AWS Identity and Access Management (IAM)

Amazon S3

IAM integrates with Amazon S3 to manage access to buckets and objects. Policies can be used to restrict who can read, write, or delete objects.

Amazon EC2

IAM allows you to create and manage permissions to control who can launch, terminate, and manage EC2 instances and their associated resources.

AWS Lambda

IAM integrates with AWS Lambda to manage permissions for invoking functions and accessing other AWS resources from within Lambda functions.

Amazon RDS

IAM manages access to Amazon RDS databases, allowing you to control who can create, modify, and delete databases, as well as manage database security groups.

Amazon DynamoDB

IAM controls access to Amazon DynamoDB tables and items, enabling fine-grained security permissions for accessing the database.

Amazon API Gateway

IAM policies control who can manage APIs and invoke methods configured for AWS_IAM authorization. Clients sign requests with AWS credentials, and API Gateway evaluates their permissions before accepting them.

Amazon AppFlow

IAM policies control access to AppFlow flows and connectors. IAM roles and resource policies authorize flows to read or write AWS destinations such as S3.

Amazon Athena

IAM policies govern who can run Athena queries and use particular workgroups and data catalogs. Querying data also requires permissions for the underlying data and query-result locations.

Amazon Augmented AI (Amazon A2I)

IAM controls access to human review workflows and grants their execution roles permission to access input data and store review results. Administrators can also restrict who may create or start human loops.

Amazon Aurora

IAM policies govern Aurora cluster administration, and supported Aurora engines offer IAM database authentication. Applications can use short-lived authentication tokens instead of stored database passwords.

Amazon Aurora Serverless

IAM controls management of Aurora Serverless clusters and access through the RDS Data API on supported configurations. Data API callers need permissions to execute database operations and access the associated Secrets Manager secret.

IAM policies determine which Bedrock models, agents, knowledge bases, and other resources a principal can use or manage. Bedrock service roles grant features such as knowledge bases permission to access their data sources and supporting resources.

IAM controls access to AgentCore resources and authorizes supported runtime invocations. AgentCore runtime execution roles define which AWS resources a hosted agent can access.

Amazon Braket

IAM policies determine who can submit quantum tasks, manage hybrid jobs, and access Braket resources. Hybrid jobs use execution roles to access resources such as input data and output locations.

Amazon CloudFront

IAM controls who can create or change CloudFront distributions and related resources. Administrators can restrict permissions to particular distributions or separate deployment permissions from read-only access.

Amazon CloudSearch

IAM policies control CloudSearch domain administration and can authorize signed requests to document and search endpoints. Domain access policies can grant access to specified IAM principals.

Amazon CloudWatch

IAM policies restrict access to CloudWatch metrics, alarms, dashboards, and logs. CloudWatch features also use IAM roles where they need permission to deliver data or perform configured actions.

Amazon CodeGuru

IAM controls access to CodeGuru code reviews, repository associations, and profiling groups. Applications submitting profiling data can receive narrowly scoped permissions to publish to a particular profiling group.

Amazon CodeWhisperer

IAM policies control administrative operations for CodeWhisperer profiles and customizations. These permissions are separate from the workforce sign-in used by developers receiving code suggestions.

Amazon Cognito

IAM roles define the AWS permissions granted to authenticated and guest users through Cognito identity pools. Role trust policies restrict which identities may obtain temporary credentials.

Amazon Comprehend

IAM controls access to Comprehend analysis operations, custom models, and endpoints. Asynchronous jobs use IAM service roles to read input documents and write analysis results.

Amazon Connect

IAM policies govern administration of Connect instances and access to Connect APIs. Connect also uses service-linked roles to access AWS resources needed for features such as logging and integrations.

Amazon Data Firehose

IAM policies control delivery stream administration and who can submit records. Firehose assumes an IAM role to read supported sources, invoke transformations, and deliver records to configured destinations.

IAM policies govern access to DataZone domains and management APIs. DataZone uses service and environment roles to provision environments and manage access to underlying data resources.

