AWS actions that generate or return credentials

aws-credential-actions.json

[
  "airflow:CreateCliToken",
  "airflow:CreateWebLoginToken",
  "amplifybackend:CreateToken",
  "amplifybackend:GetToken",
  "amplifyuibuilder:ExchangeCodeForToken",
  "amplifyuibuilder:RefreshToken",
  "appsync:CreateApiKey",
  "appsync:ListApiKeys",
  "appsync:UpdateApiKey",
  "chime:CreateApiKey",
  "chime:PutVoiceConnectorTerminationCredentials",
  "chime:RegenerateSecurityToken",
  "cloud9:CreateEnvironmentToken",
  "cloud9:ModifyTemporaryCredentialsOnEnvironmentEC2",
  "codeartifact:GetAuthorizationToken",
  "codebuild:ImportSourceCredentials",
  "codebuild:PersistOAuthToken",
  "codepipeline:PollForJobs",
  "cognito-identity:GetCredentialsForIdentity",
  "cognito-identity:GetOpenIdToken",
  "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
  "cognito-idp:AdminSetUserPassword",
  "cognito-idp:AssociateSoftwareToken",
  "cognito-idp:ChangePassword",
  "cognito-idp:ConfirmForgotPassword",
  "cognito-idp:DescribeUserPoolClient",
  "cognito-idp:ForgotPassword",
  "cognito-idp:UpdateUserPoolClient",
  "cognito-idp:VerifySoftwareToken",
  "connect:GetFederationToken",
  "connect:GetFederationTokens",
  "deepracer:CreateLeaderboardAccessToken",
  "ds:ResetUserPassword",
  "ec2:GetPasswordData",
  "ecr:GetAuthorizationToken",
  "ecr-public:GetAuthorizationToken",
  "finspace:ResetUserPassword",
  "gamelift:RequestUploadCredentials",
  "grafana:CreateWorkspaceApiKey",
  "iam:ChangePassword",
  "iam:CreateAccessKey",
  "iam:CreateLoginProfile",
  "iam:CreateServiceSpecificCredential",
  "iam:ResetServiceSpecificCredential",
  "iam:UpdateAccessKey",
  "iam:UpdateLoginProfile",
  "iot:CreateKeysAndCertificate",
  "iot:RotateTunnelAccessToken",
  "ivschat:CreateChatToken",
  "lakeformation:AssumeDecoratedRoleWithSAML",
  "license-manager:CreateToken",
  "license-manager:GetAccessToken",
  "lightsail:CreateBucketAccessKey",
  "lightsail:DownloadDefaultKeyPair",
  "lightsail:GetBucketAccessKeys",
  "lightsail:GetInstanceAccessDetails",
  "lightsail:GetRelationalDatabaseMasterUserPassword",
  "mediapackage:RotateChannelCredentials",
  "mediapackage:RotateIngestEndpointCredentials",
  "rds-db:connect",
  "redshift:GetClusterCredentials",
  "redshift-serverless:GetCredentials",
  "sso-directory:CreateBearerToken",
  "sso-directory:UpdatePassword",
  "storagegateway:SetLocalConsolePassword",
  "storagegateway:SetSMBGuestPassword",
  "sts:AssumeRole",
  "sts:AssumeRoleWithSAML",
  "sts:AssumeRoleWithWebIdentity",
  "sts:GetFederationToken",
  "sts:GetServiceBearerToken",
  "sts:GetSessionToken",
  "waf:GetChangeToken",
  "waf-regional:GetChangeToken",
  "workmail:AssumeImpersonationRole",
  "workmail:ResetPassword",
  "workmail:ResetUserPassword"
]