AWS services that work with IAM

The AWS services listed below are grouped alphabetically and include information about what IAM features they support:

• Service – You can choose the name of a service to view the AWS documentation about IAM authorization and access for that service.

• Actions – You can specify individual actions in a policy. If the service does not support this feature, then All actions is selected in the visual editor. In a JSON policy document, you must use * in the Action element. For a list of actions in each service, see Actions, Resources, and Condition Keys for AWS Services.

• Resource-level permissions – You can use ARNs to specify individual resources in the policy. If the service does not support this feature, then All resources is chosen in the policy visual editor. In a JSON policy document, you must use * in the Resource element. Some actions, such as List* actions, do not support specifying an ARN because they are designed to return multiple resources. If a service supports this feature for some resources but not others, it is indicated by Partial in the table. See the documentation for that service for more information.

• Resource-based policies – You can attach resource-based policies to a resource within the service. Resource-based policies include a Principal element to specify which IAM identities can access that resource. For more information, see Identity-based policies and resource-based policies.

• ABAC (authorization based on tags) – To control access based on tags, you provide tag information in the condition element of a policy using the aws:ResourceTag/key-name, aws:RequestTag/key-name, or aws:TagKeys condition keys. If a service supports all three condition keys for every resource type, then the value is Yes for the service. If a service supports all three condition keys for only some resource types, then the value is Partial. For more information about defining permissions based on attributes such as tags, see What is ABAC for AWS?. To view a tutorial with steps for setting up ABAC, see Use attribute-based access control (ABAC).

• Temporary credentials – You can use short-term credentials that you obtain when you sign in using IAM Identity Center, switch roles in the console, or that you generate using AWS STS in the AWS CLI or AWS API. You can access services with a No value only while using your long-term IAM user credentials. This includes a user name and password or your user access keys. For more information, see Temporary security credentials in IAM.

• Service-linked roles – A service-linked role is a special type of service role that gives the service permission to access resources in other services on your behalf. Choose the Yes or Partial link to see the documentation for services that support these roles. This column does not indicate if the service uses standard service roles. For more information, see Using service-linked roles.

• More information – If a service doesn't fully support a feature, you can review the footnotes for an entry to view the limitations and links to related information.

