec2:DescribeVpcEndpointConnectionNotifications", + "ec2:DescribeVpcEndpoints", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServicePermissions", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeVpcs", + "ec2:DescribeVpnConcentrators", + "ec2:DescribeVpnConnections", + "ec2:DescribeVpnGateways", + "ec2:GetAssociatedEnclaveCertificateIamRoles", + "ec2:GetIpamPoolAllocations", + "ec2:GetIpamPoolCidrs", + "ec2:GetIpamPrefixListResolverRules", + "ec2:GetManagedPrefixListEntries", + "ec2:GetNetworkInsightsAccessScopeContent", + "ec2:GetRouteServerAssociations", + "ec2:GetRouteServerPropagations", + "ec2:GetSnapshotBlockPublicAccessState", + "ec2:GetTransitGatewayMeteringPolicyEntries", + "ec2:GetTransitGatewayMulticastDomainAssociations", + "ec2:GetTransitGatewayRouteTableAssociations", + "ec2:GetTransitGatewayRouteTablePropagations", + "ec2:GetVerifiedAccessEndpointPolicy", + "ec2:GetVerifiedAccessGroupPolicy", + "ec2:SearchLocalGatewayRoutes", + "ec2:SearchTransitGatewayMulticastGroups", + "ec2:SearchTransitGatewayRoutes", + "elasticache:DescribeCacheClusters", + "elasticache:DescribeCacheParameterGroups", + "elasticache:DescribeCacheParameters", + "elasticache:DescribeCacheSubnetGroups", + "elasticache:DescribeGlobalReplicationGroups", + "elasticache:DescribeReplicationGroups", + "elasticache:DescribeServerlessCaches", + "elasticache:DescribeUserGroups", + "elasticache:DescribeUsers", + "elasticache:ListTagsForResource", + "es:GetApplication", + "es:ListApplications", + "es:ListTags", + "frauddetector:BatchGetVariable", + "frauddetector:DescribeDetector", + "frauddetector:GetDetectors", + "frauddetector:GetDetectorVersion", + "frauddetector:GetEntityTypes", + "frauddetector:GetEventTypes", + "frauddetector:GetExternalModels", + "frauddetector:GetLabels", + "frauddetector:GetListsMetadata", + "frauddetector:GetModelVersion", + "frauddetector:GetOutcomes", + "frauddetector:GetRules", + "frauddetector:GetVariables", + "frauddetector:ListTagsForResource", + "glue:DescribeIntegrations", + "glue:GetCatalog", + "glue:GetCatalogs", + "glue:GetCrawler", + "glue:GetDatabase", + "glue:GetDatabases", + "glue:GetIntegrationResourceProperty", + "glue:GetJob", + "glue:GetRegistry", + "glue:GetSchema", + "glue:GetSchemaVersion", + "glue:GetTags", + "glue:GetTrigger", + "glue:GetUsageProfile", + "glue:ListCrawlers", + "glue:ListIntegrationResourceProperties", + "glue:ListJobs", + "glue:ListRegistries", + "glue:ListSchemas", + "glue:ListSchemaVersions", + "glue:ListTriggers", + "glue:ListUsageProfiles", + "identitystore:DescribeGroup", + "identitystore:ListGroupMemberships", + "identitystore:ListGroupMembershipsForMember", + "identitystore:ListGroups", + "kms:DescribeCustomKeyStores", + "kms:DescribeKey", + "kms:GetKeyPolicy", + "kms:GetKeyRotationStatus", + "kms:GetParametersForImport", + "kms:GetPublicKey", + "kms:ListAliases", + "kms:ListGrants", + "kms:ListKeyPolicies", + "kms:ListKeyRotations", + "kms:ListKeys", + "kms:ListResourceTags", + "kms:ListRetirableGrants", + "lambda:GetAlias", + "lambda:GetCapacityProvider", + "lambda:GetCodeSigningConfig", + "lambda:GetEventSourceMapping", + "lambda:GetFunction", + "lambda:GetFunctionCodeSigningConfig", + "lambda:GetFunctionConfiguration", + "lambda:GetFunctionEventInvokeConfig", + "lambda:GetFunctionRecursionConfig", + "lambda:GetFunctionScalingConfig", + "lambda:GetFunctionUrlConfig", + "lambda:GetLayerVersionPolicy", + "lambda:GetPolicy", + "lambda:GetProvisionedConcurrencyConfig", + "lambda:GetRuntimeManagementConfig", + "lambda:ListAliases", + "lambda:ListCapacityProviders", + "lambda:ListCodeSigningConfigs", + "lambda:ListEventSourceMappings", + "lambda:ListFunctionEventInvokeConfigs", + "lambda:ListFunctions", + "lambda:ListFunctionUrlConfigs", + "lambda:ListLayerVersions", + "lambda:ListTags", + "lambda:ListVersionsByFunction", + "lightsail:GetAlarms", + "lightsail:GetBuckets", + "lightsail:GetCertificates", + "lightsail:GetContainerServices", + "lightsail:GetDisk", + "lightsail:GetDisks", + "lightsail:GetDiskSnapshot", + "lightsail:GetDiskSnapshots", + "lightsail:GetDistributions", + "lightsail:GetDomain", + "lightsail:GetDomains", + "lightsail:GetInstance", + "lightsail:GetInstances", + "lightsail:GetInstanceSnapshot", + "lightsail:GetInstanceSnapshots", + "lightsail:GetLoadBalancer", + "lightsail:GetLoadBalancers", + "lightsail:GetLoadBalancerTlsCertificates", + "lightsail:GetRelationalDatabase", + "lightsail:GetRelationalDatabases", + "lightsail:GetRelationalDatabaseSnapshot", + "lightsail:GetRelationalDatabaseSnapshots", + "lightsail:GetStaticIp", + "lightsail:GetStaticIps", + "memorydb:DescribeACLs", + "memorydb:DescribeClusters", + "memorydb:DescribeMultiRegionClusters", + "memorydb:DescribeParameterGroups", + "memorydb:DescribeSubnetGroups", + "memorydb:DescribeUsers", + "memorydb:ListTags", + "neptune-graph:GetGraph", + "neptune-graph:GetGraphSnapshot", + "neptune-graph:GetPrivateGraphEndpoint", + "neptune-graph:ListGraphs", + "neptune-graph:ListGraphSnapshots", + "neptune-graph:ListPrivateGraphEndpoints", + "neptune-graph:ListTagsForResource", + "qldb:DescribeJournalKinesisStream", + "qldb:ListJournalKinesisStreamsForLedger", + "qldb:ListTagsForResource", + "rds:DescribeDBClusterParameterGroups", + "rds:DescribeDBClusterParameters", + "rds:DescribeDBClusters", + "rds:DescribeDBEngineVersions", + "rds:DescribeDBInstances", + "rds:DescribeDBParameterGroups", + "rds:DescribeDBParameters", + "rds:DescribeDBProxies", + "rds:DescribeDBProxyEndpoints", + "rds:DescribeDBProxyTargetGroups", + "rds:DescribeDBProxyTargets", + "rds:DescribeDBShardGroups", + "rds:DescribeDBSubnetGroups", + "rds:DescribeEngineDefaultParameters", + "rds:DescribeEventSubscriptions", + "rds:DescribeGlobalClusters", + "rds:DescribeIntegrations", + "rds:DescribeOptionGroups", + "rds:ListTagsForResource", + "redshift-serverless:GetNamespace", + "redshift-serverless:GetSnapshot", + "redshift-serverless:GetWorkgroup", + "redshift-serverless:ListNamespaces", + "redshift-serverless:ListSnapshotCopyConfigurations", + "redshift-serverless:ListSnapshots", + "redshift-serverless:ListTagsForResource", + "redshift-serverless:ListWorkgroups", + "redshift:DescribeClusterDbRevisions", + "redshift:DescribeClusterParameterGroups", + "redshift:DescribeClusterParameters", + "redshift:DescribeClusters", + "redshift:DescribeClusterSubnetGroups", + "redshift:DescribeEndpointAccess", + "redshift:DescribeEndpointAuthorization", + "redshift:DescribeEventSubscriptions", + "redshift:DescribeIntegrations", + "redshift:DescribeLoggingStatus", + "redshift:DescribeScheduledActions", + "redshift:DescribeTags", + "redshift:GetResourcePolicy", + "route53globalresolver:GetAccessSource", + "route53globalresolver:GetDNSView", + "route53globalresolver:GetFirewallDomainList", + "route53globalresolver:GetFirewallRule", + "route53globalresolver:GetGlobalResolver", + "route53globalresolver:GetHostedZoneAssociation", + "route53globalresolver:ListAccessSources", + "route53globalresolver:ListAccessTokens", + "route53globalresolver:ListDNSViews", + "route53globalresolver:ListFirewallDomainLists", + "route53globalresolver:ListFirewallRules", + "route53globalresolver:ListGlobalResolvers", + "route53globalresolver:ListHostedZoneAssociations", + "route53globalresolver:ListTagsForResource", + "s3-outposts:GetAccessPoint", + "s3-outposts:GetAccessPointPolicy", + "s3-outposts:GetBucket", + "s3-outposts:GetBucketTagging", + "s3-outposts:GetLifecycleConfiguration", + "s3-outposts:ListAccessPoints", + "s3-outposts:ListEndpoints", + "s3-outposts:ListRegionalBuckets", + "s3:GetAccelerateConfiguration", + "s3:GetAccessGrant", + "s3:GetAccessGrantsInstance", + "s3:GetAccessGrantsLocation", + "s3:GetAccessPoint", + "s3:GetAccessPointConfigurationForObjectLambda", + "s3:GetAccessPointForObjectLambda", + "s3:GetAccessPointPolicy", + "s3:GetAccessPointPolicyStatusForObjectLambda", + "s3:GetAnalyticsConfiguration", + "s3:GetBucketAbac", + "s3:GetBucketAcl", + "s3:GetBucketCORS", + "s3:GetBucketLocation", + "s3:GetBucketLogging", + "s3:GetBucketMetadataTableConfiguration", + "s3:GetBucketNotification", + "s3:GetBucketObjectLockConfiguration", + "s3:GetBucketOwnershipControls", + "s3:GetBucketPolicy", + "s3:GetBucketPublicAccessBlock", + "s3:GetBucketTagging", + "s3:GetBucketVersioning", + "s3:GetBucketWebsite", + "s3:GetEncryptionConfiguration", + "s3:GetIntelligentTieringConfiguration", + "s3:GetInventoryConfiguration", + "s3:GetLifecycleConfiguration", + "s3:GetMetricsConfiguration", + "s3:GetMultiRegionAccessPoint", + "s3:GetMultiRegionAccessPointPolicy", + "s3:GetMultiRegionAccessPointPolicyStatus", + "s3:GetObjectAcl", + "s3:GetReplicationConfiguration", + "s3:GetStorageLensConfiguration", + "s3:GetStorageLensConfigurationTagging", + "s3:GetStorageLensGroup", + "s3:ListAccessGrants", + "s3:ListAccessGrantsInstances", + "s3:ListAccessGrantsLocations", + "s3:ListAccessPoints", + "s3:ListAccessPointsForObjectLambda", + "s3:ListAllMyBuckets", + "s3:ListMultiRegionAccessPoints", + "s3:ListStorageLensConfigurations", + "s3:ListStorageLensGroups", + "s3:ListTagsForResource", + "s3express:GetAccessPoint", + "s3express:GetAccessPointPolicy", + "s3express:GetAccessPointScope", + "s3express:GetBucketPolicy", + "s3express:GetEncryptionConfiguration", + "s3express:GetInventoryConfiguration", + "s3express:GetLifecycleConfiguration", + "s3express:GetMetricsConfiguration", + "s3express:ListAccessPointsForDirectoryBuckets", + "s3express:ListAllMyDirectoryBuckets", + "s3express:ListTagsForResource", + "s3files:GetAccessPoint", + "s3files:GetFileSystem", + "s3files:GetFileSystemPolicy", + "s3files:GetMountTarget", + "s3files:GetSynchronizationConfiguration", + "s3files:ListAccessPoints", + "s3files:ListFileSystems", + "s3files:ListMountTargets", + "s3files:ListTagsForResource", + "s3tables:GetNamespace", + "s3tables:GetTable", + "s3tables:GetTableBucket", + "s3tables:GetTableBucketEncryption", + "s3tables:GetTableBucketMaintenanceConfiguration", + "s3tables:GetTableBucketMetricsConfiguration", + "s3tables:GetTableBucketPolicy", + "s3tables:GetTableBucketReplication", + "s3tables:GetTableBucketStorageClass", + "s3tables:GetTableMaintenanceConfiguration", + "s3tables:GetTablePolicy", + "s3tables:GetTableStorageClass", + "s3tables:ListNamespaces", + "s3tables:ListTableBuckets", + "s3tables:ListTables", + "s3tables:ListTagsForResource", + "s3vectors:GetIndex", + "s3vectors:GetVectorBucket", + "s3vectors:GetVectorBucketPolicy", + "s3vectors:ListIndexes", + "s3vectors:ListTagsForResource", + "s3vectors:ListVectorBuckets", + "secretsmanager:DescribeSecret", + "secretsmanager:GetResourcePolicy", + "secretsmanager:ListSecrets", + "securityagent:BatchGetAgentSpaces", + "securityagent:BatchGetPentests", + "securityagent:BatchGetTargetDomains", + "securityagent:GetApplication", + "securityagent:ListAgentSpaces", + "securityagent:ListApplications", + "securityagent:ListIntegratedResources", + "securityagent:ListPentests", + "securityagent:ListTagsForResource", + "securityagent:ListTargetDomains", + "securityhub:BatchGetAutomationRules", + "securityhub:BatchGetSecurityControls", + "securityhub:DescribeHub", + "securityhub:DescribeOrganizationConfiguration", + "securityhub:DescribeSecurityHubV2", + "securityhub:DescribeStandardsControls", + "securityhub:GetAggregatorV2", + "securityhub:GetAutomationRuleV2", + "securityhub:GetConfigurationPolicy", + "securityhub:GetConfigurationPolicyAssociation", + "securityhub:GetConnectorV2", + "securityhub:GetEnabledStandards", + "securityhub:GetFindingAggregator", + "securityhub:GetInsights", + "securityhub:ListAggregatorsV2", + "securityhub:ListAutomationRules", + "securityhub:ListAutomationRulesV2", + "securityhub:ListConfigurationPolicies", + "securityhub:ListConfigurationPolicyAssociations", + "securityhub:ListConnectorsV2", + "securityhub:ListEnabledProductsForImport", + "securityhub:ListFindingAggregators", + "securityhub:ListOrganizationAdminAccounts", + "securityhub:ListSecurityControlDefinitions", + "securityhub:ListTagsForResource", + "ssm:DescribeAssociation", + "ssm:DescribeDocument", + "ssm:DescribeMaintenanceWindows", + "ssm:DescribeMaintenanceWindowTargets", + "ssm:DescribeMaintenanceWindowTasks", + "ssm:DescribeParameters", + "ssm:DescribePatchBaselines", + "ssm:GetDefaultPatchBaseline", + "ssm:GetDocument", + "ssm:GetMaintenanceWindow", + "ssm:GetMaintenanceWindowTask", + "ssm:GetPatchBaseline", + "ssm:GetResourcePolicies", + "ssm:ListAssociations", + "ssm:ListDocuments", + "ssm:ListResourceDataSync", + "ssm:ListTagsForResource", + "sso-directory:DescribeGroup", + "sso-directory:SearchGroups", + "sts:GetCallerIdentity", + "timestream-influxdb:GetDbCluster", + "timestream-influxdb:GetDbInstance", + "timestream-influxdb:ListDbClusters", + "timestream-influxdb:ListDbInstances", + "timestream-influxdb:ListTagsForResource", + "timestream:DescribeDatabase", + "timestream:DescribeEndpoints", + "timestream:DescribeScheduledQuery", + "timestream:DescribeTable", + "timestream:ListDatabases", + "timestream:ListScheduledQueries", + "timestream:ListTables", + "timestream:ListTagsForResource" + ], + "Effect":"Allow", + "Resource":"*", + "Sid":"CloudControlDiscoveryCompactExact" + } + ], + "Version":"2012-10-17" + }, + "Path":"/", + "PermissionsBoundaryUsageCount":0, + "UpdateDate":"2026-07-16T20:27:15+00:00" + }, "WellArchitectedConsoleFullAccess":{ "CreateDate":"2018-11-29T18:19:23+00:00", - "DefaultVersionId":"v1", + "DefaultVersionId":"v2", "Document":{ "Statement":[ + { + "Action":"wellarchitected:*", + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":[ + "organizations:DescribeAccount", + "organizations:DescribeOrganization", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:ListRoots", + "organizations:ListAccounts", + "organizations:ListOrganizationalUnitsForParent", + "organizations:ListAccountsForParent", + "organizations:ListDelegatedServicesForAccount", + "organizations:ListDelegatedAdministrators" + ], + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":[ + "organizations:RegisterDelegatedAdministrator", + "organizations:DeregisterDelegatedAdministrator", + "organizations:EnableAWSServiceAccess", + "organizations:DisableAWSServiceAccess" + ], + "Condition":{ + "StringEquals":{ + "organizations:ServicePrincipal":"agent.wellarchitected.amazonaws.com" + } + }, + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":[ + "trustedadvisor:List*", + "trustedadvisor:Get*" + ], + "Effect":"Allow", + "Resource":"*" + }, + { + "Action":"iam:CreateServiceLinkedRole", + "Condition":{ + "StringEquals":{ + "iam:AWSServiceName":[ + "wellarchitected.amazonaws.com", + "agent.wellarchitected.amazonaws.com", + "metrics.wellarchitected.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:*:iam::*:role/aws-service-role/*/AWSServiceRoleForWellArchitected*" + }, + { + "Action":[ + "iam:DeleteServiceLinkedRole", + "iam:GetServiceLinkedRoleDeletionStatus" + ], + "Effect":"Allow", + "Resource":"arn:*:iam::*:role/aws-service-role/*/AWSServiceRoleForWellArchitected*" + }, + { + "Action":[ + "iam:CreateRole", + "iam:AttachRolePolicy" + ], + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/service-role/*" + }, { "Action":[ - "wellarchitected:*" + "iam:CreatePolicy", + "iam:CreatePolicyVersion", + "iam:DeletePolicyVersion" ], "Effect":"Allow", + "Resource":"arn:aws:iam::*:policy/service-role/*" + }, + { + "Action":"iam:ListRoles", + "Effect":"Allow", "Resource":"*" + }, + { + "Action":"iam:PassRole", + "Condition":{ + "StringEquals":{ + "iam:PassedToService":[ + "wellarchitected.amazonaws.com", + "agent.wellarchitected.amazonaws.com" + ] + } + }, + "Effect":"Allow", + "Resource":"arn:aws:iam::*:role/*" } ], "Version":"2012-10-17" }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2018-11-29T18:19:23+00:00" + "UpdateDate":"2026-07-09T17:27:22+00:00" }, "WellArchitectedConsoleReadOnlyAccess":{ "CreateDate":"2018-11-29T18:21:08+00:00", - "DefaultVersionId":"v2", + "DefaultVersionId":"v3", "Document":{ "Statement":[ { "Action":[ "wellarchitected:Get*", "wellarchitected:List*", - "wellarchitected:ExportLens" + "wellarchitected:ExportLens", + "organizations:DescribeAccount", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:ListDelegatedAdministrators", + "organizations:ListRoots", + "organizations:ListOrganizationalUnitsForParent", + "organizations:ListAccountsForParent", + "organizations:ListAccounts", + "organizations:DescribeOrganization", + "trustedadvisor:List*", + "trustedadvisor:Get*" ], "Effect":"Allow", "Resource":"*" @@ -151597,7 +160340,7 @@ }, "Path":"/", "PermissionsBoundaryUsageCount":0, - "UpdateDate":"2023-06-29T17:16:13+00:00" + "UpdateDate":"2026-07-09T17:27:19+00:00" }, "WorkLinkServiceRolePolicy":{ "CreateDate":"2019-01-23T19:03:45+00:00",