Amazon Detective

IAM policies determine who can manage Detective behavior graphs and investigate their findings. Detective uses a service-linked role for supported integration operations.

Amazon DevOps Guru

IAM controls access to DevOps Guru insights and configuration. Its service-linked role allows it to analyze supported operational data and resource information.

Amazon DocumentDB (with MongoDB compatibility)

IAM policies control who can create, modify, or delete DocumentDB clusters and instances. Supported DocumentDB configurations also allow database authentication with IAM identities.

Amazon EC2 Auto Scaling

IAM policies restrict management of Auto Scaling groups, scaling policies, and instance refreshes. Auto Scaling uses service-linked roles to launch and manage instances on behalf of a group.

Amazon ECS Anywhere

IAM roles authorize external ECS instances to register with and communicate with ECS. Task roles provide separate AWS permissions to workloads running on those external instances.

Amazon Elastic Block Store (Amazon EBS)

IAM policies control actions on EBS volumes and snapshots, including creation, attachment, deletion, and snapshot sharing. Tag-based conditions can restrict administrators to volumes belonging to a particular application.

Amazon Elastic Container Registry (Amazon ECR)

IAM policies and ECR repository policies determine who can push, pull, and manage container images. IAM permissions also control retrieval of the authorization tokens used by container clients.

Amazon Elastic Container Service (Amazon ECS)

IAM task roles give each ECS task its own AWS permissions, while task execution roles authorize operations such as pulling images and sending logs. IAM also controls who can deploy services or pass roles to tasks.

Amazon Elastic File System (Amazon EFS)

IAM identity policies and EFS file system policies can authorize NFS clients using IAM authentication. Permissions distinguish mounting, writing, and root access, and can require a particular access point.

Amazon Elastic Kubernetes Service (Amazon EKS)

IAM principals can receive Kubernetes access through EKS access entries. EKS Pod Identity and IAM roles for service accounts give pods scoped AWS permissions without embedding long-term credentials.

Amazon ElastiCache

IAM policies control ElastiCache administration, and supported Valkey and Redis OSS configurations offer IAM authentication for cache connections. Applications can authenticate with short-lived tokens tied to authorized IAM identities.

Amazon EMR

IAM service roles and instance profiles authorize EMR to provision cluster resources and access workload data. EMR Serverless and EMR on EKS use execution roles to define the AWS permissions available to jobs.

Amazon EventBridge

IAM policies control event buses, rules, schedules, and event publication. EventBridge assumes configured execution roles for supported targets, and rules can match IAM API activity delivered through CloudTrail.

Amazon Forecast

IAM policies control access to Forecast datasets, predictors, and forecasts. Forecast assumes an IAM role to import training data and export forecast results.

Amazon Fraud Detector

IAM policies govern Fraud Detector models, detectors, and prediction operations. Service roles authorize access to training datasets and supported external model resources.

Amazon FSx

IAM policies control creation and management of FSx file systems, backups, and related resources. FSx uses service-linked roles to manage supporting AWS resources such as network interfaces.

Amazon GameLift

IAM controls access to GameLift fleets, builds, aliases, and game-session management APIs. Fleet IAM roles can supply temporary AWS credentials to game server processes.

Amazon GuardDuty

IAM policies govern GuardDuty detectors, findings, and protection settings. GuardDuty uses service-linked roles to access supported data sources and perform threat-detection operations.

Amazon HealthLake

IAM policies control HealthLake data stores and access to their APIs. Import and export jobs use IAM roles to read and write data in S3.

Amazon Inspector

IAM policies determine who can enable Inspector scanning and access vulnerability findings. Inspector service-linked roles authorize discovery and scanning of supported AWS resources.

Amazon Kendra

IAM policies control access to Kendra indexes and search APIs. Kendra assumes service roles to crawl data sources, access documents, and write operational logs.

Amazon Keyspaces (for Apache Cassandra)

IAM policies authorize Keyspaces operations at the keyspace and table level. Cassandra clients can use the SigV4 authentication plugin to connect with IAM credentials instead of service-specific credentials.

