Changelog

AWS Backup

• backup:ListBackupJobSummaries
• backup:ListCopyJobSummaries
• backup:ListRestoreJobSummaries

Amazon Connect Wisdom

• wisdom:PutFeedback

AWS Control Tower

• controltower:ListTagsForResource
• controltower:TagResource
• controltower:UntagResource

AWS Cost Explorer Service

• ce:GetApproximateUsageRecords

Amazon FinSpace

• finspace:UpdateKxClusterCodeConfiguration

Amazon Redshift

• redshift:DeleteResourcePolicy
• redshift:DescribeInboundIntegrations
• redshift:GetResourcePolicy
• redshift:PutResourcePolicy

AWS Resource Explorer

• resource-explorer-2:GetAccountLevelServiceConfiguration
• resource-explorer-2:ListIndexesForMembers

Amazon S3

• s3:CreateStorageLensGroup
• s3:DeleteStorageLensGroup
• s3:GetStorageLensGroup
• s3:ListStorageLensGroups
• s3:ListTagsForResource
• s3:TagResource
• s3:UntagResource
• s3:UpdateStorageLensGroup

AWS Step Functions

• states:RedriveExecution

AWS Systems Manager Incident Manager

• ssm-incidents:BatchGetIncidentFindings
• ssm-incidents:ListIncidentFindings

Amazon CodeWhisperer

• codewhisperer:AllowVendedLogDeliveryForResource

AWS Launch Wizard

• launchwizard:CreateDeployment
• launchwizard:DeleteDeployment
• launchwizard:GetDeployment
• launchwizard:GetResourceRecommendation
• launchwizard:GetSettingsSet
• launchwizard:GetWorkload
• launchwizard:GetWorkloadAsset
• launchwizard:ListAllowedResources
• launchwizard:ListDeploymentEvents
• launchwizard:ListDeployments
• launchwizard:ListResourceCostEstimates
• launchwizard:ListWorkloadDeploymentPatterns
• launchwizard:PutSettingsSet

AWS Resource Groups

• resource-groups:AssociateResource
• resource-groups:DisassociateResource

Amazon CloudWatch Logs

• logs:CreateDelivery
• logs:DeleteDelivery
• logs:DeleteDeliveryDestination
• logs:DeleteDeliveryDestinationPolicy
• logs:DeleteDeliverySource
• logs:DescribeDeliveries
• logs:DescribeDeliveryDestinations
• logs:DescribeDeliverySources
• logs:GetDelivery
• logs:GetDeliveryDestination
• logs:GetDeliveryDestinationPolicy
• logs:GetDeliverySource
• logs:PutDeliveryDestination
• logs:PutDeliveryDestinationPolicy
• logs:PutDeliverySource

Amazon Comprehend

• comprehend:DetectToxicContent

Amazon EC2

• ec2:GetSecurityGroupsForVpc
• ec2:InjectApiError

Amazon Elastic Kubernetes Service

• eks:CreateEksAnywhereSubscription
• eks:DeleteEksAnywhereSubscription
• eks:DescribeEksAnywhereSubscription
• eks:ListEksAnywhereSubscriptions
• eks:UpdateEksAnywhereSubscription

Amazon RDS

• rds:CreateIntegration
• rds:CreateTenantDatabase
• rds:DeleteIntegration
• rds:DeleteTenantDatabase
• rds:DescribeDbSnapshotTenantDatabases
• rds:DescribeIntegrations
• rds:DescribeTenantDatabases
• rds:ModifyTenantDatabase

AWS Partner central account management

• partnercentral-account-management:AssociatePartnerAccount
• partnercentral-account-management:AssociatePartnerUser
• partnercentral-account-management:DisassociatePartnerUser

Amazon Connect

• connect:BatchPutContact

Amazon SageMaker

• sagemaker:CreateInferenceComponent
• sagemaker:DeleteInferenceComponent
• sagemaker:DescribeInferenceComponent
• sagemaker:InvokeEndpointWithResponseStream
• sagemaker:ListInferenceComponents
• sagemaker:UpdateInferenceComponent
• sagemaker:UpdateInferenceComponentRuntimeConfig

Amazon Cognito Identity

• cognito-identity:GetIdentityPoolAnalytics
• cognito-identity:GetIdentityPoolDailyAnalytics
• cognito-identity:GetIdentityProviderDailyAnalytics

AWS Systems Manager

• ssm:DeleteOpsItem

AWS Migration Hub Strategy Recommendations

• migrationhub-strategy:ListAnalyzableServers

Amazon Redshift

• redshift:FailoverPrimaryCompute

Amazon EMR Serverless

• emr-serverless:AccessInteractiveEndpoints

AWS Global Accelerator

• globalaccelerator:CreateCrossAccountAttachment
• globalaccelerator:DeleteCrossAccountAttachment
• globalaccelerator:DescribeCrossAccountAttachment
• globalaccelerator:ListCrossAccountAttachments
• globalaccelerator:ListCrossAccountResourceAccounts
• globalaccelerator:ListCrossAccountResources
• globalaccelerator:UpdateCrossAccountAttachment

AWS Data Exchange

• dataexchange:SendDataSetNotification

AWS DeepRacer

• deepracer:ListLeaderboardEvaluations

Amazon Redshift Serverless

• redshift-serverless:CreateCustomDomainAssociation
• redshift-serverless:DeleteCustomDomainAssociation
• redshift-serverless:GetCustomDomainAssociation
• redshift-serverless:ListCustomDomainAssociations
• redshift-serverless:UpdateCustomDomainAssociation

Amazon EC2

• ec2:DisableImage
• ec2:EnableImage

AWS Application Transformation Service

• application-transformation:GetGroupingAssessment
• application-transformation:GetPortingCompatibilityAssessment
• application-transformation:GetPortingRecommendationAssessment
• application-transformation:GetRuntimeAssessment
• application-transformation:PutLogData
• application-transformation:PutMetricData
• application-transformation:StartGroupingAssessment
• application-transformation:StartPortingCompatibilityAssessment
• application-transformation:StartPortingRecommendationAssessment
• application-transformation:StartRuntimeAssessment