Services that work with IAM

Service	Actions	Resource-level permissions	Resource-based policies	ABAC	Temporary credentials	Service-linked roles
AWS Account Management	Yes	Yes	No	No	Yes	No
AWS Activate Console	Yes	No	No	No	Yes	No
AWS Amplify Admin	Yes	Yes	No	No	Yes	No
AWS Amplify	Yes	Yes	No	Partial	Yes	No
AWS Amplify UI Builder	Yes	Yes	No	Yes	Yes	No
Apache Kafka APIs for Amazon MSK clusters	Yes	Yes	No	No	Yes	No
Amazon API Gateway	Yes	Yes	Yes	No	Yes	Yes
Amazon API Gateway Management	Yes	Yes	No	Yes	Yes	No
Amazon API Gateway Management V2	Yes	Yes	No	Yes	Yes	No
AWS App2Container	Yes	No	No	No	Yes	No
AWS AppConfig	Yes	Yes	No	Yes	Yes	No
AWS AppFabric	Yes	Yes	No	Yes	Yes	No
Amazon AppFlow	Yes	Yes	No	Yes	Yes	No
Amazon AppIntegrations	Yes	Yes	No	Yes	Yes	Yes
Application Auto Scaling	Yes	Yes	No	Yes	Yes	Yes
AWS Application Cost Profiler	Yes	No	No	No	Yes	No
AWS Application Discovery Arsenal	Yes	No	No	No	Yes	No
AWS Application Discovery Service	Yes	No	No	No	Yes	Yes
AWS Application Migration Service	Yes	Yes	No	Yes	Yes	Yes
AWS Application Transformation Service	Yes	No	No	No	Yes	No
AWS App Mesh	Yes	Yes	No	Yes	Yes	Yes
AWS App Mesh Preview	Yes	Yes	No	No	Yes	Yes
AWS App Runner	Yes	Yes	No	Yes	Yes	Yes
Amazon AppStream 2.0	Yes	Yes	No	Yes	Yes	No
AWS AppSync	Yes	Yes	No	Yes	Yes	No
AWS Artifact	Yes	Yes	No	No	Yes	No
Amazon Athena	Yes	Yes	No	Yes	Yes	No
AWS Audit Manager	Yes	Yes	No	Yes	Yes	Yes
AWS Auto Scaling	Yes	No	No	No	Yes	Yes
AWS B2B Data Interchange	Yes	Yes	No	Yes	Yes	No
AWS Backup	Yes	Yes	Yes	Yes	Yes	Yes
AWS Backup Gateway	Yes	Yes	No	Yes	Yes	No
AWS Backup storage	Yes	No	No	No	Yes	No
AWS Batch	Yes	Partial	No	Yes	Yes	Yes
Amazon Bedrock	Yes	Yes	No	Yes	Yes	No
AWS Billing and Cost Management	Yes	No	No	No	Yes	No
AWS Billing and Cost Management Data Exports	Yes	Yes	No	Yes	Yes	No
AWS Billing Conductor	Yes	Yes	No	Yes	Yes	No
Amazon Braket	Yes	Yes	No	Yes	Yes	Yes
AWS Budget Service	Yes	Yes	No	No	No	No
AWS BugBust	Yes	Yes	No	Yes	Yes	Yes
AWS Certificate Manager (ACM)	Yes	Yes	No	Yes	Yes	Yes
AWS Chatbot	Yes	Yes	No	No	Yes	Yes
Amazon Chime	Yes	Yes	No	Yes	Yes	Yes
AWS Clean Rooms	Yes	Yes	No	Yes	Yes	No
AWS Clean Rooms ML	Yes	Yes	No	Yes	Yes	No
AWS Client VPN	Yes	Yes	No	No	Yes	Yes
AWS Cloud9	Yes	Yes	Yes	Yes	Yes	Yes
AWS Cloud Control API	Yes	No	No	No	Yes	No
Amazon Cloud Directory	Yes	Yes	No	No	Yes	No
AWS CloudFormation	Yes	Yes	No	Yes	Yes	No
Amazon CloudFront	Yes	Yes	No	Yes	Yes	Partial (Info)
Amazon CloudFront KeyValueStore	Yes	Yes	No	No	Yes	No
AWS CloudHSM	Yes	Yes	No	Yes	Yes	Yes
AWS Cloud Map	Yes	Yes	No	Yes	Yes	No
Amazon CloudSearch	Yes	Yes	No	No	Yes	No
AWS CloudShell	Yes	Yes	No	No	Yes	No
AWS CloudTrail	Yes	Yes	Partial (Info)	Yes	Yes	Yes
AWS CloudTrail Data	Yes	Yes	No	Yes	Yes	No
Amazon CloudWatch	Yes	Yes	No	Yes	Yes	Partial (Info)
Amazon CloudWatch Application Insights	Yes	No	No	No	Yes	No
Amazon CloudWatch Evidently	Yes	Yes	No	Yes	Yes	No
Amazon CloudWatch Internet Monitor	Yes	Yes	No	Yes	Yes	No
Amazon CloudWatch Logs	Yes	Yes	Yes	Partial	Yes	Yes
Amazon CloudWatch Observability Access Manager	Yes	Yes	No	Yes	Yes	No
Amazon CloudWatch RUM	Yes	Yes	No	Yes	Yes	No
Amazon CloudWatch Synthetics	Yes	Yes	No	Yes	Yes	No
AWS CodeArtifact	Yes	Yes	Yes	Yes	Yes	No
