AWS services that work with IAM
The AWS services listed below are grouped by their AWS product categories
-
Service – You can choose the name of a service to view the AWS documentation about IAM authorization and access for that service.
-
Actions – You can specify individual actions in a policy. If the service does not support this feature, then All actions is selected in the visual editor. In a JSON policy document, you must use
*
in theAction
element. For a list of actions in each service, see Actions, Resources, and Condition Keys for AWS Services. -
Resource-level permissions – You can use ARNs to specify individual resources in the policy. If the service does not support this feature, then All resources is chosen in the policy visual editor. In a JSON policy document, you must use
*
in theResource
element. Some actions, such asList*
actions, do not support specifying an ARN because they are designed to return multiple resources. If a service supports this feature for some resources but not others, it is indicated by Partial in the table. See the documentation for that service for more information. -
Resource-based policies – You can attach resource-based policies to a resource within the service. Resource-based policies include a
Principal
element to specify which IAM identities can access that resource. For more information, see Identity-based policies and resource-based policies. -
Authorization based on tags – You can use resource tags in the condition of a policy to control access to a resource in the service. You do this using the aws:ResourceTag global condition key or service-specific tags, such as iam:ResourceTag. For more information about defining permissions based on attributes such as tags, see What is ABAC for AWS?.
-
Temporary credentials – You can use short-term credentials that you obtain when you sign in using IAM Identity Center, switch roles in the console, or that you generate using AWS STS in the AWS CLI or AWS API. You can access services with a No value only while using your long-term IAM user credentials. This includes a user name and password or your user access keys. For more information, see Temporary security credentials in IAM.
-
Service-linked roles – A service-linked role is a special type of service role that gives the service permission to access resources in other services on your behalf. Choose the
Yes
link to see the documentation for services that support these roles. This column does not indicate if the service uses standard service roles. For more information, see Using service-linked roles. -
More information – If a service doesn't fully support a feature, you can review the footnotes for an entry to view the limitations and links to related information.
Compute services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS App Runner | ||||||
AWS Batch | ||||||
Amazon Elastic Compute Cloud (Amazon EC2) | ||||||
Amazon EC2 Auto Scaling | ||||||
EC2 Image Builder | ||||||
Amazon EC2 Instance Connect | ||||||
AWS Elastic Beanstalk | ||||||
Amazon Elastic Inference | ||||||
Elastic Load Balancing | ||||||
AWS Lambda | ||||||
Amazon Lightsail |
||||||
AWS Outposts | ||||||
AWS Recycle Bin | ||||||
AWS Serverless Application Repository |
¹ Amazon EC2 service-linked roles can be used only for the following features: Spot Instance Requests, Spot Fleet Requests, Amazon EC2 Fleets, and Fast launching for Windows instances.
² AWS Lambda supports attribute-based access control (ABAC) for API actions that use a Lambda function as the required resource. Layers, event source mappings, and code signing config resources are not supported.
³ AWS Lambda doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.
⁴ Amazon Lightsail partially supports resource-level permissions and authorization based on tags. For more information, see Actions, resources, and condition keys for Amazon Lightsail.
Containers services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS App Runner | ||||||
Amazon Elastic Container Registry (Amazon ECR) | ||||||
Amazon Elastic Container Registry Public (Amazon ECR Public) | ||||||
Amazon Elastic Container Service (Amazon ECS) | ||||||
Amazon Elastic Kubernetes Service (Amazon EKS) |
¹ Only some Amazon ECS actions support resource-level permissions.
Storage services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Backup | ||||||
AWS Backup Gateway | ||||||
AWS Backup storage | ||||||
Amazon Elastic Block Store (Amazon EBS) | ||||||
AWS Elastic Disaster Recovery | ||||||
Amazon Elastic File System (Amazon EFS) | ||||||
Amazon FSx | ||||||
AWS Import/Export | ||||||
Amazon S3 Glacier | ||||||
Amazon Simple Storage Service (Amazon S3) | ||||||
Amazon Simple Storage Service (Amazon S3) on AWS Outposts | ||||||
Amazon Simple Storage Service (Amazon S3) Object Lambda | ||||||
AWS Snow Device Management | ||||||
AWS Snowball | ||||||
AWS Snowball Edge | ||||||
AWS Storage Gateway |
¹ Amazon S3 supports tag-based authorization for only object resources.
² Amazon S3 supports service-linked roles for Amazon S3 Storage Lens.
Database services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Database Query Metadata Service | ||||||
Amazon DynamoDB | ||||||
Amazon DynamoDB Accelerator (DAX) | ||||||
Amazon ElastiCache | ||||||
Amazon Keyspaces (for Apache Cassandra) | ||||||
Amazon MediaImport | ||||||
Amazon MemoryDB for Redis | ||||||
Amazon Neptune | ||||||
AWS Performance Insights | ||||||
Amazon Quantum Ledger Database (Amazon QLDB) | ||||||
Amazon Redshift | ||||||
Amazon Redshift Data API | ||||||
Amazon Redshift Serverless | ||||||
Amazon Relational Database Service (Amazon RDS) | ||||||
Amazon RDS Data API | ||||||
Amazon RDS IAM Authentication | ||||||
Amazon SimpleDB | ||||||
AWS SQL Workbench | ||||||
Amazon Timestream |
Developer tools services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Cloud9 | ||||||
AWS Cloud Control API | ||||||
AWS CloudShell | ||||||
AWS CodeArtifact | ||||||
AWS CodeBuild | ||||||
AWS CodeCommit | ||||||
AWS CodeDeploy | ||||||
AWS CodeDeploy secure host commands service | ||||||
AWS CodePipeline | ||||||
AWS CodeStar | ||||||
AWS CodeStar Connections | ||||||
AWS CodeStar Notifications | ||||||
AWS Fault Injection Simulator | ||||||
AWS Microservice Extractor for .NET | ||||||
AWS X-Ray |
¹ CodeBuild supports cross-account resource sharing using AWS RAM.
² CodeBuild supports authorization based on tags for project-based actions.
³ X-Ray does not support resource-level permissions for all actions.
⁴ X-Ray supports tag-based access control for groups and sampling rules.
Security, identity, and compliance services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Artifact | ||||||
AWS Audit Manager | ||||||
Amazon Cloud Directory | ||||||
Amazon Cognito | ||||||
Amazon Cognito Sync | ||||||
Amazon Cognito user pools | ||||||
Amazon Detective | ||||||
AWS Directory Service | ||||||
AWS Firewall Manager | ||||||
Amazon GuardDuty | ||||||
AWS IAM Identity Center (successor to AWS Single Sign-On) | ||||||
IAM Identity Center Directory | ||||||
IAM Identity Center Identity Store | ||||||
AWS Identity and Access Management (IAM) | ||||||
AWS Identity and Access Management Access Analyzer | ||||||
AWS Identity and Access Management Roles Anywhere | ||||||
AWS Identity Sync | ||||||
Amazon Inspector Classic | ||||||
Amazon Inspector | ||||||
Amazon Macie | ||||||
AWS Network Firewall | ||||||
AWS Resource Access Manager (AWS RAM) | ||||||
AWS Secrets Manager | ||||||
AWS Security Hub | ||||||
AWS Security Token Service (AWS STS) | ||||||
AWS Shield | ||||||
AWS WAF | ||||||
AWS WAF Classic | ||||||
AWS WAF Regional |
¹ IAM supports only one type of resource-based policy called a role trust policy, which is attached to an IAM role. For more information, see Granting a user permissions to switch roles.
² IAM supports tag-based access control for most IAM resources. For more information, see Tagging IAM resources.
³ Only some of the API actions for IAM can be called with temporary credentials. For more information, see Comparing your API options.
⁴ AWS STS does not have "resources," but does allow restricting access in a similar way to users. For more information, see Denying Access to Temporary Security Credentials by Name.
⁵ Only some of the API operations for AWS STS support calling with temporary credentials. For more information, see Comparing your API options.