AWS Migration Hub

• mgh:DeleteHomeRegionControl

Amazon OpenSearch Serverless

• aoss:BatchGetEffectiveLifecyclePolicy
• aoss:BatchGetLifecyclePolicy
• aoss:CreateLifecyclePolicy
• aoss:DeleteLifecyclePolicy
• aoss:ListLifecyclePolicies
• aoss:UpdateLifecyclePolicy

Amazon Braket

• braket:AcceptUserAgreement
• braket:AccessBraketFeature
• braket:GetServiceLinkedRoleStatus
• braket:GetUserAgreementStatus

Amazon Connect

• connect:BatchGetFlowAssociation
• connect:CreatePredefinedAttribute
• connect:DeletePredefinedAttribute
• connect:DescribePredefinedAttribute
• connect:ListPredefinedAttributes
• connect:ListSecurityProfileApplications
• connect:UpdatePhoneNumberMetadata
• connect:UpdatePredefinedAttribute

Amazon Connect Wisdom

• wisdom:CreateQuickResponse
• wisdom:DeleteImportJob
• wisdom:DeleteQuickResponse
• wisdom:GetImportJob
• wisdom:GetQuickResponse
• wisdom:ListImportJobs
• wisdom:ListQuickResponses
• wisdom:SearchQuickResponses
• wisdom:StartImportJob
• wisdom:UpdateQuickResponse

AWS Lake Formation

• lakeformation:CreateLakeFormationOptIn
• lakeformation:DeleteLakeFormationOptIn
• lakeformation:ListLakeFormationOptIns

Amazon Rekognition

• rekognition:GetMediaAnalysisJob
• rekognition:ListMediaAnalysisJobs
• rekognition:StartMediaAnalysisJob

Amazon Redshift Serverless

• redshift-serverless:DescribeOneTimeCredit

Amazon AppIntegrations

• app-integrations:CreateApplication
• app-integrations:GetApplication
• app-integrations:ListApplications
• app-integrations:UpdateApplication

AWS Application Discovery Service

• discovery:BatchDeleteAgents
• discovery:DescribeBatchDeleteConfigurationTask
• discovery:StartBatchDeleteConfigurationTask

Amazon Chime

• chime:CreateMediaPipelineKinesisVideoStreamPool
• chime:CreateMediaStreamPipeline
• chime:DeleteMediaPipelineKinesisVideoStreamPool
• chime:GetMediaPipelineKinesisVideoStreamPool
• chime:ListMediaPipelineKinesisVideoStreamPools
• chime:UpdateMediaPipelineKinesisVideoStreamPool

Amazon CodeWhisperer

• codewhisperer:AssociateCustomizationPermission
• codewhisperer:CreateCustomization
• codewhisperer:DeleteCustomization
• codewhisperer:DisassociateCustomizationPermission
• codewhisperer:GetCustomization
• codewhisperer:ListCustomizationPermissions
• codewhisperer:ListCustomizations
• codewhisperer:UpdateCustomization

Amazon Managed Streaming for Apache Kafka

• kafka:CreateReplicator
• kafka:DeleteReplicator
• kafka:DescribeReplicator
• kafka:ListReplicators
• kafka:UpdateReplicationInfo

Amazon OpenSearch Service

• es:GetDomainMaintenanceStatus
• es:ListDomainMaintenances
• es:StartDomainMaintenance

Amazon Route 53 Recovery Controls

• route53-recovery-control-config:GetResourcePolicy

AWS Control Tower

• controltower:GetEnabledControl

AWS Entity Resolution

• entityresolution:CreateIdMappingWorkflow
• entityresolution:DeleteIdMappingWorkflow
• entityresolution:GetIdMappingJob
• entityresolution:GetIdMappingWorkflow
• entityresolution:GetProviderService
• entityresolution:ListIdMappingJobs
• entityresolution:ListIdMappingWorkflows
• entityresolution:ListProviderServices
• entityresolution:StartIdMappingJob
• entityresolution:UpdateIdMappingWorkflow
• entityresolution:UpdateSchemaMapping

Amazon FSx

• fsx:StartMisconfiguredStateRecovery

Amazon Managed Blockchain Query

• managedblockchain-query:GetAssetContract
• managedblockchain-query:ListAssetContracts

AWS Elemental MediaLive

• medialive:StartInputDevice
• medialive:StopInputDevice

AWS IoT FleetWise

• iotfleetwise:GetEncryptionConfiguration
• iotfleetwise:PutEncryptionConfiguration

AWS Support

• support:DescribeCommunication

Amazon Textract

• textract:CreateAdapter
• textract:CreateAdapterVersion
• textract:DeleteAdapter
• textract:DeleteAdapterVersion
• textract:GetAdapter
• textract:GetAdapterVersion
• textract:ListAdapterVersions
• textract:ListAdapters
• textract:ListTagsForResource
• textract:TagResource
• textract:UntagResource
• textract:UpdateAdapter

AWS Database Migration Service

• dms:DescribeEngineVersions

AWS Directory Service

• ds:DisableRoleAccess
• ds:EnableRoleAccess
• ds:UpdateDirectory

Amazon WorkSpaces

• workspaces:AssociateWorkspaceApplication
• workspaces:DeployWorkspaceApplications
• workspaces:DescribeApplicationAssociations
• workspaces:DescribeApplications
• workspaces:DescribeBundleAssociations
• workspaces:DescribeImageAssociations
• workspaces:DescribeWorkspaceAssociations
• workspaces:DisassociateWorkspaceApplication

AWS Well-Architected Tool

• wellarchitected:CreateReviewTemplate
• wellarchitected:CreateTemplateShare
• wellarchitected:DeleteReviewTemplate
• wellarchitected:DeleteTemplateShare
• wellarchitected:GetReviewTemplate
• wellarchitected:GetReviewTemplateAnswer
• wellarchitected:GetReviewTemplateLensReview
• wellarchitected:ListReviewTemplateAnswers
• wellarchitected:ListReviewTemplates
• wellarchitected:ListTemplateShares
• wellarchitected:UpdateReviewTemplate
• wellarchitected:UpdateReviewTemplateAnswer
• wellarchitected:UpdateReviewTemplateLensReview
• wellarchitected:UpgradeReviewTemplateLensReview