AWS CodeBuild	Yes	Yes	Yes (Info)	Partial (Info)	Yes	No
Amazon CodeCatalyst	Yes	Yes	No	Yes	Yes	Yes
AWS CodeCommit	Yes	Yes	No	Yes	Yes	No
AWS CodeDeploy	Yes	Yes	No	Yes	Yes	No
AWS CodeDeploy secure host commands service	Yes	No	No	No	Yes	No
Amazon CodeGuru Profiler	Yes	Yes	No	Yes	Yes	Yes
Amazon CodeGuru Reviewer	Yes	Yes	No	Yes	Yes	Yes
Amazon CodeGuru Security	Yes	Yes	No	Yes	Yes	No
AWS CodePipeline	Yes	Partial	No	Yes	Yes	No
AWS CodeStar	Yes	Partial	No	Yes	Yes	No
AWS CodeStar Connections	Yes	Yes	No	Yes	Yes	No
AWS CodeStar Notifications	Yes	Yes	No	Yes	Yes	Yes
Amazon CodeWhisperer	Yes	Yes	No	Yes	Yes	Yes
Amazon Cognito	Yes	Yes	No	Yes	Yes	Yes
Amazon Cognito Sync	Yes	Yes	No	No	Yes	Yes
Amazon Cognito user pools	Yes	Yes	No	Yes	Yes	Yes
Amazon Comprehend	Yes	Yes	No	Yes	Yes	No
Amazon Comprehend Medical	Yes	No	No	No	Yes	No
AWS Compute Optimizer	Yes	No	No	No	Yes	Yes
AWS Config	Yes	Partial (Info)	No	Yes	Yes	Yes
Amazon Connect	Yes	Yes	No	Yes	Yes	Yes
Amazon Connect Cases	Yes	Yes	No	Yes	Yes	No
Amazon Connect Customer Profiles	Yes	Yes	No	Yes	Yes	Yes
Amazon Connect High-volume outbound communications	Yes	Yes	No	Yes	Yes	No
Amazon Connect Voice ID	Yes	Yes	No	Yes	Yes	No
AWS Console Mobile Application	Yes	Yes	No	No	Yes	No
AWS Consolidated Billing	Yes	No	No	No	Yes	No
AWS Control Tower	Yes	Yes	No	No	Yes	No
AWS Cost and Usage Report	Yes	Yes	No	No	Yes	No
AWS Cost Explorer	Yes	Yes	No	Yes	Yes	No
AWS Cost Optimization Hub	Yes	No	No	No	Yes	No
AWS Customer Verification Service	Yes	No	No	No	Yes	No
AWS Database Migration Service	Yes	Yes	No (Info)	Yes	Yes	Yes
Database Query Metadata Service	Yes	No	No	No	Yes	No
AWS Data Exchange	Yes	Yes	No	Yes	Yes	No
Amazon Data Lifecycle Manager	Yes	Yes	No	Yes	Yes	No
AWS Data Pipeline	Yes	Yes	No	Partial	Yes	No
AWS DataSync	Yes	Yes	No	Yes	Yes	Yes
Amazon DataZone	Yes	No	No	No	Yes	No
AWS DeepComposer	Yes	Yes	No	Yes	Yes	No
AWS DeepLens	Yes	Yes	No	No	Yes	No
AWS DeepRacer	Yes	Yes	No	Yes	Yes	Yes
Amazon Detective	Yes	Yes	No	Yes	Yes	No
AWS Device Farm	Yes	Yes	No	Yes	Yes	Yes
Amazon DevOps Guru	Yes	Yes	No	No	Yes	Yes
AWS Diagnostic tools	Yes	Yes	No	Yes	Yes	No
AWS Direct Connect	Yes	Yes	No	Yes	Yes	Yes
AWS Directory Service	Yes	Yes	No	Yes	Yes	No
Amazon DocumentDB Elastic Clusters	Yes	Yes	No	Yes	Yes	No
Amazon DynamoDB Accelerator (DAX)	Yes	Yes	No	No	Yes	Yes
Amazon DynamoDB	Yes	Yes	No	No	Yes	No
Amazon Elastic Compute Cloud (Amazon EC2)	Yes	Partial	No	Yes	Yes	Partial (Info)
Amazon EC2 Auto Scaling	Yes	Yes	No	Yes	Yes	Yes
EC2 Image Builder	Yes	Yes	No	Yes	Yes	Yes
Amazon EC2 Instance Connect	Yes	Yes	No	No	Yes	Yes
Amazon ElastiCache	Yes	Yes	No	Yes	Yes	Yes
AWS Elastic Beanstalk	Yes	Partial	No	Yes	Yes	Yes
Amazon Elastic Block Store (Amazon EBS)	Yes	Partial	No	Yes	Yes	No
Amazon Elastic Container Registry (Amazon ECR)	Yes	Yes	Yes	Yes	Yes	Yes
Amazon Elastic Container Registry Public (Amazon ECR Public)	Yes	Yes	No	Yes	Yes	No
Amazon Elastic Container Service (Amazon ECS)	Yes	Partial (Info)	No	Yes	Yes	Yes
AWS Elastic Disaster Recovery	Yes	Yes	No	Yes	Yes	Yes
Amazon Elastic File System (Amazon EFS)	Yes	Yes	Yes	Partial	Yes	Yes
Amazon Elastic Inference	Yes	Yes	No	No	Yes	No
Amazon Elastic Kubernetes Service (Amazon EKS)	Yes	Yes	No	Yes	Yes	Yes
Amazon Elastic Kubernetes Service (Amazon EKS) Auth	Yes	Yes	No	No	Yes	No
AWS Elastic Load Balancing	Yes	Partial	No	Partial	Yes	Yes
Amazon Elastic Transcoder	Yes	Yes	No	No	Yes	No
AWS Elemental Appliances and Software Activation Service	Yes	Yes	No	Yes	Yes	No
AWS Elemental Appliances and Software	Yes	Yes	No	Yes	Yes	No
AWS Elemental MediaConnect	Yes	Yes	No	No	Yes	Yes
AWS Elemental MediaConvert	Yes	Yes	No	Yes	Yes	No
AWS Elemental MediaLive	Yes	Yes	No	Yes	Yes	No
AWS Elemental MediaPackage	Yes	Yes	No	Yes	Yes	Partial (Info)
AWS Elemental MediaPackage V2	Yes	Yes	No	Yes	Yes	No
AWS Elemental MediaPackage VOD	Yes	Yes	No	Yes	Yes	Partial (Info)
AWS Elemental MediaStore	Yes	Yes	Yes	Yes	Yes	No
AWS Elemental MediaTailor	Yes	Yes	No	Yes	Yes	Yes
AWS Elemental Support Cases	Yes	No	No	No	Yes	No
AWS Elemental Support Content	Yes	No	No	No	Yes	No
Amazon EMR	Yes	Yes	No	Yes	Yes	Yes
Amazon EMR on EKS	Yes	Yes	No	Yes	Yes	Yes
Amazon EMR Serverless	Yes	Yes	No	Yes	Yes	Yes
AWS Entity Resolution	Yes	Yes	No	Yes	Yes	No
Amazon EventBridge	Yes	Yes	Yes	Yes	Yes	No
Amazon EventBridge Pipes	Yes	Yes	No	Yes	Yes	No
Amazon EventBridge Scheduler	Yes	Yes	No	Yes	Yes	No
Amazon EventBridge Schemas	Yes	Yes	Yes	Yes	Yes	No
AWS Fault Injection Simulator	Yes	Yes	No	Yes	Yes	Yes
Amazon FinSpace	Yes	Yes	No	Yes	Yes	Yes
Amazon FinSpace API	Yes	Yes	No	No	Yes	No
AWS Firewall Manager	Yes	Yes	No	Yes	Yes	Partial
Fleet Hub for AWS IoT Device Management	Yes	Yes	No	Yes	Yes	No
Amazon Forecast	Yes	Yes	No	Yes	Yes	No
Amazon Fraud Detector	Yes	Yes	No	Yes	Yes	No
FreeRTOS	Yes	Yes	No	Yes	Yes	No
AWS Free Tier	Yes	No	No	No	Yes	No
Amazon FSx	Yes	Yes	No	Yes	Yes	Yes
Amazon GameLift	Yes	Yes	No	Yes	Yes	No
AWS Global Accelerator	Yes	Yes	No	Yes	Yes	Yes
AWS Glue	Yes	Yes	Yes	Partial	Yes	No
AWS Glue DataBrew	Yes	Yes	No	Yes	Yes	No
AWS Ground Station	Yes	Yes	No	Yes	Yes	Yes
Amazon Ground Truth Labeling	Yes	No	No	No	Yes	No
Amazon GuardDuty	Yes	Yes	No	Yes	Yes	Yes
AWS Health APIs And Notifications	Yes	Yes	No	No	Yes	No
AWS HealthImaging	Yes	Yes	No	Yes	Yes	No
AWS HealthLake	Yes	Yes	No	Yes	Yes	No
AWS HealthOmics	Yes	Yes	No	Yes	Yes	No
Amazon Honeycode	Yes	Yes	No	No	Yes	No
AWS IAM Identity Center	Yes	Yes	No	Partial	Yes	Yes
IAM Identity Center Directory	Yes	No	No	No	Yes	No
IAM Identity Center Identity Store	Yes	Yes	No	No	Yes	No
IAM Identity Center OIDC service	Yes	Yes	No	No	Yes	No
AWS Identity and Access Management (IAM)	Yes	Yes	Partial (Info)	Partial (Info)	Partial (Info)	No
AWS Identity and Access Management Access Analyzer	Yes	Yes	No	Yes	Yes	Partial
AWS Identity and Access Management Roles Anywhere	Yes	Yes	No	Yes	Yes	Yes
AWS Identity Store Auth	Yes	No	No	No	Yes	No
AWS Identity Sync	Yes	Yes	No	No	Yes	No
AWS Import/Export	Yes	No	No	No	Yes	No
Amazon Inspector	Yes	Yes	No	Yes	Yes	Yes
Amazon Inspector Classic	Yes	No	No	No	Yes	Yes
Amazon InspectorScan	Yes	No	No	No	Yes	No
Amazon Interactive Video Service	Yes	Yes	No	Yes	Yes	Yes
Amazon Interactive Video Service Chat	Yes	Yes	No	Yes	Yes	No
AWS Invoicing	Yes	No	No	No	Yes	No
AWS IoT 1-Click	Yes	Yes	No	Yes	Yes	No
AWS IoT Analytics	Yes	Yes	No	Yes	Yes	No
AWS IoT	Yes	Yes	Partial (Info)	Yes	Yes	No
AWS IoT Core Device Advisor	Yes	Yes	No	Yes	Yes	No
AWS IoT Device Tester	Yes	No	No	No	Yes	No