Amazon Kinesis Data Streams

IAM policies control stream administration and permissions to publish or consume records. Stream resource policies can grant access to IAM principals in another AWS account.

Amazon Kinesis Video Streams

IAM policies determine who can create video streams and publish or retrieve their media. Resource-scoped permissions can separate camera upload access from playback access.

Amazon Lex

IAM policies control Lex bot administration and runtime conversations. Lex uses service-linked roles for supported operations and integrations.

Amazon Lightsail

IAM policies control access to Lightsail instances, databases, snapshots, and other resources. Administrators can separate read-only visibility from permissions to create or delete resources.

Amazon Location Service

IAM policies authorize access to Location maps, trackers, geofence collections, and other resources. Applications can use temporary credentials to make signed requests within those permissions.

Amazon Macie

IAM policies govern Macie configuration, classification jobs, and access to findings. Macie uses a service-linked role to inspect S3 resources and discover sensitive data.

Amazon Managed Blockchain

IAM policies control Managed Blockchain networks, members, nodes, and supported blockchain API access. Managed Blockchain Access endpoints use SigV4-signed requests to authenticate callers.

Amazon Managed Grafana

IAM controls workspace administration and the AWS permissions available to Grafana data sources. Workspace roles can grant access to metrics and logs in the same account or across accounts.

Amazon Managed Service for Apache Flink

IAM policies control Flink application administration. Applications run with service execution roles that authorize access to configured streams, storage, logs, and other AWS resources.

Amazon Managed Service for Prometheus

IAM policies control workspace management and access to metric ingestion and query APIs. Collectors and query clients use SigV4-signed requests with authorized IAM credentials.

Amazon Managed Streaming for Apache Kafka

IAM policies control MSK cluster administration and can authorize Kafka client connections when IAM access control is enabled. Policies can restrict clients to particular topics, consumer groups, and Kafka operations.

Amazon Managed Workflows for Apache Airflow (Amazon MWAA)

IAM controls MWAA environment management and access to Airflow interfaces. An environment execution role defines the AWS resources its workflows and supporting components can access.

Amazon MemoryDB for Redis

IAM policies control MemoryDB clusters, users, and access control lists. Supported engine versions also allow clients to authenticate with short-lived IAM authentication tokens.

Amazon Monitron

IAM policies govern administrative access to Monitron projects and associated resources. Monitron also uses a service-linked role for operations required by the service.

Amazon MQ

IAM policies control broker creation, configuration, and other Amazon MQ management operations. These permissions are separate from the broker credentials used by messaging clients.

Amazon Neptune

IAM policies control Neptune administration and can authorize database requests when IAM database authentication is enabled. Clients sign requests with AWS credentials to access the graph.

Amazon OpenSearch Service

IAM policies and domain access policies control OpenSearch Service administration and access to domain endpoints. With fine-grained access control, IAM roles can be mapped to OpenSearch roles for index-level permissions.

Amazon Personalize

IAM policies control Personalize datasets, training resources, and recommendation APIs. Personalize assumes service roles to import training data and access supporting AWS resources.

Amazon Polly

IAM policies determine who can synthesize speech and manage pronunciation lexicons. Permissions can also restrict access to asynchronous speech-synthesis tasks.

IAM policies control access to supported Amazon Q operations. For Amazon Q Developer, administrators can use IAM permissions to govern capabilities such as chat and inline suggestions.

IAM policies control Q Business applications, indexes, retrievers, and other management resources. Service roles authorize document ingestion and access to configured data sources.

Amazon QuickSight

IAM policies control QuickSight administration and API access, including embedding operations. QuickSight service roles authorize access to AWS data sources used by datasets.

IAM policies can require applications to authenticate to RDS Proxy with IAM credentials. The proxy uses an IAM role to retrieve database credentials from Secrets Manager when configured for secret-based backend authentication.

Amazon Redshift

IAM roles authorize Redshift to load, unload, and query data in other AWS services. IAM identities can also obtain temporary database credentials or access Redshift through supported IAM authentication features.

Amazon Rekognition

IAM policies control image and video analysis operations and access to Rekognition collections. Video analysis workflows use a service role to publish completion notifications to SNS.