AWS App Runner

• apprunner:ListServicesForAutoScalingConfiguration
• apprunner:UpdateDefaultAutoScalingConfiguration

Amazon Bedrock

• bedrock:CreateFoundationModelAgreement
• bedrock:CreateProvisionedModelThroughput
• bedrock:DeleteFoundationModelAgreement
• bedrock:DeleteModelInvocationLoggingConfiguration
• bedrock:DeleteProvisionedModelThroughput
• bedrock:GetFoundationModelAvailability
• bedrock:GetModelInvocationLoggingConfiguration
• bedrock:GetProvisionedModelThroughput
• bedrock:GetUseCaseForModelAccess
• bedrock:ListFoundationModelAgreementOffers
• bedrock:ListProvisionedModelThroughputs
• bedrock:PutFoundationModelEntitlement
• bedrock:PutModelInvocationLoggingConfiguration
• bedrock:PutUseCaseForModelAccess
• bedrock:UpdateProvisionedModelThroughput

Amazon RDS

• rds:SwitchoverGlobalCluster

AWS Application Migration Service

• mgn:CreateConnector
• mgn:DeleteConnector
• mgn:ListConnectors
• mgn:UpdateConnector
• mgn:UpdateSourceServer

Amazon DataZone

• datazone:AcceptPredictions
• datazone:AcceptSubscriptionRequest
• datazone:CancelSubscription
• datazone:CreateAsset
• datazone:CreateAssetRevision
• datazone:CreateAssetType
• datazone:CreateDataSource
• datazone:CreateDomain
• datazone:CreateEnvironment
• datazone:CreateEnvironmentBlueprint
• datazone:CreateEnvironmentProfile
• datazone:CreateFormType
• datazone:CreateGlossary
• datazone:CreateGlossaryTerm
• datazone:CreateGroupProfile
• datazone:CreateListingChangeSet
• datazone:CreateProject
• datazone:CreateProjectMembership
• datazone:CreateSubscriptionGrant
• datazone:CreateSubscriptionRequest
• datazone:CreateSubscriptionTarget
• datazone:CreateUserProfile
• datazone:DeleteAsset
• datazone:DeleteAssetType
• datazone:DeleteDataSource
• datazone:DeleteDomain
• datazone:DeleteDomainSharingPolicy
• datazone:DeleteEnvironment
• datazone:DeleteEnvironmentBlueprint
• datazone:DeleteEnvironmentBlueprintConfiguration
• datazone:DeleteEnvironmentProfile
• datazone:DeleteFormType
• datazone:DeleteGlossary
• datazone:DeleteGlossaryTerm
• datazone:DeleteListing
• datazone:DeleteProject
• datazone:DeleteProjectMembership
• datazone:DeleteSubscriptionGrant
• datazone:DeleteSubscriptionRequest
• datazone:DeleteSubscriptionTarget
• datazone:GetAsset
• datazone:GetAssetType
• datazone:GetDataSource
• datazone:GetDataSourceRun
• datazone:GetDomain
• datazone:GetDomainSharingPolicy
• datazone:GetEnvironment
• datazone:GetEnvironmentActionLink
• datazone:GetEnvironmentBlueprint
• datazone:GetEnvironmentBlueprintConfiguration
• datazone:GetEnvironmentCredentials
• datazone:GetEnvironmentProfile
• datazone:GetFormType
• datazone:GetGlossary
• datazone:GetGlossaryTerm
• datazone:GetGroupProfile
• datazone:GetIamPortalLoginUrl
• datazone:GetListing
• datazone:GetSubscription
• datazone:GetSubscriptionEligibility
• datazone:GetSubscriptionGrant
• datazone:GetSubscriptionRequestDetails
• datazone:GetSubscriptionTarget
• datazone:GetUserProfile
• datazone:ListAccountEnvironments
• datazone:ListAssetRevisions
• datazone:ListDataSourceRunActivities
• datazone:ListDataSourceRuns
• datazone:ListDataSources
• datazone:ListDomains
• datazone:ListEnvironmentBlueprintConfigurations
• datazone:ListEnvironmentBlueprints
• datazone:ListEnvironmentProfiles
• datazone:ListEnvironments
• datazone:ListGroupsForUser
• datazone:ListNotifications
• datazone:ListProjectMemberships
• datazone:ListSubscriptionGrants
• datazone:ListSubscriptionRequests
• datazone:ListSubscriptionTargets
• datazone:ListSubscriptions
• datazone:ListTagsForResource
• datazone:ListWarehouseMetadata
• datazone:ProvisionDomain
• datazone:PutDomainSharingPolicy
• datazone:PutEnvironmentBlueprintConfiguration
• datazone:RefreshToken
• datazone:RejectPredictions
• datazone:RejectSubscriptionRequest
• datazone:RevokeSubscription
• datazone:Search
• datazone:SearchGroupProfiles
• datazone:SearchListings
• datazone:SearchTypes
• datazone:SearchUserProfiles
• datazone:SsoLogin
• datazone:SsoLogout
• datazone:StartDataSourceRun
• datazone:TagResource
• datazone:UntagResource
• datazone:UpdateDataSource
• datazone:UpdateDomain
• datazone:UpdateEnvironment
• datazone:UpdateEnvironmentBlueprint
• datazone:UpdateEnvironmentConfiguration
• datazone:UpdateEnvironmentDeploymentStatus
• datazone:UpdateEnvironmentProfile
• datazone:UpdateGlossary
• datazone:UpdateGlossaryTerm
• datazone:UpdateGroupProfile
• datazone:UpdateProject
• datazone:UpdateSubscriptionGrantStatus
• datazone:UpdateSubscriptionRequest
• datazone:UpdateSubscriptionTarget
• datazone:UpdateUserProfile
• datazone:ValidatePassRole