AWS IoT Events	Yes	Yes	No	Yes	Yes	No
AWS IoT FleetWise	Yes	Yes	No	Yes	Yes	No
AWS IoT Greengrass	Yes	Yes	No	Yes	Yes	No
AWS IoT Greengrass V2	Yes	Yes	No	Partial	Yes	No
AWS IoT Jobs DataPlane	Yes	Yes	No	No	Yes	No
AWS IoT RoboRunner	Yes	Yes	No	No	Yes	No
AWS IoT SiteWise	Yes	Yes	No	Yes	Yes	Yes
AWS IoT TwinMaker	Yes	Yes	No	Yes	Yes	No
AWS IoT Wireless	Yes	Yes	No	Yes	Yes	No
AWS IQ	Yes	Yes	No	No	Yes	Yes
AWS IQ Permissions	Yes	Yes	No	No	Yes	No
Amazon Kendra	Yes	Yes	No	Yes	Yes	No
Amazon Kendra Intelligent Ranking	Yes	Yes	No	Yes	Yes	No
AWS Key Management Service (AWS KMS)	Yes	Yes	Yes	Yes	Yes	Yes
Amazon Keyspaces (for Apache Cassandra)	Yes	Yes	No	Yes	Yes	Yes
Amazon Managed Service for Apache Flink	Yes	Yes	No	Yes	Yes	No
Amazon Managed Service for Apache Flink V2	Yes	Yes	No	Yes	Yes	No
Amazon Kinesis Data Firehose	Yes	Yes	No	Yes	Yes	No
Amazon Kinesis Data Streams	Yes	Yes	Yes	No	Yes	No
Amazon Kinesis Video Streams	Yes	Yes	No	Yes	Yes	No
AWS Lake Formation	Yes	No	No	No	Yes	Yes
AWS Lambda	Yes	Yes	Yes	Partial (Info)	Yes	Partial (Info)
AWS Launch Wizard	Yes	No	No	No	Yes	No
Amazon Lex	Yes	Yes	No	Yes	Yes	Yes
Amazon Lex V2	Yes	Yes	Yes	Yes	Yes	Yes
AWS License Manager	Yes	Yes	No	Yes	Yes	Yes
AWS License Manager Linux Subscriptions Manager	Yes	No	No	No	Yes	No
AWS License Manager User Subscriptions	Yes	No	No	No	Yes	Yes
Amazon Lightsail	Yes	Partial (Info)	No	Partial (Info)	Yes	Yes
Amazon Location Service	Yes	Yes	No	Yes	Yes	No
Amazon Lookout for Equipment	Yes	Yes	No	Yes	Yes	No
Amazon Lookout for Metrics	Yes	Yes	No	Yes	Yes	No
Amazon Lookout for Vision	Yes	Yes	No	Yes	Yes	No
Amazon Machine Learning	Yes	Yes	No	No	Yes	No
Amazon Macie	Yes	Yes	No	Yes	Yes	Yes
AWS Mainframe Modernization	Yes	Yes	No	Yes	Yes	Yes
Amazon Managed Blockchain	Yes	Yes	No	Yes	Yes	No
Amazon Managed Blockchain Query	Yes	No	No	No	Yes	No
Amazon Managed Grafana	Yes	Yes	No	Yes	Yes	Yes
Amazon Managed Service for Prometheus	Yes	Yes	No	Yes	Yes	No
Amazon Managed Streaming for Apache Kafka (MSK)	Yes	Yes	No	Yes	Yes	Yes
Amazon Managed Streaming for Kafka Connect	Yes	Yes	No	No	Yes	Yes
Amazon Managed Workflows for Apache Airflow	Yes	Yes	No	Yes	Yes	No
AWS Marketplace	Yes	No	No	No	Yes	Yes
AWS Marketplace Catalog	Yes	Yes	No	Yes	Yes	No
AWS Marketplace Commerce Analytics	Yes	No	No	No	No	No
AWS Marketplace Deployment Service	Yes	Yes	No	Yes	Yes	No
AWS Marketplace Discovery	Yes	No	No	No	Yes	No
AWS Marketplace Management Portal	Yes	No	No	No	Yes	No
AWS Marketplace Metering Service	Yes	No	No	No	Yes	No
AWS Marketplace Private Marketplace	Yes	No	No	No	Yes	No
AWS Marketplace Seller Reporting	Yes	Yes	No	No	Yes	No
AWS Marketplace Vendor Insights	Yes	Yes	No	Yes	Yes	No
Amazon Mechanical Turk	Yes	No	No	No	Yes	No
Amazon MediaImport	Yes	No	No	No	No	No
Amazon MemoryDB for Redis	Yes	Yes	No	Yes	Yes	Yes
Amazon Message Delivery Service	Yes	No	No	No	Yes	No
AWS Microservice Extractor for .NET	Yes	No	No	No	Yes	No
AWS Migration Acceleration Program Credits	Yes	Yes	No	No	Yes	No
AWS Migration Hub	Yes	Yes	No	No	Yes	Yes
AWS Migration Hub Orchestrator	Yes	Yes	No	Yes	Yes	No
AWS Migration Hub Refactor Spaces	Yes	Yes	Yes	Yes	Yes	Yes
AWS Migration Hub Strategy Recommendations	Yes	No	No	No	Yes	Yes
Amazon Monitron	Yes	Yes	No	Yes	Yes	Yes