Cryptography and PKI services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Certificate Manager (ACM) | ||||||
AWS Certificate Manager Private Certificate Authority (ACM) | ||||||
AWS CloudHSM | ||||||
AWS Key Management Service (AWS KMS) | ||||||
AWS Signer |
Machine learning services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS BugBust | ||||||
Amazon CodeGuru Profiler | ||||||
Amazon CodeGuru Reviewer | ||||||
Amazon Comprehend | ||||||
Amazon Comprehend Medical | ||||||
AWS DeepComposer | ||||||
AWS DeepLens | ||||||
AWS DeepRacer | ||||||
Amazon DevOps Guru | ||||||
Amazon Forecast | ||||||
Amazon Fraud Detector | ||||||
Ground Truth Labeling | ||||||
Amazon HealthLake | ||||||
Amazon Kendra | ||||||
Amazon Lex | ||||||
Amazon Lex V2 | ||||||
Amazon Lookout for Equipment | ||||||
Amazon Lookout for Metrics | ||||||
Amazon Lookout for Vision | ||||||
Amazon Machine Learning | ||||||
Amazon Monitron | ||||||
AWS Panorama | ||||||
Amazon Personalize | ||||||
Amazon Polly | ||||||
Amazon Rekognition | ||||||
Amazon SageMaker | ||||||
Amazon SageMaker Ground Truth Synthetic | ||||||
Amazon Textract | ||||||
Amazon Transcribe | ||||||
Amazon Translate |
¹ Service-linked roles are currently available for SageMaker Studio and SageMaker training jobs.
Management and governance services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Account Management | ||||||
Application Auto Scaling | ||||||
AWS AppConfig | ||||||
AWS Auto Scaling | ||||||
AWS Chatbot | ||||||
AWS CloudFormation | ||||||
AWS CloudTrail | ||||||
Amazon CloudWatch | ||||||
Amazon CloudWatch Application Insights | ||||||
Amazon CloudWatch Evidently | ||||||
Amazon CloudWatch Logs | ||||||
AWS CloudWatch RUM | ||||||
Amazon CloudWatch Synthetics | ||||||
AWS Compute Optimizer | ||||||
AWS Config | ||||||
AWS Control Tower | ||||||
Amazon Data Lifecycle Manager | ||||||
AWS Health APIs And Notifications | ||||||
AWS Launch Wizard | ||||||
AWS License Manager | ||||||
AWS License Manager User Subscriptions | ||||||
Amazon Managed Grafana | ||||||
Amazon Managed Service for Prometheus | ||||||
Amazon Message Delivery Service | ||||||
AWS OpsWorks | ||||||
AWS OpsWorks Configuration Management | ||||||
AWS Organizations | ||||||
AWS Proton | ||||||
AWS Resilience Hub | ||||||
AWS Resource Groups | ||||||
AWS Resource Groups Tagging API | ||||||
Amazon RHEL Knowledgebase Portal | ||||||
AWS Service Catalog | ||||||
Amazon Session Manager Message Gateway Service | ||||||
AWS Systems Manager | ||||||
AWS Systems Manager GUI Connect | ||||||
AWS Systems Manager Incident Manager | ||||||
AWS Systems Manager Incident Manager Contacts | ||||||
AWS Tag Editor | ||||||
AWS Trusted Advisor | ||||||
AWS Well-Architected Tool | ||||||
Service Quotas |
¹ Amazon CloudWatch service-linked roles cannot be created using the AWS Management Console, and support only the Alarm Actions feature.
² AWS Config supports resource-level permissions for multi-account multi-Region data aggregation and AWS Config Rules. For a list of supported resources, see the Multi-Account Multi-Region Data Aggregation section and AWS Config Rules section of AWS Config API Guide.
³ Users can assume a role with a policy that allows AWS Resource Groups operations.
⁴ API access to Trusted Advisor is through the AWS Support API and is controlled by AWS Support IAM policies.