Amazon Bedrock

• bedrock:AssociateAgentKnowledgeBase
• bedrock:AssociateThirdPartyKnowledgeBase
• bedrock:CreateDataSource
• bedrock:CreateKnowledgeBase
• bedrock:DeleteDataSource
• bedrock:DeleteKnowledgeBase
• bedrock:DisassociateAgentKnowledgeBase
• bedrock:GetAgentKnowledgeBase
• bedrock:GetDataSource
• bedrock:GetFoundationModel
• bedrock:GetIngestionJob
• bedrock:GetKnowledgeBase
• bedrock:ListAgentKnowledgeBases
• bedrock:ListDataSources
• bedrock:ListIngestionJobs
• bedrock:ListKnowledgeBases
• bedrock:QueryKnowledgeBase
• bedrock:StartIngestionJob
• bedrock:UpdateAgentKnowledgeBase
• bedrock:UpdateDataSource
• bedrock:UpdateKnowledgeBase

Amazon WorkMail

• workmail:DescribeEntity
• workmail:ListGroupsForEntity
• workmail:UpdateGroup
• workmail:UpdateUser

Amazon Lookout for Equipment

• lookoutequipment:CreateRetrainingScheduler
• lookoutequipment:DeleteRetrainingScheduler
• lookoutequipment:DescribeRetrainingScheduler
• lookoutequipment:ListRetrainingSchedulers
• lookoutequipment:StartRetrainingScheduler
• lookoutequipment:StopRetrainingScheduler
• lookoutequipment:UpdateModel
• lookoutequipment:UpdateRetrainingScheduler

AWS Amplify UI Builder

• amplifyuibuilder:ExchangeCodeForToken
• amplifyuibuilder:RefreshToken

AWS Cloud Map

• servicediscovery:DiscoverInstancesRevision

Amazon EC2

• ec2:DisableImageBlockPublicAccess
• ec2:EnableImageBlockPublicAccess
• ec2:GetImageBlockPublicAccessState

AWS Health APIs and Notifications

• health:DescribeEntityAggregatesForOrganization

AWS Elastic Disaster Recovery

• drs:DeleteLaunchAction
• drs:ListLaunchActions
• drs:PutLaunchAction

Amazon Connect

• connect:CreateView
• connect:CreateViewVersion
• connect:DeleteView
• connect:DeleteViewVersion
• connect:DescribeView
• connect:ListViewVersions
• connect:ListViews
• connect:UpdateViewContent
• connect:UpdateViewMetadata

Amazon SageMaker

• sagemaker:GetScalingConfigurationRecommendation

Amazon CloudWatch Internet Monitor

• internetmonitor:GetQueryResults
• internetmonitor:GetQueryStatus
• internetmonitor:StartQuery
• internetmonitor:StopQuery

Amazon Simple Email Service v2

• ses:CancelExportJob
• ses:CreateExportJob
• ses:GetExportJob
• ses:GetMessageInsights
• ses:ListExportJobs

AWS CodeCommit

• codecommit:ListFileCommitHistory

AWS Compute Optimizer

• compute-optimizer:ExportLicenseRecommendations
• compute-optimizer:GetLicenseRecommendations

AWS Private CA Connector for Active Directory

• pca-connector-ad:CreateConnector
• pca-connector-ad:CreateDirectoryRegistration
• pca-connector-ad:CreateServicePrincipalName
• pca-connector-ad:CreateTemplate
• pca-connector-ad:CreateTemplateGroupAccessControlEntry
• pca-connector-ad:DeleteConnector
• pca-connector-ad:DeleteDirectoryRegistration
• pca-connector-ad:DeleteServicePrincipalName
• pca-connector-ad:DeleteTemplate
• pca-connector-ad:DeleteTemplateGroupAccessControlEntry
• pca-connector-ad:GetConnector
• pca-connector-ad:GetDirectoryRegistration
• pca-connector-ad:GetServicePrincipalName
• pca-connector-ad:GetTemplate
• pca-connector-ad:GetTemplateGroupAccessControlEntry
• pca-connector-ad:ListConnectors
• pca-connector-ad:ListDirectoryRegistrations
• pca-connector-ad:ListServicePrincipalNames
• pca-connector-ad:ListTagsForResource
• pca-connector-ad:ListTemplateGroupAccessControlEntries
• pca-connector-ad:ListTemplates
• pca-connector-ad:TagResource
• pca-connector-ad:UntagResource
• pca-connector-ad:UpdateTemplate
• pca-connector-ad:UpdateTemplateGroupAccessControlEntry

Amazon Personalize

• personalize:CreateDataInsightsJob
• personalize:DescribeDataInsightsJob
• personalize:GetDataInsights
• personalize:ListDataInsightsJobs

Amazon SageMaker

• sagemaker:ListResourceCatalogs

Amazon Cognito User Pools

• cognito-idp:GetLogDeliveryConfiguration
• cognito-idp:SetLogDeliveryConfiguration

AWS Marketplace Vendor Insights

• vendor-insights:UpdateDataSource

AWS Amplify UI Builder

• amplifyuibuilder:GetCodegenJob
• amplifyuibuilder:ListCodegenJobs
• amplifyuibuilder:StartCodegenJob

AWS HealthOmics

• omics:AcceptShare
• omics:CreateAnnotationStoreVersion
• omics:CreateShare
• omics:DeleteAnnotationStoreVersions
• omics:DeleteShare
• omics:GetAnnotationStoreVersion
• omics:GetShare
• omics:ListAnnotationStoreVersions
• omics:ListShares
• omics:UpdateAnnotationStoreVersion

AWS Performance Insights

• pi:CreatePerformanceAnalysisReport
• pi:DeletePerformanceAnalysisReport
• pi:GetPerformanceAnalysisReport
• pi:ListPerformanceAnalysisReports
• pi:ListTagsForResource
• pi:TagResource
• pi:UntagResource

Amazon Connect

• connect:AssociateTrafficDistributionGroupUser
• connect:DisassociateTrafficDistributionGroupUser
• connect:ListTrafficDistributionGroupUsers

Amazon ElastiCache

• elasticache:TestMigration

AWS Snowball

• snowball:ListPickupLocations

AWS Migration Acceleration Program Credits

• mapcredits:ListAssociatedPrograms
• mapcredits:ListQuarterCredits
• mapcredits:ListQuarterSpend

AWS Backup

• backup:CreateLogicallyAirGappedBackupVault
• backup:DeleteBackupVaultSharingPolicy
• backup:GetBackupVaultSharingPolicy
• backup:ListProtectedResourcesByBackupVault
• backup:PutBackupVaultSharingPolicy

Amazon Bedrock

• bedrock:CreateAgent
• bedrock:CreateAgentActionGroup
• bedrock:CreateAgentAlias
• bedrock:CreateAgentDraftSnapshot
• bedrock:GetAgent
• bedrock:GetAgentActionGroup
• bedrock:GetAgentAlias
• bedrock:GetAgentVersion
• bedrock:InvokeAgent
• bedrock:ListAgentActionGroups
• bedrock:ListAgentAliases
• bedrock:ListAgentVersions
• bedrock:ListAgents
• bedrock:UpdateAgent
• bedrock:UpdateAgentActionGroup
• bedrock:UpdateAgentAlias

AWS Artifact

• artifact:GetAccountSettings
• artifact:PutAccountSettings

Amazon CloudWatch Application Insights

• applicationinsights:AddWorkload
• applicationinsights:DescribeWorkload
• applicationinsights:ListWorkloads
• applicationinsights:RemoveWorkload
• applicationinsights:UpdateProblem
• applicationinsights:UpdateWorkload

Amazon Connect

• connect:UpdateRoutingProfileAgentAvailabilityTimer

AWS IQ Permissions

• iq-permission:AssumePermissionRole

AWS DataSync

• datasync:CreateLocationAzureBlob
• datasync:DescribeLocationAzureBlob
• datasync:UpdateLocationAzureBlob

Amazon RDS

• rds:DeleteDBClusterAutomatedBackup
• rds:DescribeDBClusterAutomatedBackups

AWS Resilience Hub

• resiliencehub:AddDraftAppVersionResourceMappings
• resiliencehub:BatchUpdateRecommendationStatus
• resiliencehub:CreateApp
• resiliencehub:CreateAppVersionAppComponent
• resiliencehub:CreateAppVersionResource
• resiliencehub:CreateRecommendationTemplate
• resiliencehub:CreateResiliencyPolicy
• resiliencehub:DeleteApp
• resiliencehub:DeleteAppAssessment
• resiliencehub:DeleteAppInputSource
• resiliencehub:DeleteAppVersionAppComponent
• resiliencehub:DeleteAppVersionResource
• resiliencehub:DeleteRecommendationTemplate
• resiliencehub:DeleteResiliencyPolicy
• resiliencehub:DescribeApp
• resiliencehub:DescribeAppAssessment
• resiliencehub:DescribeAppVersion
• resiliencehub:DescribeAppVersionAppComponent
• resiliencehub:DescribeAppVersionResource
• resiliencehub:DescribeAppVersionResourcesResolutionStatus
• resiliencehub:DescribeAppVersionTemplate
• resiliencehub:DescribeDraftAppVersionResourcesImportStatus
• resiliencehub:DescribeResiliencyPolicy
• resiliencehub:ImportResourcesToDraftAppVersion
• resiliencehub:ListAlarmRecommendations
• resiliencehub:ListAppAssessmentComplianceDrifts
• resiliencehub:ListAppAssessments
• resiliencehub:ListAppComponentCompliances
• resiliencehub:ListAppComponentRecommendations
• resiliencehub:ListAppInputSources
• resiliencehub:ListAppVersionAppComponents
• resiliencehub:ListAppVersionResourceMappings
• resiliencehub:ListAppVersionResources
• resiliencehub:ListAppVersions
• resiliencehub:ListApps
• resiliencehub:ListRecommendationTemplates
• resiliencehub:ListResiliencyPolicies
• resiliencehub:ListSopRecommendations
• resiliencehub:ListSuggestedResiliencyPolicies
• resiliencehub:ListTagsForResource
• resiliencehub:ListTestRecommendations
• resiliencehub:ListUnsupportedAppVersionResources
• resiliencehub:PublishAppVersion
• resiliencehub:PutDraftAppVersionTemplate
• resiliencehub:RemoveDraftAppVersionResourceMappings
• resiliencehub:ResolveAppVersionResources
• resiliencehub:StartAppAssessment
• resiliencehub:TagResource
• resiliencehub:UntagResource
• resiliencehub:UpdateApp
• resiliencehub:UpdateAppVersion
• resiliencehub:UpdateAppVersionAppComponent
• resiliencehub:UpdateAppVersionResource
• resiliencehub:UpdateResiliencyPolicy

Amazon Inspector2

• inspector2:BatchGetFindingDetails

Amazon Lookout for Equipment

• lookoutequipment:DeleteResourcePolicy
• lookoutequipment:DescribeModelVersion
• lookoutequipment:DescribeResourcePolicy
• lookoutequipment:ImportDataset
• lookoutequipment:ImportModelVersion
• lookoutequipment:ListModelVersions
• lookoutequipment:PutResourcePolicy
• lookoutequipment:UpdateActiveModelVersion

AWS Mainframe Modernization Service

• m2:GetSignedBluinsightsUrl

AWS Clean Rooms

• cleanrooms:BatchGetCollaborationAnalysisTemplate
• cleanrooms:CreateAnalysisTemplate
• cleanrooms:DeleteAnalysisTemplate
• cleanrooms:GetAnalysisTemplate
• cleanrooms:GetCollaborationAnalysisTemplate
• cleanrooms:ListAnalysisTemplates
• cleanrooms:ListCollaborationAnalysisTemplates
• cleanrooms:UpdateAnalysisTemplate

AWS Elemental MediaLive

• medialive:DescribeAccountConfiguration
• medialive:DescribeThumbnails
• medialive:UpdateAccountConfiguration

Amazon WorkDocs

• workdocs:UpdateUserAdministrativeSettings

Amazon Managed Streaming for Apache Kafka

• kafka:DescribeClusterOperationV2
• kafka:ListClusterOperationsV2

AWS Proton

• proton:DeleteDeployment
• proton:GetDeployment
• proton:ListDeployments

AWS Cost Explorer Service

• ce:GetSavingsPlanPurchaseRecommendationDetails

Amazon Interactive Video Service

• ivs:BatchStartViewerSessionRevocation
• ivs:StartViewerSessionRevocation

Amazon Lex V2

• lex:ListIntentMetrics
• lex:ListIntentPaths
• lex:ListIntentStageMetrics
• lex:ListSessionAnalyticsData
• lex:ListSessionMetrics

Amazon Managed Blockchain

• managedblockchain:InvokeRpcBitcoinMainnet
• managedblockchain:InvokeRpcBitcoinTestnet

AWS Trusted Advisor

• trustedadvisor:UpdateEngagement

AWS Entity Resolution

• entityresolution:CreateMatchingWorkflow
• entityresolution:CreateSchemaMapping
• entityresolution:DeleteMatchingWorkflow
• entityresolution:DeleteSchemaMapping
• entityresolution:GetMatchId
• entityresolution:GetMatchingJob
• entityresolution:GetMatchingWorkflow
• entityresolution:GetSchemaMapping
• entityresolution:ListMatchingJobs
• entityresolution:ListMatchingWorkflows
• entityresolution:ListSchemaMappings
• entityresolution:ListTagsForResource
• entityresolution:StartMatchingJob
• entityresolution:TagResource
• entityresolution:UntagResource
• entityresolution:UpdateMatchingWorkflow

Amazon Managed Blockchain Query

• managedblockchain-query:BatchGetTokenBalance
• managedblockchain-query:GetTokenBalance
• managedblockchain-query:GetTransaction
• managedblockchain-query:ListTokenBalances
• managedblockchain-query:ListTransactionEvents
• managedblockchain-query:ListTransactions

Amazon Connect Customer Profiles

• profile:GetSimilarProfiles
• profile:ListRuleBasedMatches

Amazon QuickSight

• quicksight:DescribeDashboardSnapshotJob
• quicksight:DescribeDashboardSnapshotJobResult
• quicksight:SearchUsers
• quicksight:StartDashboardSnapshotJob

Amazon Route 53 Resolver

• route53resolver:CreateOutpostResolver
• route53resolver:DeleteOutpostResolver
• route53resolver:GetOutpostResolver
• route53resolver:ListOutpostResolvers
• route53resolver:UpdateOutpostResolver

AWS Systems Manager for SAP

• ssm-sap:StartApplicationRefresh

AWS Transfer Family

• transfer:TestConnection

AWS HealthLake

• healthlake:CreateFHIRDatastore
• healthlake:CreateResource
• healthlake:DeleteFHIRDatastore
• healthlake:DeleteResource
• healthlake:DescribeFHIRDatastore
• healthlake:DescribeFHIRExportJob
• healthlake:DescribeFHIRImportJob
• healthlake:GetCapabilities
• healthlake:ListFHIRDatastores
• healthlake:ListFHIRExportJobs
• healthlake:ListFHIRImportJobs
• healthlake:ListTagsForResource
• healthlake:ReadResource
• healthlake:SearchWithGet
• healthlake:SearchWithPost
• healthlake:StartFHIRExportJob
• healthlake:StartFHIRImportJob
• healthlake:TagResource
• healthlake:UntagResource
• healthlake:UpdateResource

AWS HealthOmics

• omics:AbortMultipartReadSetUpload
• omics:BatchDeleteReadSet
• omics:CancelAnnotationImportJob
• omics:CancelRun
• omics:CancelVariantImportJob
• omics:CompleteMultipartReadSetUpload
• omics:CreateAnnotationStore
• omics:CreateMultipartReadSetUpload
• omics:CreateReferenceStore
• omics:CreateRunGroup
• omics:CreateSequenceStore
• omics:CreateVariantStore
• omics:CreateWorkflow
• omics:DeleteAnnotationStore
• omics:DeleteReference
• omics:DeleteReferenceStore
• omics:DeleteRun
• omics:DeleteRunGroup
• omics:DeleteSequenceStore
• omics:DeleteVariantStore
• omics:DeleteWorkflow
• omics:GetAnnotationImportJob
• omics:GetAnnotationStore
• omics:GetReadSet
• omics:GetReadSetActivationJob
• omics:GetReadSetExportJob
• omics:GetReadSetImportJob
• omics:GetReadSetMetadata
• omics:GetReference
• omics:GetReferenceImportJob
• omics:GetReferenceMetadata
• omics:GetReferenceStore
• omics:GetRun
• omics:GetRunGroup
• omics:GetRunTask
• omics:GetSequenceStore
• omics:GetVariantImportJob
• omics:GetVariantStore
• omics:GetWorkflow
• omics:ListAnnotationImportJobs
• omics:ListAnnotationStores
• omics:ListMultipartReadSetUploads
• omics:ListReadSetActivationJobs
• omics:ListReadSetExportJobs
• omics:ListReadSetImportJobs
• omics:ListReadSetUploadParts
• omics:ListReadSets
• omics:ListReferenceImportJobs
• omics:ListReferenceStores
• omics:ListReferences
• omics:ListRunGroups
• omics:ListRunTasks
• omics:ListRuns
• omics:ListSequenceStores
• omics:ListTagsForResource
• omics:ListVariantImportJobs
• omics:ListVariantStores
• omics:ListWorkflows
• omics:StartAnnotationImportJob
• omics:StartReadSetActivationJob
• omics:StartReadSetExportJob
• omics:StartReadSetImportJob
• omics:StartReferenceImportJob
• omics:StartRun
• omics:StartVariantImportJob
• omics:TagResource
• omics:UntagResource
• omics:UpdateAnnotationStore
• omics:UpdateRunGroup
• omics:UpdateVariantStore
• omics:UpdateWorkflow
• omics:UploadReadSetPart