Amazon MQ	Yes	Yes	No	Yes	Yes	Yes
Amazon Neptune	Yes	Yes	No	No	Yes	Yes
Amazon Neptune Analytics	Yes	Yes	No	Yes	Yes	No
AWS Network Firewall	Yes	Yes	No	Yes	Yes	Yes
AWS Network Manager	Yes	Yes	No	Yes	Yes	Yes (Info)
AWS Network Manager Chat	Yes	No	No	No	Yes	No
Amazon Nimble Studio	Yes	Yes	No	Yes	Yes	No
Amazon One Enterprise	Yes	Yes	No	Yes	Yes	No
Amazon OpenSearch Ingestion	Yes	Yes	No	Yes	Yes	Yes
Amazon OpenSearch Serverless	Yes	Yes	No	Yes	Yes	Yes
Amazon OpenSearch Service	Yes	Yes	Yes	Yes	Yes	Yes
AWS OpsWorks	Yes	Yes	No	No	Yes	No
AWS OpsWorks Configuration Management	Yes	Yes	No	No	Yes	No
AWS Organizations	Yes	Yes	No	Yes	No	Yes
AWS Outposts	Yes	Yes	No	Yes	Yes	Yes
AWS Panorama	Yes	Yes	No	Yes	Yes	Yes
AWS Partner Central account management	Yes	No	No	No	Yes	No
AWS Payment Cryptography	Yes	Yes	No	Yes	Yes	No
AWS Payments	Yes	No	No	No	Yes	No
AWS Performance Insights	Yes	Yes	No	No	Yes	No
Amazon Personalize	Yes	Yes	No	No	Yes	No
Amazon Pinpoint	Yes	Yes	No	Yes	Yes	No
Amazon Pinpoint Email Service	Yes	Yes	No	Yes	Yes	No
Amazon Pinpoint SMS and Voice Service	Yes	No	No	No	Yes	No
Amazon Pinpoint SMS and Voice Service V2	Yes	Yes	No	Yes	Yes	No
Amazon Polly	Yes	Yes	No	No	Yes	No
AWS Price List	Yes	No	No	No	Yes	No
AWS Private 5G	Yes	Yes	No	Yes	Yes	No
AWS Private CA Connector for Active Directory	Yes	Yes	No	Yes	Yes	No
AWS Private Certificate Authority (AWS Private CA)	Yes	Yes	Yes	Yes	Yes	No
AWS Proton	Yes	Yes	No	Yes	Yes	Yes
AWS Purchase Orders Console	Yes	Yes	No	Yes	Yes	No
Amazon Q	Yes	No	No	No	Yes	No
Amazon Q Business	Yes	Yes	No	Yes	Yes	No
Amazon Q in Connect	Yes	Yes	No	Yes	Yes	No
Amazon Quantum Ledger Database (Amazon QLDB)	Yes	Yes	No	Yes	Yes	No
Amazon QuickSight	Yes	Yes	No	Yes	Yes	No
Amazon RDS Data API	Yes	Yes	No	No	Yes	No
Amazon RDS IAM Authentication	Yes	Yes	No	No	Yes	No
AWS Recycle Bin	Yes	Yes	No	Yes	Yes	No
Amazon Redshift	Yes	Yes	No	Yes	Yes	Yes
Amazon Redshift Data API	Yes	Yes	No	No	Yes	No
Amazon Redshift Serverless	Yes	Yes	Yes	Yes	Yes	No
Amazon Rekognition	Yes	Yes	Partial (Info)	Yes	Yes	No
Amazon Relational Database Service (Amazon RDS) (Info)	Yes	Yes	No	Yes	Yes	Yes
AWS re:Post Private	Yes	Yes	No	Yes	Yes	Yes
AWS Resilience Hub	Yes	Yes	No	Yes	Yes	No
AWS Resource Access Manager (AWS RAM)	Yes	Yes	No	Yes	Yes	Yes
AWS Resource Explorer	Yes	Yes	No	Yes	Yes	Yes
AWS Resource Groups	Yes	Yes	No	Yes	Partial (Info)	No
AWS Resource Groups Tagging API	Yes	No	No	No	Yes	No
Amazon RHEL Knowledgebase Portal	Yes	No	No	No	Yes	No
AWS RoboMaker	Yes	Yes	No	Yes	Yes	Yes
Amazon Route 53	Yes	Yes	No	No	Yes	No
Amazon Route 53 Application Recovery Controller - Zonal Shift	Yes	Yes	No	No	Yes	No
Amazon Route 53 Domains	Yes	No	No	No	No	No
Amazon Route 53 Recovery Cluster	Yes	Yes	No	No	Yes	No
Amazon Route 53 Recovery Control Config	Yes	Yes	No	Yes	Yes	No
Amazon Route 53 Recovery Readiness	Yes	Yes	No	Yes	Yes	Yes
Amazon Route 53 Resolver	Yes	Yes	No	Yes	Yes	Yes
Amazon S3 Express	Yes	Yes	No	No	Yes	No
Amazon S3 Glacier	Yes	Yes	Yes	Yes	Yes	No
Amazon SageMaker	Yes	Yes	No	Yes	Yes	Partial (Info)
Amazon SageMaker geospatial capabilities	Yes	Yes	No	Yes	Yes	No
Amazon SageMaker Ground Truth Synthetic	Yes	No	No	No	Yes	No
AWS Savings Plans	Yes	Yes	No	Yes	Yes	No
AWS Secrets Manager	Yes	Yes	Yes	Yes	Yes	No
AWS Security Hub	Yes	Yes	No	Yes	Yes	Yes
Amazon Security Lake	Yes	Yes	No	No	Yes	Yes
AWS Security Token Service (AWS STS)	Yes	Partial (Info)	No	Yes	Partial (Info)	No
AWS Serverless Application Repository	Yes	Yes	Yes	No	Yes	No
AWS Service Catalog	Yes	Yes	No	Yes	Yes	Yes
Service Quotas	Yes	Yes	No	Yes	Yes	No
Amazon Session Manager Message Gateway Service	Yes	No	No	No	Yes	No
AWS Shield	Yes	Yes	No	Yes	Yes	Yes
AWS Signer	Yes	Yes	Yes	Yes	Yes	No
Amazon SimpleDB	Yes	Yes	No	No	Yes	No
Amazon Simple Email Service (Amazon SES) v2	Yes	Partial (Info)	Yes	Yes	Partial (Info)	No
Amazon Simple Notification Service (Amazon SNS)	Yes	Yes	Yes	Yes	Yes	No
Amazon Simple Queue Service (Amazon SQS)	Yes	Yes	Yes	Partial	Yes	No
Amazon Simple Storage Service (Amazon S3)	Yes	Yes	Yes	Partial (Info)	Yes	Partial (Info)
Amazon Simple Storage Service (Amazon S3) Object Lambda	Yes	Yes	No	No	Yes	No
Amazon Simple Storage Service (Amazon S3) on AWS Outposts	Yes	Yes	Yes	No	Yes	Yes
Amazon Simple Workflow Service (Amazon SWF)	Yes	Yes	No	Yes	Yes	No
AWS SimSpace Weaver	Yes	Yes	No	Yes	Yes	No
AWS Site-to-Site VPN	Yes	Yes	No	No	Yes	Yes
AWS Snowball	Yes	No	No	No	Yes	No
AWS Snowball Edge	Yes	No	No	No	Yes	No
AWS Snow Device Management	Yes	Yes	No	Yes	Yes	No
AWS SQL Workbench	Yes	Yes	No	Yes	Yes	No
AWS Step Functions	Yes	Yes	No	Yes	Yes	No
AWS Storage Gateway	Yes	Yes	No	Yes	Yes	No
AWS Supply Chain	Yes	Yes	No	Yes	Yes	No
AWS Support App in Slack	Yes	No	No	No	Yes	No
AWS Support	Yes	No	No	No	Yes	Yes
AWS Support Plans	Yes	No	No	No	Yes	No
AWS Sustainability	Yes	No	No	No	Yes	No
AWS Systems Manager	Yes	Yes	No	Yes	Yes	Yes
AWS Systems Manager for SAP	Yes	Yes	No	Yes	Yes	No
AWS Systems Manager GUI Connect	Yes	No	No	No	Yes	No
AWS Systems Manager Incident Manager	Yes	Yes	Yes	Yes	Yes	Yes
AWS Systems Manager Incident Manager Contacts	Yes	Yes	Yes	No	Yes	No
AWS Tax Settings	Yes	No	No	No	Yes	No
AWS Telco Network Builder	Yes	Yes	No	Yes	Yes	No
Amazon Textract	Yes	No	No	No	Yes	No
Amazon Timestream	Yes	Yes	No	Yes	Yes	No
AWS Tiros API (for Reachability Analyzer)	Yes	No	No	No	No	No
Amazon Transcribe	Yes	Yes	No	Yes	Yes	No
AWS Transfer Family	Yes	Yes	No	Yes	Yes	No
Amazon Translate	Yes	Yes	No	Yes	Yes	No
AWS Trusted Advisor	Partial (Info)	Yes	No	No	Partial	Yes
AWS User Notifications	Yes	Yes	No	Yes	Yes	Yes
AWS User Notifications Contacts	Yes	Yes	No	Yes	Yes	No
AWS Verified Access	Yes	No	No	No	Yes	No
Amazon Verified Permissions	Yes	Yes	No	No	Yes	No
Amazon Virtual Private Cloud (Amazon VPC)	Yes	Partial (Info)	Partial (Info)	Yes	Yes	Partial (Info)
Amazon VPC Lattice	Yes	Yes	No	Yes	Yes	No
Amazon VPC Lattice Services	Yes	Yes	No	No	Yes	No
AWS WAF	Yes	Yes	No	Yes	Yes	Yes
AWS WAF Classic	Yes	Yes	No	Yes	Yes	Yes
AWS WAF Regional	Yes	Yes	No	Yes	Yes	Yes
AWS Well-Architected Tool	Yes	Yes	No	Yes	Yes	No
AWS Wickr	Yes	Yes	No	Yes	Yes	No
Amazon WorkDocs	Yes	No	No	No	Yes	No
Amazon WorkMail	Yes	Yes	No	Yes	Yes	Yes
Amazon WorkMail Message Flow	Yes	Yes	No	No	Yes	No
Amazon WorkSpaces	Yes	Yes	No	Yes	Yes	No
Amazon WorkSpaces Application Manager	Yes	No	No	No	Yes	No
Amazon WorkSpaces Thin Client	Yes	Yes	No	Yes	Yes	No
Amazon WorkSpaces Web	Yes	Yes	No	Yes	Yes	Yes
AWS X-Ray	Yes	Partial (Info)	No	Partial (Info)	Yes	No