Migration and transfer services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Application Discovery Service | ||||||
AWS Application Discovery Arsenal | ||||||
AWS Application Migration Service | ||||||
AWS Connector Service | ||||||
AWS Transfer Family | ||||||
AWS Database Migration Service | ||||||
AWS DataSync | ||||||
AWS Mainframe Modernization | ||||||
AWS Migration Hub | ||||||
AWS Migration Hub Orchestrator | ||||||
AWS Migration Hub Refactor Spaces | ||||||
AWS Migration Hub Strategy Recommendations | ||||||
AWS Server Migration Service |
¹ You can create and modify policies that are attached to AWS KMS encryption keys you create to encrypt data migrated to supported target endpoints. The supported target endpoints include Amazon Redshift and Amazon S3. For more information, see Creating and Using AWS KMS Keys to Encrypt Amazon Redshift Target Data and Creating AWS KMS Keys to Encrypt Amazon S3 Target Objects in the AWS Database Migration Service User Guide.
Mobile services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Amplify | ||||||
AWS Amplify Admin | ||||||
AWS Amplify UI Builder | ||||||
AWS AppSync | ||||||
AWS Device Farm | ||||||
Amazon Location Service |
Networking and content delivery services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon API Gateway | ||||||
Amazon API Gateway Management | ||||||
Amazon API Gateway Management V2 | ||||||
AWS Direct Connect | ||||||
AWS Global Accelerator | ||||||
AWS Network Manager | ||||||
AWS Private 5G | ||||||
Amazon Route 53 | ||||||
Amazon Route 53 Domains | ||||||
Amazon Route 53 Recovery Cluster | ||||||
Amazon Route 53 Recovery Control Config | ||||||
Amazon Route 53 Recovery Readiness | ||||||
Amazon Route 53 Resolver | ||||||
AWS Tiros API (for VPC Reachability Analyzer) | ||||||
Amazon Virtual Private Cloud (Amazon VPC) |
¹ In an IAM user policy, you cannot restrict permissions to a specific Amazon VPC
endpoint. Any Action
element that includes the ec2:*VpcEndpoint*
or
ec2:DescribePrefixLists
API actions must specify ""Resource":
"*"
". For more information, see Controlling the Use of
Endpoints in the Amazon VPC User Guide.
² Amazon VPC supports attaching a single resource policy to a VPC endpoint to restrict what can be accessed through that endpoint. For more information about using resource-based policies to control access to resources from specific Amazon VPC endpoints, see Using Endpoint Policies in the Amazon VPC User Guide.
³ Amazon CloudFront doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.
Media services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon Elastic Transcoder | ||||||
AWS Elemental Appliances and Software | ||||||
AWS Elemental Appliances and Software Activation Service | ||||||
AWS Elemental MediaConnect | ||||||
AWS Elemental MediaConvert | ||||||
AWS Elemental MediaLive | ||||||
AWS Elemental MediaPackage | ||||||
AWS Elemental MediaPackage VOD | ||||||
AWS Elemental MediaStore | ||||||
AWS Elemental MediaTailor | ||||||
AWS Elemental Support Cases | ||||||
AWS Elemental Support Content | ||||||
Amazon Interactive Video Service | ||||||
Amazon Interactive Video Service Chat | ||||||
Amazon Kinesis Video Streams | ||||||
Amazon Nimble Studio |
¹ MediaPackage supports service-linked roles for publishing customer access logs to CloudWatch but not for other API actions.