Amazon Personalize

• personalize:UpdateDataset

AWS Directory Service

• ds:UpdateAuthorizedApplication

Amazon Security Lake

• securitylake:ListTagsForResource
• securitylake:TagResource
• securitylake:UntagResource

AWS HealthImaging

• medical-imaging:CopyImageSet
• medical-imaging:CreateDatastore
• medical-imaging:DeleteDatastore
• medical-imaging:DeleteImageSet
• medical-imaging:GetDICOMImportJob
• medical-imaging:GetDatastore
• medical-imaging:GetImageFrame
• medical-imaging:GetImageSet
• medical-imaging:GetImageSetMetadata
• medical-imaging:ListDICOMImportJobs
• medical-imaging:ListDatastores
• medical-imaging:ListImageSetVersions
• medical-imaging:ListTagsForResource
• medical-imaging:SearchImageSets
• medical-imaging:StartDICOMImportJob
• medical-imaging:TagResource
• medical-imaging:UntagResource
• medical-imaging:UpdateImageSetMetadata

Amazon Managed Grafana

• grafana:ListVersions

Amazon MQ

• mq:Promote

Amazon SageMaker

• sagemaker:GetScalingPolicyConfigurationRecommendation

Amazon Bedrock

• bedrock:CreateModelCustomizationJob
• bedrock:DeleteCustomModel
• bedrock:DeletePrompt
• bedrock:GetCustomModel
• bedrock:GetModelCustomizationJob
• bedrock:GetPrompt
• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream
• bedrock:ListCustomModels
• bedrock:ListFoundationModels
• bedrock:ListModelCustomizationJobs
• bedrock:ListPrompts
• bedrock:ListTagsForResource
• bedrock:StopModelCustomizationJob
• bedrock:TagResource
• bedrock:UntagResource
• bedrock:UpdatePrompt

AWS SQL Workbench

• sqlworkbench:GetAutocompletionMetadata
• sqlworkbench:GetAutocompletionResource

Amazon Connect

• connect:DeleteQueue
• connect:DeleteRoutingProfile

Amazon FSx

• fsx:BypassSnaplockEnterpriseRetention

Amazon Redshift

• redshift:CreateCustomDomainAssociation
• redshift:DeleteCustomDomainAssociation
• redshift:DescribeCustomDomainAssociations
• redshift:ModifyCustomDomainAssociation

Amazon AppStream 2.0

• appstream:AssociateAppBlockBuilderAppBlock
• appstream:CreateAppBlockBuilder
• appstream:CreateAppBlockBuilderStreamingURL
• appstream:DeleteAppBlockBuilder
• appstream:DescribeAppBlockBuilderAppBlockAssociations
• appstream:DescribeAppBlockBuilders
• appstream:DisassociateAppBlockBuilderAppBlock
• appstream:StartAppBlockBuilder
• appstream:StopAppBlockBuilder
• appstream:UpdateAppBlockBuilder

Amazon Elastic MapReduce

• elasticmapreduce:ListSupportedInstanceTypes

AWS IQ

• iq:DisableIndividualPublicProfile
• iq:EnableIndividualPublicProfile
• iq:GetCompanyChatMessages
• iq:LinkAwsCertification
• iq:ListExpertAccessLogs
• iq:UnlinkAwsCertification

Amazon Kinesis Video Streams

• kinesisvideo:DeleteEdgeConfiguration
• kinesisvideo:ListEdgeAgentConfigurations

AWS AppFabric

• appfabric:BatchGetUserAccessTasks
• appfabric:ConnectAppAuthorization
• appfabric:CreateAppAuthorization
• appfabric:CreateAppBundle
• appfabric:CreateIngestion
• appfabric:CreateIngestionDestination
• appfabric:DeleteAppAuthorization
• appfabric:DeleteAppBundle
• appfabric:DeleteIngestion
• appfabric:DeleteIngestionDestination
• appfabric:GetAppAuthorization
• appfabric:GetAppBundle
• appfabric:GetIngestion
• appfabric:GetIngestionDestination
• appfabric:ListAppAuthorizations
• appfabric:ListAppBundles
• appfabric:ListIngestionDestinations
• appfabric:ListIngestions
• appfabric:ListTagsForResource
• appfabric:StartIngestion
• appfabric:StartUserAccessTasks
• appfabric:StopIngestion
• appfabric:TagResource
• appfabric:UntagResource
• appfabric:UpdateAppAuthorization
• appfabric:UpdateIngestionDestination

Amazon AppFlow

• appflow:ResetConnectorMetadataCache

AWS CloudFormation

• cloudformation:ActivateOrganizationsAccess
• cloudformation:DeactivateOrganizationsAccess
• cloudformation:DescribeOrganizationsAccess
• cloudformation:ListStackInstanceResourceDrifts

Amazon Connect

• connect:SearchResourceTags

Amazon Interactive Video Service

• ivs:GetParticipant
• ivs:GetStageSession
• ivs:ListParticipantEvents
• ivs:ListParticipants
• ivs:ListStageSessions

Amazon Lex V2

• lex:CreateTestSet
• lex:CreateTestSetDiscrepancyReport
• lex:DeleteTestSet
• lex:DescribeTestExecution
• lex:DescribeTestSet
• lex:DescribeTestSetDiscrepancyReport
• lex:DescribeTestSetGeneration
• lex:GetTestExecutionArtifactsUrl
• lex:ListTestExecutionResultItems
• lex:ListTestExecutions
• lex:ListTestSetRecords
• lex:ListTestSets
• lex:StartTestExecution
• lex:StartTestSetGeneration
• lex:UpdateTestSet

Amazon Kendra

• kendra:Retrieve

AWS Step Functions

• states:CreateStateMachineAlias
• states:DeleteStateMachineAlias
• states:DeleteStateMachineVersion
• states:DescribeStateMachineAlias
• states:ListStateMachineAliases
• states:ListStateMachineVersions
• states:PublishStateMachineVersion
• states:UpdateStateMachineAlias