Amazon Route 53

IAM policies govern hosted zones, health checks, and DNS record changes. Conditions can restrict record changes by record name, record type, and requested action.

Amazon S3 Glacier

IAM policies and Glacier vault access policies control archive uploads, retrievals, and vault management. Administrators can grant a principal access to a specific vault without granting access to every archive repository.

Amazon SageMaker

IAM policies control SageMaker resources and who may pass execution roles to workloads. Execution roles define the data, container images, encryption keys, and other AWS resources available to training jobs and hosted models.

IAM execution-role permissions determine which data sources Data Wrangler can access and where it can export transformed data. IAM also controls the SageMaker resources used to run Data Wrangler processing jobs.

Amazon SageMaker Ground Truth

IAM policies control labeling jobs and workforce administration. Ground Truth uses execution roles to access input data and write labeling outputs.

IAM policies govern Security Lake administration and subscriber management. Security Lake uses service-linked and other IAM roles to collect security data and manage supporting resources.

Amazon Simple Email Service (Amazon SES)

IAM policies control email sending and SES administration. Sending permissions can be restricted by sender or recipient conditions, and SES SMTP credentials are derived from IAM access credentials.

Amazon Simple Notification Service (Amazon SNS)

IAM policies and SNS topic policies determine who can publish, subscribe, and administer topics. Topic policies can also authorize specific AWS services or cross-account IAM principals to publish.

Amazon Simple Queue Service (Amazon SQS)

IAM policies and SQS queue policies control who can send, receive, delete, and manage messages. Queue policies can grant access to particular IAM principals or authorize message delivery from AWS services.

Amazon Textract

IAM policies control Textract document-analysis operations. Asynchronous jobs can assume an IAM role to publish completion notifications to an SNS topic.

Amazon Timestream

IAM policies authorize Timestream database and table administration, record writes, and queries. Permissions can separate ingestion workloads from applications that only read time-series data.

IAM policies control creation and management of Timestream for InfluxDB instances. These management permissions are separate from the InfluxDB tokens used to query and write database data.

Amazon Transcribe

IAM policies control transcription jobs, streaming transcription, vocabularies, and language models. Supported transcription workflows use service roles to access input media and other required resources.

Amazon Translate

IAM policies control translation operations and access to custom terminology and parallel data. Batch translation jobs assume an IAM role to read source documents and write translated output.

IAM policies control access to Verified Permissions policy stores and authorization APIs. They determine which AWS callers may manage application policies or submit authorization requests, separately from the application permissions those policies evaluate.

Amazon VPC

IAM policies control creation and modification of VPCs, subnets, route tables, security groups, and other networking resources. Conditions can restrict network administration by resource tags and other supported attributes.

Amazon WorkSpaces

IAM policies govern WorkSpaces provisioning and administration. WorkSpaces uses service roles to perform required operations on supporting AWS resources.

Amazon WorkSpaces Applications

IAM policies control fleets, stacks, images, and streaming URL creation. Fleet IAM roles can provide temporary AWS credentials to applications running in streaming instances.

Amazon WorkSpaces Secure Browser

IAM policies govern Secure Browser portals, browser settings, network settings, and related administrative resources. These administrative permissions are separate from end-user authentication to a browsing session.

AWS Amplify

IAM policies control Amplify applications, branches, and deployments. Amplify service roles authorize backend provisioning, and supported hosting compute roles provide AWS permissions to server-side application code.

AWS App Runner

IAM controls App Runner service management and role assignment. Access roles authorize private ECR image retrieval, while instance roles provide AWS permissions to running applications.

AWS AppConfig

IAM policies distinguish permission to manage AppConfig applications and deployments from permission to retrieve configuration data. AppConfig can assume retrieval roles to read configuration from supported external stores.

AWS Application Discovery Service

IAM policies control access to discovered server information, discovery configurations, and export operations. Discovery agents use AWS credentials with permissions to submit collected inventory data.

AWS Application Migration Service

IAM policies govern migration source servers, replication settings, and launch actions. Application Migration Service uses service-linked and other IAM roles to manage replication and launch target instances.

AWS AppSync

IAM policies authorize GraphQL requests when an AppSync API enables AWS_IAM authentication. AppSync also assumes data-source roles to access resources such as DynamoDB tables or Lambda functions.

AWS Artifact

IAM policies control access to Artifact compliance reports and agreement operations. Administrators can separate report downloads from permissions to accept or terminate agreements.

AWS Audit Manager

IAM policies control Audit Manager assessments, frameworks, and evidence access. Audit Manager uses a service-linked role to collect evidence from supported AWS services.

AWS Auto Scaling

IAM policies control scaling plans and supported application scaling configurations. Scaling services use service-linked roles to inspect and adjust the capacity of target resources.

AWS Backup

IAM policies govern backup plans, vaults, recovery points, and restore operations. AWS Backup assumes service roles to back up and restore protected resources.

AWS Batch

IAM policies control Batch queues, compute environments, job definitions, and job submission. Service roles manage compute resources, while job roles provide scoped AWS permissions to workloads.

IAM policies control access to billing information, payment settings, and cost-management operations after IAM access to billing is enabled where required. Administrators can grant financial visibility without granting permission to change payment details.

AWS Billing Conductor

IAM policies govern Billing Conductor billing groups, pricing plans, pricing rules, and custom line items. Financial administrators can receive pricing-management permissions without broader infrastructure access.

AWS Budgets

IAM policies control budget creation and modification. Budget actions can use an IAM execution role to attach IAM policies or apply other configured enforcement actions when a threshold is reached.

AWS Certificate Manager (ACM)

IAM policies control certificate requests, imports, exports where supported, and deletion. Conditions can restrict certificate requests by domain name and other supported certificate attributes.

AWS Chatbot

IAM roles define the AWS permissions available to chat channels and individual users running commands through AWS Chatbot. Channel guardrail policies further limit those permissions.

IAM policies control collaborations, memberships, configured tables, and analysis operations. Clean Rooms assumes configured IAM roles to access underlying data and write query results.

AWS Client VPN

IAM policies govern Client VPN endpoints, network associations, routes, and authorization rules. Client VPN uses a service-linked role to manage supporting network resources.

AWS Cloud Map

IAM policies control Cloud Map namespaces, services, instance registration, and discovery operations. Permissions can distinguish applications that register service instances from clients that only discover them.

AWS Cloud9

IAM policies control Cloud9 environment creation, access, and sharing. Cloud9 also supports managed temporary AWS credentials for supported EC2 development environments.

AWS CloudFormation

CloudFormation templates can provision IAM users, groups, roles, managed policies, and identity providers. CloudFormation can also assume an IAM service role that defines its permissions to create and manage stack resources.

AWS CloudHSM

IAM policies control CloudHSM cluster and backup administration. IAM permissions do not replace the separate HSM user authentication used for cryptographic operations.

AWS CloudShell

IAM policies control access to CloudShell and supported environment operations. CloudShell makes temporary credentials from the signed-in AWS session available to commands, so their AWS access remains bounded by that identity's permissions.

AWS CloudTrail

CloudTrail records IAM API activity, including changes to users, roles, policies, and access keys. These events provide an audit trail for investigating permission changes and credential use.

AWS CodeArtifact

IAM policies and CodeArtifact resource policies control domains, repositories, and package operations. Authorized IAM principals obtain temporary authorization tokens for package-manager access.

AWS CodeBuild

IAM policies control build projects and build execution. Each project's service role defines the AWS resources its builds can access, such as source artifacts, logs, and deployment destinations.

AWS CodeCommit

IAM policies govern repository administration and Git access. Repository permissions can restrict operations on particular branches, while IAM users can use supported Git credentials or SSH public keys.

IAM policies control connection creation, management, and use by services such as CodePipeline. PassConnection permissions govern which services may receive access to a connection.

AWS CodeDeploy

IAM policies govern CodeDeploy applications, deployment groups, and deployment operations. CodeDeploy assumes a service role to interact with the compute and traffic-management resources involved in deployments.

