Skip to content

Instantly share code, notes, and snippets.

@mechcozmo

mechcozmo/IAM Permissions List.md

Last active February 15, 2024 20:35
Show Gist options
  • Star 89 You must be signed in to star a gist
  • Fork 14 You must be signed in to fork a gist
  • Save mechcozmo/bb06948169862771f980c8af39d952e9 to your computer and use it in GitHub Desktop.
Save mechcozmo/bb06948169862771f980c8af39d952e9 to your computer and use it in GitHub Desktop.
Download ZIP
A list of IAM permissions you can use in policy documents. Collected from the myriad of places Amazon hides them. (incomplete)
Raw
IAM Permissions List.md

List of IAM Permissions

This is a list of controls that can be placed into an IAM policy document. All content comes from AWS documentation.

Something wrong? Try looking here.

Table of Contents generated with DocToc

IAM Policy Variables

  • aws:CurrentTime —To check for date/time conditions.
  • aws:EpochTime —To check for date/time conditions using a date in epoch or UNIX time.
  • aws:TokenIssueTime This is the date and time that temporary security credentials were issued and can be used with date/time conditions. (Note: This key is only available in requests that are signed using temporary security credentials. For more information about temporary security credentials, see Temporary Security Credentials.)
  • aws:principaltype —To check the type of principal (user, account, federated user, - etc.) for the current request.
  • aws:SecureTransport —To check whether the request was sent using SSL. For services - that use only SSL, such as Amazon RDS and Amazon Route 53, the aws:SecureTransport - key has no meaning.
  • aws:SourceArn —To check the source of the request, using the Amazon Resource Name - (ARN) of the source. (This value is available for only some services. For more - information, see Amazon Resource Name (ARN) under "Element Descriptions" in the - Amazon Simple Queue Service Developer Guide.)
  • aws:SourceIp —To check the IP address of the requester. Note that if you use - aws:SourceIp, and the request comes from an Amazon EC2 instance, the public IP - address of the instance is evaluated.
  • aws:UserAgent —To check the client application that made the request.
  • aws:userid —To check the user ID of the requester.
  • aws:username —To check the user name of the requester, if available.
  • ec2:SourceInstanceARN This is the Amazon Resource Name (ARN) of the Amazon EC2 instance from which the request is made. This key is present only when the request comes from an Amazon EC2 instance using an IAM role associated with an EC2 instance profile.

The values for aws:username, aws:userid, and aws:principaltype depend on what type of principal initiated the request—whether the request was made using the credentials of an AWS account, an IAM user, an IAM role, and so on. The following table shows values for these keys for different types of principal.

Principal aws:username aws:userid aws:principaltype
AWS account (not present) AWS account ID Account
IAM user IAM-user-name unique ID User
Federated user (not present) account:caller-specified-name FederatedUser
Web federated user (Login with Amazon, Amazon Cognito, Facebook, Google) * (not present) role id:caller-specified-role-name AssumedRole
SAML federated user ** (not present) role id:caller-specified-role-name AssumedRole
Assumed role (not present) role-id:caller-specified-role-name AssumedRole
Role assigned to an Amazon EC2 instance (not present) role-id:ec2-instance-id AssumedRole
Anonymous caller (Amazon SQS, Amazon SNS, and Amazon S3 only) (not present) (not present) Anonymous

* For information about policy keys that are available when you use web identity federation, see Identifying Users with Web Identity Federation.

** For information about policy keys that are available when you use SAML federation, see Uniquely Identifying Users in SAML-Based Federation.

In this table:

  • not present means that the value is not in the current request information, and any attempt to match it fails and causes the request to be denied.
  • role-id is a unique identifier assigned to each role at creation. You can display the role ID with the AWS CLI command: aws iam get-role --role-name ${rolename}
  • caller-specified-name and caller-specified-role-name are names that are passed by the calling process (e.g. application or service) when it makes a call to get temporary credentials.
  • ec2-instance-id is a value assigned to the instance when it is launched and appears on the Instances page of the Amazon EC2 console. You can also display the instance ID by running the AWS CLI command: aws ec2 describe-instances

AWS Billing

aws-portal:

  • ModifyAccount
  • ModifyBilling
  • ModifyPaymentMethods
  • ViewAccount
  • ViewBilling
  • ViewBudget
  • ViewPaymentMethods
  • ViewUsage

Auto Scaling

autoscaling:

CloudFormation

cloudformation:

CloudTrail

cloudtrail:

CloudWatch

cloudwatch:

CloudWatch Logs

logs:

Database Migration Service (DMS)

dms:

DynamoDB

dynamodb:

Elastic Beanstalk

elasticbeanstalk:

ElastiCache

elasticache:

EC2

ec2:

EC2 Container Service (ECS)

ecs:

Elastic File System (EFS)

elasticfilesystem:

Elastic Load Balancer (ELB)##

elasticloadbalancing:

Elastic MapReduce (EMR)

elasticmapreduce:

Identity and Access Management (IAM)

iam:

Kinesis##

kinesis:

Key Management Service (KMS)

kms:

Lambda

lambda:

[OpsWorks](AWS OpsWorks)

opsworks:

Relational Database Service (RDS)

rds:

Redshift

redshift:

Route 53

route53:

Route53 Domains

route53domains:

S3

s3:

Security Token Service (STS)

sts:

Simple Email Service (SES)

ses:

Simple Notification Service (SNS)

Simple Queue Service (SQS)

sqs:

Support##

support:

Trusted Advisor

trustedadvisor:

  • DescribeCheckSummaries
  • DescribeCheckItems
  • RefreshCheck
  • DescribeCheckRefreshStatuses
  • ExcludeCheckItems
  • IncludeCheckItems
  • DescribeNotificationPreferences
  • UpdateNotificationPreferences
@bddap
Copy link

bddap commented Oct 13, 2021

codestar:*
https://docs.aws.amazon.com/codestar/latest/userguide/security_iam_id-based-policy-examples.html

@lukepearson
Copy link

cloudfront:

AssociateAlias
CreateCachePolicy
CreateCloudFrontOriginAccessIdentity
CreateDistribution
CreateDistributionWithTags
CreateFieldLevelEncryptionConfig
CreateFieldLevelEncryptionProfile
CreateFunction
CreateInvalidation
CreateKeyGroup
CreateMonitoringSubscription
CreateOriginRequestPolicy
CreatePublicKey
CreateRealtimeLogConfig
CreateResponseHeadersPolicy
CreateStreamingDistribution
CreateStreamingDistributionWithTags
DeleteCachePolicy
DeleteCloudFrontOriginAccessIdentity
DeleteDistribution
DeleteFieldLevelEncryptionConfig
DeleteFieldLevelEncryptionProfile
DeleteFunction
DeleteKeyGroup
DeleteMonitoringSubscription
DeleteOriginRequestPolicy
DeletePublicKey
DeleteRealtimeLogConfig
DeleteResponseHeadersPolicy
DeleteStreamingDistribution
DescribeFunction
GetCachePolicy
GetCachePolicyConfig
GetCloudFrontOriginAccessIdentity
GetCloudFrontOriginAccessIdentityConfig
GetDistribution
GetDistributionConfig
GetFieldLevelEncryption
GetFieldLevelEncryptionConfig
GetFieldLevelEncryptionProfile
GetFieldLevelEncryptionProfileConfig
GetFunction
GetInvalidation
GetKeyGroup
GetKeyGroupConfig
GetMonitoringSubscription
GetOriginRequestPolicy
GetOriginRequestPolicyConfig
GetPublicKey
GetPublicKeyConfig
GetRealtimeLogConfig
GetResponseHeadersPolicy
GetResponseHeadersPolicyConfig
GetStreamingDistribution
GetStreamingDistributionConfig
ListCachePolicies
ListCloudFrontOriginAccessIdentities
ListConflictingAliases
ListDistributions
ListDistributionsByCachePolicyId
ListDistributionsByKeyGroup
ListDistributionsByOriginRequestPolicyId
ListDistributionsByRealtimeLogConfig
ListDistributionsByResponseHeadersPolicyId
ListDistributionsByWebACLId
ListFieldLevelEncryptionConfigs
ListFieldLevelEncryptionProfiles
ListFunctions
ListInvalidations
ListKeyGroups
ListOriginRequestPolicies
ListPublicKeys
ListRealtimeLogConfigs
ListResponseHeadersPolicies
ListStreamingDistributions
ListTagsForResource
PublishFunction
TagResource
TestFunction
UntagResource
UpdateCachePolicy
UpdateCloudFrontOriginAccessIdentity
UpdateDistribution
UpdateFieldLevelEncryptionConfig
UpdateFieldLevelEncryptionProfile
UpdateFunction
UpdateKeyGroup
UpdateOriginRequestPolicy
UpdatePublicKey
UpdateRealtimeLogConfig
UpdateResponseHeadersPolicy
UpdateStreamingDistribution

@ktippetts
Copy link

ktippetts commented Apr 28, 2022 •
edited

Discovered some additional permissions for IAM:
iam:
ListRoleTags
TagRole
UntagRole
ListUserTags
TagUser
UntagUser

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment