AssuranceServiceRolePolicy
Description: Allows AWS Assurance to access your resources for compliance assessments and evidence collection.
AssuranceServiceRolePolicy is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy details
-
Type: Service-linked role policy
-
Creation time: August 26, 2026, 21:07 UTC
-
Edited time: August 26, 2026, 21:07 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AssuranceServiceRolePolicy
Policy version
Policy version: v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AssuranceComplianceRead", "Effect" : "Allow", "Action" : [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAdjustmentTypes", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeAutoScalingNotificationTypes", "autoscaling:DescribeInstanceRefreshes", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLifecycleHookTypes", "autoscaling:DescribeLifecycleHooks", "autoscaling:DescribeLoadBalancerTargetGroups", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeMetricCollectionTypes", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribePolicies", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScalingProcessTypes", "autoscaling:DescribeScheduledActions", "autoscaling:DescribeTags", "autoscaling:DescribeTerminationPolicyTypes", "autoscaling:DescribeTrafficSources", "autoscaling:DescribeWarmPool", "bedrock-agentcore:GetAgentCard", "bedrock-agentcore:GetAgentRuntime", "bedrock-agentcore:GetAgentRuntimeEndpoint", "bedrock-agentcore:GetEvaluator", "bedrock-agentcore:GetGateway", "bedrock-agentcore:GetGatewayTarget", "bedrock-agentcore:GetMemory", "bedrock-agentcore:GetOnlineEvaluationConfig", "bedrock-agentcore:GetPolicy", "bedrock-agentcore:GetPolicyEngine", "bedrock-agentcore:GetResourcePolicy", "bedrock-agentcore:GetTokenVault", "bedrock-agentcore:GetWorkloadIdentity", "bedrock-agentcore:ListActors", "bedrock-agentcore:ListAgentRuntimeEndpoints", "bedrock-agentcore:ListAgentRuntimeVersions", "bedrock-agentcore:ListAgentRuntimes", "bedrock-agentcore:ListApiKeyCredentialProviders", "bedrock-agentcore:ListBrowserProfiles", "bedrock-agentcore:ListBrowserSessions", "bedrock-agentcore:ListBrowsers", "bedrock-agentcore:ListCodeInterpreterSessions", "bedrock-agentcore:ListCodeInterpreters", "bedrock-agentcore:ListEvaluators", "bedrock-agentcore:ListEvents", "bedrock-agentcore:ListGatewayTargets", "bedrock-agentcore:ListGateways", "bedrock-agentcore:ListMemories", "bedrock-agentcore:ListMemoryExtractionJobs", "bedrock-agentcore:ListMemoryRecords", "bedrock-agentcore:ListOauth2CredentialProviders", "bedrock-agentcore:ListOnlineEvaluationConfigs", "bedrock-agentcore:ListPolicies", "bedrock-agentcore:ListPolicyEngines", "bedrock-agentcore:ListSessions", "bedrock-agentcore:ListTagsForResource", "bedrock-agentcore:ListWorkloadIdentities", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentCollaborator", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentMemory", "bedrock:GetAgentVersion", "bedrock:GetCustomModel", "bedrock:GetDataSource", "bedrock:GetFlow", "bedrock:GetFlowAlias", "bedrock:GetFlowExecution", "bedrock:GetFlowVersion", "bedrock:GetFoundationModel", "bedrock:GetGuardrail", "bedrock:GetIngestionJob", "bedrock:GetInvocationStep", "bedrock:GetKnowledgeBase", "bedrock:GetModelInvocationLoggingConfiguration", "bedrock:GetPrompt", "bedrock:GetSession", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentCollaborators", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions", "bedrock:ListAgents", "bedrock:ListAutomatedReasoningPolicies", "bedrock:ListBlueprints", "bedrock:ListCustomModels", "bedrock:ListDataSources", "bedrock:ListEvaluationJobs", "bedrock:ListFlowAliases", "bedrock:ListFlowExecutionEvents", "bedrock:ListFlowExecutions", "bedrock:ListFlowVersions", "bedrock:ListFlows", "bedrock:ListFoundationModels", "bedrock:ListGuardrails", "bedrock:ListIngestionJobs", "bedrock:ListInvocationSteps", "bedrock:ListInvocations", "bedrock:ListKnowledgeBases", "bedrock:ListPrompts", "bedrock:ListSessions", "bedrock:ListTagsForResource", "bedrock:ValidateFlowDefinition", "cloudformation:GetResource", "cloudformation:ListResources", "cloudformation:ListStackResources", "cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetQueryResults", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListChannels", "cloudtrail:ListDashboards", "cloudtrail:ListEventDataStores", "cloudtrail:ListTags", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudtrail:StartQuery", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListDashboards", "cloudwatch:ListMetrics", "config:DescribeComplianceByConfigRule", "config:DescribeConfigRules", "config:DescribeConfigurationAggregators", "config:DescribeConfigurationRecorderStatus", "config:DescribeConformancePacks", "config:DescribeOrganizationConformancePacks", "config:GetComplianceDetailsByConfigRule", "config:SelectResourceConfig", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeFlowLogs", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshotAttribute", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeTransitGateways", "ec2:DescribeVolumeAttribute", "ec2:DescribeVolumes", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEncryptionControls", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecr:DescribeImageScanFindings", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRegistryScanningConfiguration", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:ListTagsForResource", "ecs:DescribeCapacityProviders", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeDaemon", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTaskSets", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListDaemons", "ecs:ListServices", "ecs:ListTagsForResource", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "eks:DescribeAccessEntry", "eks:DescribeAddon", "eks:DescribeAddonVersions", "eks:DescribeCapability", "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeIdentityProviderConfig", "eks:DescribeNodegroup", "eks:DescribePodIdentityAssociation", "eks:DescribeUpdate", "eks:ListAccessEntries", "eks:ListAddons", "eks:ListAssociatedAccessPolicies", "eks:ListCapabilities", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListIdentityProviderConfigs", "eks:ListNodegroups", "eks:ListPodIdentityAssociations", "eks:ListTagsForResource", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystemPolicy", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeLifecycleConfiguration", "elasticfilesystem:DescribeMountTargetSecurityGroups", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:ListTagsForResource", "events:ListTagsForResource", "events:DescribeEventBus", "guardduty:DescribeOrganizationConfiguration", "guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:GetFindings", "guardduty:GetMalwareProtectionPlan", "guardduty:GetMasterAccount", "guardduty:GetMemberDetectors", "guardduty:GetMembers", "guardduty:ListDetectors", "guardduty:ListFilters", "guardduty:ListFindings", "guardduty:ListIPSets", "guardduty:ListMembers", "guardduty:ListOrganizationAdminAccounts", "guardduty:ListTagsForResource", "guardduty:ListThreatEntitySets", "guardduty:ListThreatIntelSets", "guardduty:ListTrustedEntitySets", "iam:GenerateCredentialReport", "iam:GetAccessKeyLastUsed", "iam:GetAccountPasswordPolicy", "iam:GetAccountSummary", "iam:GetCredentialReport", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser", "iam:ListInstanceProfiles", "iam:ListMFADevices", "iam:ListPolicies", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListServerCertificates", "iam:ListUserPolicies", "iam:ListUsers", "iam:ListVirtualMFADevices", "kms:DescribeKey", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeys", "kms:ListResourceTags", "lambda:GetFunction", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:ListAliases", "lambda:ListCapacityProviders", "lambda:ListEventSourceMappings", "lambda:ListFunctionEventInvokeConfigs", "lambda:ListFunctionUrlConfigs", "lambda:ListFunctions", "lambda:ListLayerVersions", "lambda:ListLayers", "lambda:ListTags", "lambda:ListVersionsByFunction", "logs:DescribeDeliveryDestinations", "logs:DescribeDeliverySources", "logs:DescribeDestinations", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeMetricFilters", "logs:DescribeQueryDefinitions", "logs:DescribeResourcePolicies", "logs:DescribeSubscriptionFilters", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "logs:GetQueryResults", "logs:StartQuery", "rds:DescribeDBClusterParameterGroups", "rds:DescribeDBClusterParameters", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "rds:DescribeDBParameterGroups", "rds:DescribeDBParameters", "rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBShardGroups", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:DescribeEventSubscriptions", "rds:ListTagsForResource", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetView", "resource-explorer-2:ListViews", "resource-explorer-2:Search", "s3:GetAccountPublicAccessBlock", "s3:GetBucketAbac", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketMetadataTableConfiguration", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetBucketWebsite", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetReplicationConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "securityhub:BatchGetSecurityControls", "securityhub:DescribeHub", "securityhub:GetEnabledStandards", "securityhub:GetFindings", "securityhub:ListSecurityControlDefinitions", "tag:GetResources" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ApiGatewayRead", "Effect" : "Allow", "Action" : [ "apigateway:GET" ], "Resource" : [ "arn:aws:apigateway:*::/account", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/usageplans", "arn:aws:apigateway:*::/usageplans/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "OrganizationsTopologyRead", "Effect" : "Allow", "Action" : [ "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListDelegatedAdministrators", "organizations:ListParents" ], "Resource" : "*" }, { "Sid" : "AssuranceConfigurationRecorderManagement", "Effect" : "Allow", "Action" : [ "config:DeleteServiceLinkedConfigurationRecorder", "config:DescribeConfigurationRecorders", "config:PutServiceLinkedConfigurationRecorder" ], "Resource" : "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForAssurance/*" }, { "Sid" : "AWSConfigServiceLinkedRole", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "config.amazonaws.com" } } }, { "Sid" : "AssurancePolicy", "Effect" : "Allow", "Action" : [ "assurance:CreateComment", "assurance:DownloadEvidence", "assurance:GetAssessment", "assurance:GetComment", "assurance:GetControl", "assurance:GetEnvironment", "assurance:GetEvidence", "assurance:GetProject", "assurance:GetTask", "assurance:ListAssessmentAnnotations", "assurance:ListAssessments", "assurance:ListComments", "assurance:ListControls", "assurance:ListDiscoveredResources", "assurance:ListEnabledFrameworks", "assurance:ListEvidence", "assurance:ListEvidenceAnnotations", "assurance:ListProjects", "assurance:ListTasks", "assurance:StartResourceDiscovery", "assurance:UpdateTask", "assurance:UploadEvidence" ], "Resource" : "arn:*:assurance:*:*:environment/*" } ] }
Learn more