AWS CodePipeline

IAM policies control pipelines and their execution. Pipeline service roles and action roles authorize access to artifacts and the AWS resources used by each stage.

AWS Compute Optimizer

IAM policies determine who can view Compute Optimizer recommendations and change enrollment or recommendation settings. Compute Optimizer uses a service-linked role to inspect supported resource configurations and metrics.

AWS Config

Config records supported IAM resource configurations and evaluates rules for issues such as inactive credentials, missing MFA, and overly permissive policies. Its recorder uses an IAM role to discover resources and deliver configuration information.

AWS Control Tower

Control Tower uses IAM roles to establish and govern a landing zone and enrolled accounts. Its controls can also detect or prevent selected insecure IAM configurations.

AWS Cost and Usage Report

IAM policies control creation, modification, and deletion of Cost and Usage Report definitions. Access to delivered report files is governed separately through permissions on the destination S3 bucket.

AWS Cost Explorer

IAM policies control access to Cost Explorer queries, forecasts, and related cost-management APIs. Administrators can grant cost-analysis permissions without granting access to provision or modify the resources generating those costs.

AWS Data Exchange

IAM policies govern Data Exchange datasets, revisions, assets, jobs, and data grants. Permissions can separate provider publishing operations from subscriber access.

AWS Data Pipeline

IAM policies control pipeline definitions and execution management. Pipeline service roles and resource roles authorize orchestration and access to the data and compute resources used by activities.

AWS Database Migration Service (AWS DMS)

IAM policies control DMS replication resources, endpoints, and migration tasks. DMS uses IAM roles for supported endpoints and operations such as accessing S3, writing logs, and managing network resources.

AWS DataSync

IAM policies control DataSync agents, locations, tasks, and executions. DataSync assumes configured IAM roles to access supported storage locations such as S3 buckets.

AWS DeepRacer

IAM policies control DeepRacer model training, evaluation, and related service operations. DeepRacer uses service roles to access resources required by its managed training workflows.

AWS Device Farm

IAM policies control Device Farm projects, test runs, device pools, and remote-access sessions. Permissions can limit users to particular testing projects.

IAM policies govern access to DevOps Agent resources. Configured IAM roles define which AWS resources the agent may inspect during operational investigations.

AWS Direct Connect

IAM policies control Direct Connect connections, virtual interfaces, gateways, and association operations. Administrators can separate network visibility from permissions to change connectivity.

AWS Directory Service

IAM policies control directory creation, management, and supported directory integrations. Directory Service uses service-linked roles to manage supporting AWS resources.

AWS Elastic Beanstalk

IAM policies control Beanstalk applications, environments, and deployments. Environment service roles and EC2 instance profiles authorize health monitoring, resource management, and application access to AWS services.

AWS Elastic Disaster Recovery

IAM policies govern source servers, replication settings, recovery launches, and failback operations. Elastic Disaster Recovery uses IAM roles to manage replication infrastructure and recovery resources.

IAM policies control Entity Resolution schemas, matching workflows, and related resources. Workflow execution roles authorize reading input datasets and writing matching results.

AWS Fargate

IAM roles provide credentials to ECS tasks and EKS pods running on Fargate. ECS task execution roles and EKS pod execution roles authorize platform operations such as pulling container images.

AWS Fault Injection Service

IAM policies control experiment templates and experiment execution. Each experiment uses an IAM role whose permissions define which resources and fault-injection actions the experiment can affect.

AWS Firewall Manager

IAM policies control Firewall Manager security policies and administrative operations. Firewall Manager uses service-linked roles to manage supported security protections across organization accounts.

AWS Global Accelerator

IAM policies govern accelerators, listeners, endpoint groups, and traffic configuration. Global Accelerator uses service-linked roles for supported operations on underlying AWS resources.

AWS Glue

IAM policies control Glue jobs, crawlers, connections, and Data Catalog resources. Glue assumes service roles to discover data, execute transformations, and access input and output locations.

