Inline policies

Inline policies are policies that you create and manage and embed directly into a single user, group, or role. The following policy examples show how to assign permissions to perform ACM actions. For more information about attaching inline policies, see Working with Inline Policies in the IAM User Guide. You can use the AWS Management Console, the AWS Command Line Interface (AWS CLI), or the IAM API to create and embed inline policies.

Listing certificates

The following policy allows a user to list all of the ACM certificates in the user's account.

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":"acm:ListCertificates",
         "Resource":"*"
      }
   ]
}

Note

This permission is required for ACM certificates to appear in the Elastic Load Balancing and CloudFront consoles.

Retrieving a certificate

The following policy allows a user to retrieve a specific ACM certificate.

{
   "Version":"2012-10-17",
   "Statement":{
      "Effect":"Allow",
      "Action":"acm:GetCertificate",
      "Resource":"arn:aws:acm:region:account:certificate/certificate_ID"
   }
}

Importing a certificate

The following policy allows a user to import a certificate.

{
   "Version":"2012-10-17",
   "Statement":{
      "Effect":"Allow",
      "Action":"acm:ImportCertificate",
      "Resource":"arn:aws:acm:region:account:certificate/certificate_ID"
   }
}

Deleting a certificate

The following policy allows a user to delete a specific ACM certificate.

{
   "Version":"2012-10-17",
   "Statement":{
      "Effect":"Allow",
      "Action":"acm:DeleteCertificate",
      "Resource":"arn:aws:acm:region:account:certificate/certificate_ID"
   }
}

Read-only access to ACM

The following policy allows a user to describe and list an ACM certificate and to retrieve the ACM certificate and certificate chain.

{
   "Version":"2012-10-17",
   "Statement":{
      "Effect":"Allow",
      "Action":[
         "acm:DescribeCertificate",
         "acm:ListCertificates",
         "acm:GetCertificate",
         "acm:ListTagsForCertificate"
      ],
      "Resource":"*"
   }
}

Note

This policy is available as an AWS managed policy in the AWS Management Console. For more information, see AWSCertificateManagerReadOnly. To view the managed policy in the console, go to https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly.

Full access to ACM

The following policy allows a user to perform any ACM action.

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "acm:*"
         ],
         "Resource":"*"
      }
   ]
}

Note

This policy is available as an AWS managed policy in the AWS Management Console. For more information, see AWSCertificateManagerFullAccess. To view the managed policy in the console, go to https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess.

Administrator access to all AWS resources

The following policy allows a user to perform any action on any AWS resource.

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":"*",
         "Resource":"*"
      }
   ]
}

Note

This policy is available as an AWS managed policy in the AWS Management Console. To view the managed policy in the console, go to https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/AdministratorAccess.