Analytics services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon Athena | ||||||
Amazon CloudSearch | ||||||
AWS Data Exchange | ||||||
AWS Data Pipeline | ||||||
Amazon OpenSearch Service | ||||||
Amazon EMR | ||||||
Amazon EMR on EKS | ||||||
Amazon EMR Serverless | ||||||
Amazon FinSpace | ||||||
AWS Glue | ||||||
AWS Glue DataBrew | ||||||
Amazon Kinesis Data Analytics | ||||||
Amazon Kinesis Data Analytics V2 | ||||||
Amazon Kinesis Data Firehose | ||||||
Amazon Kinesis Data Streams | ||||||
AWS Lake Formation | ||||||
Amazon Managed Streaming for Apache Kafka (MSK) | ||||||
Amazon Managed Streaming for Kafka Connect | ||||||
Apache Kafka APIs for Amazon MSK clusters | ||||||
Amazon Managed Workflows for Apache Airflow | ||||||
Amazon QuickSight |
Application integration services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon AppFlow | ||||||
Amazon EventBridge | ||||||
Amazon EventBridge Schemas | ||||||
Amazon MQ | ||||||
Amazon Simple Notification Service (Amazon SNS) | ||||||
Amazon Simple Queue Service (Amazon SQS) | ||||||
AWS Step Functions | ||||||
Amazon Simple Workflow Service (Amazon SWF) |
Business applications services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Alexa for Business | ||||||
Amazon Chime | ||||||
Amazon Honeycode | ||||||
Amazon WorkMail | ||||||
Amazon WorkMail Message Flow |
Satellite services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Ground Station |
Internet of Things services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
FreeRTOS | ||||||
AWS IoT | ||||||
AWS IoT 1-Click | ||||||
AWS IoT Analytics | ||||||
AWS IoT Core Device Advisor | ||||||
AWS IoT Core for LoRaWAN | ||||||
AWS IoT Device Tester | ||||||
AWS IoT Events | ||||||
Fleet Hub for AWS IoT Device Management | ||||||
AWS IoT FleetWise | ||||||
AWS IoT Greengrass | ||||||
AWS IoT Greengrass V2 | ||||||
AWS IoT Jobs DataPlane | ||||||
AWS IoT RoboRunner | ||||||
AWS IoT SiteWise | ||||||
AWS IoT Things Graph | ||||||
AWS IoT TwinMaker |
¹ Devices connected to AWS IoT are authenticated by using X.509 certificates or using Amazon Cognito Identities. You can attach AWS IoT policies to an X.509 certificate or Amazon Cognito Identity to control what the device is authorized to do. For more information, see Security and Identity for AWS IoT in the AWS IoT Developer Guide.
Robotics services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS RoboMaker |
Quantum Computing Services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon Braket |
Blockchain services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon Managed Blockchain |
Game development services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon GameLift | ||||||
Amazon GameSparks |
AR & VR services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon Sumerian |
Customer enablement services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS IQ | ||||||
AWS IQ Permissions | ||||||
AWS Support |
Customer engagement services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon AppIntegrations | ||||||
Amazon Connect | ||||||
Amazon Connect Cases | ||||||
Amazon Connect Customer Profiles | ||||||
Amazon Connect High-volume outbound communications | ||||||
Amazon Connect Voice ID | ||||||
Amazon Connect Wisdom | ||||||
Amazon Pinpoint | ||||||
Amazon Pinpoint Email Service | ||||||
Amazon Pinpoint SMS and Voice Service | ||||||
Amazon Pinpoint SMS and Voice Service v2 | ||||||
Amazon Simple Email Service (Amazon SES) v2 |
¹ You can only use resource-level permissions in policy statements that refer to
actions related to sending email, such as ses:SendEmail
or
ses:SendRawEmail
. For policy statements that refer to any other actions, the
Resource element can only contain *
.
² Only the Amazon SES API supports temporary security credentials. The Amazon SES SMTP interface does not support SMTP credentials that are derived from temporary security credentials.
End user computing services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
Amazon AppStream 2.0 | ||||||
Amazon WAM | ||||||
Amazon WorkDocs | ||||||
Amazon WorkSpaces | ||||||
Amazon WorkSpaces Application Manager | ||||||
Amazon WorkSpaces Web |
Billing and cost management services
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS Application Cost Profiler Service | ||||||
AWS Billing and Cost Management | ||||||
AWS Billing Conductor | ||||||
AWS Cost and Usage Report | ||||||
AWS Cost Explorer | ||||||
AWS Price List | ||||||
AWS Purchase Orders Console | ||||||
AWS Savings Plans | ||||||
AWS Sustainability | ||||||
AWS Tax Settings |
Additional resources
Service | Actions | Resource-level permissions | Resource-based policies | Authorization based on tags | Temporary credentials | Service-linked roles |
---|---|---|---|---|---|---|
AWS
Activate |
||||||
AWS Budget Service | ||||||
AWS Marketplace | ||||||
AWS Marketplace Catalog | ||||||
AWS Marketplace Commerce Analytics | ||||||
AWS Marketplace Management Portal | ||||||
AWS Marketplace Metering Service | ||||||
AWS Marketplace Private Marketplace | ||||||
AWS Marketplace Vendor Insights | ||||||
Amazon Mechanical Turk |