IAM policies govern DataBrew projects, datasets, recipes, and jobs. DataBrew assumes a configured role to read source data and write prepared datasets and job output.

AWS Health Dashboard

IAM policies control access to AWS Health account-specific events and affected-resource details. Administrators can grant operational teams access to service-health information without granting infrastructure modification permissions.

AWS IAM Identity Center (AWS Single Sign-On)

Identity Center permission sets provision and maintain IAM roles in assigned AWS accounts. Users receive temporary credentials for those roles, with permissions defined by the permission set.

AWS IoT Core

IAM policies authorize IoT Core management APIs and supported data-plane requests made with AWS credentials. The credentials provider exchanges device certificate authentication for temporary credentials from a configured IAM role.

AWS IoT Device Defender

IAM policies control audit configurations, security profiles, findings, and mitigation tasks. Device Defender uses IAM roles to perform audits and carry out configured mitigation actions.

AWS IoT Device Management

IAM policies govern device registries, fleet indexing, jobs, and secure-tunneling management APIs. Supported fleet operations use IAM roles to access job documents and other required resources.

AWS IoT Greengrass

IAM policies control Greengrass components, deployments, and core-device resources. A token exchange role supplies temporary AWS credentials to components running on a core device.

AWS IoT SiteWise

IAM policies control SiteWise asset models, assets, measurements, and portal administration. SiteWise uses configured roles for features that access other AWS resources.

AWS Key Management Service (AWS KMS)

IAM policies work with KMS key policies and grants to authorize encryption, decryption, and key administration. Key policies determine whether and how an account can delegate access through IAM policies.

AWS Lake Formation

Lake Formation grants data permissions to IAM users and roles, while IAM controls access to its administrative APIs. Registered data locations use IAM roles that allow Lake Formation to provide governed access to underlying S3 data.

IAM policies control Launch Wizard deployments and administrative operations. Deployment roles authorize Launch Wizard to provision and configure resources required by supported applications.

AWS License Manager

IAM policies govern license configurations, grants, and usage-management operations. License Manager uses service-linked roles to discover and manage supported license-related resources.

AWS Managed Services (AMS)

IAM roles provide the controlled cross-account access AMS uses to operate managed AWS environments. IAM policies define the resources and operational actions available to those roles.

AWS Marketplace

IAM policies control Marketplace subscription, procurement, and seller operations. Administrators can restrict who may subscribe to products or manage a private marketplace.

AWS Migration Hub

IAM policies control access to migration tracking, application groupings, and related Migration Hub operations. Migration tools receive permissions to report resource and migration-task progress.

AWS Network Firewall

IAM policies control firewalls, firewall policies, rule groups, and logging configurations. Permissions can separate rule maintenance from the ability to change firewall deployments.

AWS Organizations

Organizations service control policies limit the permissions available to IAM principals in member accounts without granting permissions themselves. Organizations can also centrally manage root access and other supported identity controls across accounts.

AWS Outposts

IAM policies govern Outposts sites, orders, capacity information, and other management resources. Workloads on Outposts use the IAM integrations of their underlying AWS services, including instance profiles for EC2.

AWS Private Certificate Authority

IAM policies control private CA administration and certificate issuance. Resource policies can authorize certificate operations for designated principals, including principals in other accounts.

AWS PrivateLink

IAM policies control VPC endpoint and endpoint-service management. Endpoint policies on supported services can further restrict which IAM principals and operations may use an endpoint.

AWS Resilience Hub

IAM policies control Resilience Hub applications, resilience policies, and assessments. Resilience Hub uses configured IAM roles to discover application resources and assess their resilience.

AWS Resource Access Manager (AWS RAM)

IAM policies govern resource shares, invitations, and sharing operations. RAM can share supported resources with designated IAM roles or users where the resource type supports that principal type.

IAM policies control resource-group creation, membership queries, and tagging operations. Tag-based IAM conditions can then use supported resource tags to restrict access to AWS resources.

AWS Secrets Manager

IAM policies and secret resource policies control who can retrieve, update, rotate, or delete secrets. Permissions can restrict an application role to only the secrets it needs.

