AgentRegistryFullAccess
Description: Provides full access to AWS Agent Registry
AgentRegistryFullAccess is an AWS managed policy.
Using this policy
You can attach AgentRegistryFullAccess to your users, groups, and roles.
Policy details
-
Type: AWS managed policy
-
Creation time: August 06, 2026, 18:12 UTC
-
Edited time: August 31, 2026, 17:07 UTC
-
ARN:
arn:aws:iam::aws:policy/AgentRegistryFullAccess
Policy version
Policy version: v2 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AgentRegistryFullAccess", "Effect" : "Allow", "Action" : "agent-registry:*", "Resource" : "arn:aws:agent-registry:*:*:*" }, { "Sid" : "AgentRegistryPassRoleAccess", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "agent-registry.amazonaws.com" } } }, { "Sid" : "AgentRegistryWorkloadIdentityAccess", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:CreateWorkloadIdentity", "bedrock-agentcore:DeleteWorkloadIdentity", "bedrock-agentcore:GetWorkloadAccessToken", "bedrock-agentcore:GetWorkloadIdentity" ], "Resource" : "arn:aws:bedrock-agentcore:*:*:workload-identity-directory/*" }, { "Sid" : "AllowGetResourceOauth2TokenForOauthBasedSynchronization", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:GetResourceOauth2Token" ], "Resource" : [ "arn:aws:bedrock-agentcore:*:*:credential-provider/*", "arn:aws:bedrock-agentcore:*:*:workload-identity-directory/*", "arn:aws:bedrock-agentcore:*:*:token-vault/*/oauth2credentialprovider/*" ] }, { "Sid" : "AllowListOauth2CredentialsProvidersForConsolePicker", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:ListOauth2CredentialProviders" ], "Resource" : "arn:aws:bedrock-agentcore:*:*:*" }, { "Sid" : "IAMListAccess", "Effect" : "Allow", "Action" : [ "iam:ListRoles" ], "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "AgentRegistryKMSDecryptKeyForSynchronization", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "AgentRegistryKMSDescribeKey", "Effect" : "Allow", "Action" : [ "kms:DescribeKey" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringLike" : { "kms:ViaService" : "agent-registry.*.amazonaws.com" } } }, { "Sid" : "AgentRegistryKMSCryptoOps", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:ReEncryptFrom", "kms:ReEncryptTo" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringLike" : { "kms:ViaService" : "agent-registry.*.amazonaws.com", "kms:EncryptionContext:aws:agent-registry:registry-arn" : "arn:aws:agent-registry:*:*:registry/*" } } }, { "Sid" : "AgentRegistryKMSCreateGrant", "Effect" : "Allow", "Action" : "kms:CreateGrant", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringLike" : { "kms:ViaService" : "agent-registry.*.amazonaws.com" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "Encrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "DescribeKey", "CreateGrant" ] }, "Null" : { "kms:GrantOperations" : "false" } } }, { "Sid" : "AgentRegistrySecretsManagerAccess", "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:*" }, { "Sid" : "AgentRegistryServiceLinkedRoleAccess", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry", "Condition" : { "StringLike" : { "iam:AWSServiceName" : "agent-registry.amazonaws.com" } } } ] }
Learn more