More information

Amazon CloudFront

CloudFront doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.

AWS CloudTrail

CloudTrail supports resource-based policies only on CloudTrail channels used for CloudTrail Lake integrations with event sources outside of AWS.

Amazon CloudWatch

CloudWatch service-linked roles cannot be created using the AWS Management Console, and support only the Alarm Actions feature.

AWS CodeBuild

CodeBuild supports cross-account resource sharing using AWS RAM.

CodeBuild supports ABAC for project-based actions.

AWS Config

AWS Config supports resource-level permissions for multi-account multi-Region data aggregation and AWS Config Rules. For a list of supported resources, see the Multi-Account Multi-Region Data Aggregation section and AWS Config Rules section of the AWS Config API Guide.

AWS Database Migration Service

You can create and modify policies that are attached to AWS KMS encryption keys you create to encrypt data migrated to supported target endpoints. The supported target endpoints include Amazon Redshift and Amazon S3. For more information, see Creating and Using AWS KMS Keys to Encrypt Amazon Redshift Target Data and Creating AWS KMS Keys to Encrypt Amazon S3 Target Objects in the AWS Database Migration Service User Guide.

Amazon Elastic Compute Cloud

Amazon EC2 service-linked roles can be used only for the following features: Spot Instance Requests, Spot Fleet Requests, Amazon EC2 Fleets, and Fast launching for Windows instances.

Amazon Elastic Container Service

Only some Amazon ECS actions support resource-level permissions.

AWS Elemental MediaPackage

MediaPackage supports service-linked roles for publishing customer access logs to CloudWatch but not for other API actions.

AWS Identity and Access Management

IAM supports only one type of resource-based policy called a role trust policy, which is attached to an IAM role. For more information, see Granting a user permissions to switch roles.

IAM supports tag-based access control for most IAM resources. For more information, see Tagging IAM resources.

Only some of the API actions for IAM can be called with temporary credentials. For more information, see Comparing your API options.

AWS IoT

Devices connected to AWS IoT are authenticated by using X.509 certificates or using Amazon Cognito Identities. You can attach AWS IoT policies to an X.509 certificate or Amazon Cognito Identity to control what the device is authorized to do. For more information, see Security and Identity for AWS IoT in the AWS IoT Developer Guide.

AWS Lambda

Lambda supports attribute-based access control (ABAC) for API actions that use a Lambda function as the required resource. Layers, event source mappings, and code signing config resources are not supported.

Lambda doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.

Amazon Lightsail

Lightsail partially supports resource-level permissions and ABAC. For more information, see Actions, resources, and condition keys for Amazon Lightsail.

AWS Network Manager

AWS Cloud WAN also supports service-linked roles. For more information, see AWS Cloud WAN service-linked roles in the Amazon VPC AWS Cloud WAN Guide.

Amazon Relational Database Service

Amazon Aurora is a fully managed relational database engine that's compatible with MySQL and PostgreSQL. You can choose the Aurora MySQL or Aurora PostgreSQL as the DB engine option when setting up new database servers through Amazon RDS. For more information, see Identity and access management for Amazon Aurora in the Amazon Aurora User Guide.

Amazon Rekognition

Resource-based policies are only supported for copying Amazon Rekognition Custom Labels models.

AWS Resource Groups

Users can assume a role with a policy that allows Resource Groups operations.

Amazon SageMaker

Service-linked roles are currently available for SageMaker Studio and SageMaker training jobs.

AWS Security Token Service

AWS STS does not have "resources," but does allow restricting access in a similar way to users. For more information, see Denying Access to Temporary Security Credentials by Name.

Only some of the API operations for AWS STS support calling with temporary credentials. For more information, see Comparing your API options.

Amazon Simple Email Service

You can only use resource-level permissions in policy statements that refer to actions related to sending email, such as ses:SendEmail or ses:SendRawEmail. For policy statements that refer to any other actions, the Resource element can only contain *.

Only the Amazon SES API supports temporary security credentials. The Amazon SES SMTP interface does not support SMTP credentials that are derived from temporary security credentials.

Amazon Simple Storage Service

Amazon S3 supports tag-based authorization for only object resources.

Amazon S3 supports service-linked roles for Amazon S3 Storage Lens.

AWS Trusted Advisor

API access to Trusted Advisor is through the AWS Support API and is controlled by AWS Support IAM policies.

Amazon Virtual Private Cloud

In an IAM user policy, you cannot restrict permissions to a specific Amazon VPC endpoint. Any Action element that includes the ec2:*VpcEndpoint* or ec2:DescribePrefixLists API actions must specify ""Resource": "*"". For more information, see Identity and access management for VPC endpoints and VPC endpoint services in the AWS PrivateLink Guide.

Amazon VPC supports attaching a single resource policy to a VPC endpoint to restrict what can be accessed through that endpoint. For more information about using resource-based policies to control access to resources from specific Amazon VPC endpoints, see Control access to services using endpoint policies in the AWS PrivateLink Guide.

Amazon VPC doesn't have service-linked roles, but AWS Transit Gateway does. For more information, see Use service-linked roles for transit gateway in the Amazon VPC AWS Transit Gateway Guide.

AWS X-Ray

X-Ray does not support resource-level permissions for all actions.

X-Ray supports tag-based access control for groups and sampling rules.