AWS Security Hub

IAM policies control Security Hub configuration, findings, insights, and automation rules. Security Hub uses a service-linked role for supported security checks and integration operations.

AWS Security Token Service (AWS STS)

STS issues temporary credentials for IAM roles and federated sessions. IAM role trust policies determine who may assume a role, while role policies and session policies bound the resulting permissions.

AWS Serverless Application Repository

IAM policies control application publication and access to Serverless Application Repository APIs. Deploying an application that creates IAM resources requires explicit acknowledgment of the relevant IAM capabilities.

AWS Service Catalog

IAM policies control Service Catalog administration and product provisioning. Launch constraints specify IAM roles that Service Catalog assumes to provision products without giving end users direct permissions to every underlying resource.

AWS Shield

IAM policies control Shield Advanced subscriptions, protected resources, and response settings. Supported Shield features use IAM roles to inspect and manage associated protections.

IAM policies control signing profiles, signing jobs, and signature revocation. Signing-profile resource permissions can authorize other AWS accounts to perform supported signing operations.

AWS Site-to-Site VPN

IAM policies control customer gateways, VPN gateways, VPN connections, and tunnel settings. Administrators can grant network operators permission to inspect tunnels without allowing them to modify connectivity.

IAM policies control Snow device jobs and supported device-management operations. Snow import and export jobs use IAM roles to access designated S3 resources.

AWS Step Functions

IAM policies control state machines and execution operations. Each state machine's execution role authorizes the AWS service actions its workflow can perform.

AWS Storage Gateway

IAM policies govern gateways, volumes, file shares, and tape operations. S3 File Gateway assumes IAM roles to access the buckets backing its file shares.

AWS Systems Manager

IAM policies control Systems Manager sessions, commands, automation, parameters, and managed-node operations. Managed nodes use IAM roles for service communication, and automation runbooks can assume roles that define their execution permissions.

AWS Transfer Family

IAM roles define the S3 or EFS access available to Transfer Family users. Optional session policies further restrict a user's access, such as limiting transfers to a particular S3 prefix.

AWS Transit Gateway

IAM policies govern transit gateways, attachments, routing tables, and route changes. Supported resource-level permissions and tag conditions can limit which networking resources an administrator may manage.

AWS Trusted Advisor

Trusted Advisor checks IAM-related security settings, including supported checks for root-account MFA and credential practices. IAM policies separately control access to Trusted Advisor recommendations and management operations.

IAM policies control notification configurations, event rules, and delivery-channel associations. Administrators can restrict who may create or modify notifications for AWS events.

IAM policies control Verified Access instances, groups, endpoints, and trust-provider configurations. These permissions govern administration rather than replacing the identity and device policies used to authorize application access.

AWS WAF

IAM policies control web ACLs, rule groups, IP sets, and associations with protected resources. Permissions can separate rule inspection from the ability to change traffic-filtering behavior.

AWS Well-Architected Tool

IAM policies control workloads, reviews, lenses, and related Well-Architected Tool resources. Administrators can grant review access without allowing users to modify or delete workloads.

AWS X-Ray

IAM policies control trace submission, trace retrieval, sampling rules, and other X-Ray operations. Workload roles can receive write-only tracing permissions while investigation roles receive access to read traces.

IAM policies govern image pipelines, recipes, components, and image distribution settings. Image Builder service-linked roles and instance profiles authorize infrastructure management and operations performed during image builds.

Elastic Load Balancing (ELB)

IAM policies control load balancers, listeners, target groups, and routing configuration. Elastic Load Balancing uses service-linked roles to manage supporting resources such as network interfaces.

Red Hat OpenShift Service on AWS (ROSA)

ROSA uses IAM roles and STS temporary credentials to install and operate supported clusters. Operator roles provide individual OpenShift components with scoped permissions to manage AWS resources.

VMware Cloud on AWS

A connected AWS account supplies a cross-account IAM role that VMware Cloud on AWS uses to provision and manage supporting resources such as network interfaces. This role does not replace VMware's separate user authentication and SDDC permissions.