AWS Identity and Access Management (IAM)

• iam:AddClientIDToOpenIDConnectProvider
• iam:AddRoleToInstanceProfile
• iam:AddUserToGroup
• iam:AttachGroupPolicy
• iam:AttachRolePolicy
• iam:AttachUserPolicy
• iam:ChangePassword
• iam:CreateAccessKey
• iam:CreateAccountAlias
• iam:CreateGroup
• iam:CreateInstanceProfile
• iam:CreateLoginProfile
• iam:CreateOpenIDConnectProvider
• iam:CreatePolicy
• iam:CreatePolicyVersion
• iam:CreateRole
• iam:CreateSAMLProvider
• iam:CreateServiceLinkedRole
• iam:CreateServiceSpecificCredential
• iam:CreateUser
• iam:CreateVirtualMFADevice
• iam:DeactivateMFADevice
• iam:DeleteAccessKey
• iam:DeleteAccountAlias
• iam:DeleteAccountPasswordPolicy
• iam:DeleteCloudFrontPublicKey
• iam:DeleteGroup
• iam:DeleteGroupPolicy
• iam:DeleteInstanceProfile
• iam:DeleteLoginProfile
• iam:DeleteOpenIDConnectProvider
• iam:DeletePolicy
• iam:DeletePolicyVersion
• iam:DeleteRole
• iam:DeleteRolePermissionsBoundary
• iam:DeleteRolePolicy
• iam:DeleteSAMLProvider
• iam:DeleteSSHPublicKey
• iam:DeleteServerCertificate
• iam:DeleteServiceLinkedRole
• iam:DeleteServiceSpecificCredential
• iam:DeleteSigningCertificate
• iam:DeleteUser
• iam:DeleteUserPermissionsBoundary
• iam:DeleteUserPolicy
• iam:DeleteVirtualMFADevice
• iam:DetachGroupPolicy
• iam:DetachRolePolicy
• iam:DetachUserPolicy
• iam:EnableMFADevice
• iam:GenerateCredentialReport
• iam:GenerateOrganizationsAccessReport
• iam:GenerateServiceLastAccessedDetails
• iam:GetAccessKeyLastUsed
• iam:GetAccountAuthorizationDetails
• iam:GetAccountEmailAddress
• iam:GetAccountName
• iam:GetAccountPasswordPolicy
• iam:GetAccountSummary
• iam:GetCloudFrontPublicKey
• iam:GetContextKeysForCustomPolicy
• iam:GetContextKeysForPrincipalPolicy
• iam:GetCredentialReport
• iam:GetGroup
• iam:GetGroupPolicy
• iam:GetInstanceProfile
• iam:GetLoginProfile
• iam:GetMFADevice
• iam:GetOpenIDConnectProvider
• iam:GetOrganizationsAccessReport
• iam:GetPolicy
• iam:GetPolicyVersion
• iam:GetRole
• iam:GetRolePolicy
• iam:GetSAMLProvider
• iam:GetSSHPublicKey
• iam:GetServerCertificate
• iam:GetServiceLastAccessedDetails
• iam:GetServiceLastAccessedDetailsWithEntities
• iam:GetServiceLinkedRoleDeletionStatus
• iam:GetUser
• iam:GetUserPolicy
• iam:ListAccessKeys
• iam:ListAccountAliases
• iam:ListAttachedGroupPolicies
• iam:ListAttachedRolePolicies
• iam:ListAttachedUserPolicies
• iam:ListCloudFrontPublicKeys
• iam:ListEntitiesForPolicy
• iam:ListGroupPolicies
• iam:ListGroups
• iam:ListGroupsForUser
• iam:ListInstanceProfileTags
• iam:ListInstanceProfiles
• iam:ListInstanceProfilesForRole
• iam:ListMFADeviceTags
• iam:ListMFADevices
• iam:ListOpenIDConnectProviderTags
• iam:ListOpenIDConnectProviders
• iam:ListPolicies
• iam:ListPoliciesGrantingServiceAccess
• iam:ListPolicyTags
• iam:ListPolicyVersions
• iam:ListRolePolicies
• iam:ListRoleTags
• iam:ListRoles
• iam:ListSAMLProviderTags
• iam:ListSAMLProviders
• iam:ListSSHPublicKeys
• iam:ListSTSRegionalEndpointsStatus
• iam:ListServerCertificateTags
• iam:ListServerCertificates
• iam:ListServiceSpecificCredentials
• iam:ListSigningCertificates
• iam:ListUserPolicies
• iam:ListUserTags
• iam:ListUsers
• iam:ListVirtualMFADevices
• iam:PassRole
• iam:PutGroupPolicy
• iam:PutRolePermissionsBoundary
• iam:PutRolePolicy
• iam:PutUserPermissionsBoundary
• iam:PutUserPolicy
• iam:RemoveClientIDFromOpenIDConnectProvider
• iam:RemoveRoleFromInstanceProfile
• iam:RemoveUserFromGroup
• iam:ResetServiceSpecificCredential
• iam:ResyncMFADevice
• iam:SetDefaultPolicyVersion
• iam:SetSTSRegionalEndpointStatus
• iam:SetSecurityTokenServicePreferences
• iam:SimulateCustomPolicy
• iam:SimulatePrincipalPolicy
• iam:TagInstanceProfile
• iam:TagMFADevice
• iam:TagOpenIDConnectProvider
• iam:TagPolicy
• iam:TagRole
• iam:TagSAMLProvider
• iam:TagServerCertificate
• iam:TagUser
• iam:UntagInstanceProfile
• iam:UntagMFADevice
• iam:UntagOpenIDConnectProvider
• iam:UntagPolicy
• iam:UntagRole
• iam:UntagSAMLProvider
• iam:UntagServerCertificate
• iam:UntagUser
• iam:UpdateAccessKey
• iam:UpdateAccountEmailAddress
• iam:UpdateAccountName
• iam:UpdateAccountPasswordPolicy
• iam:UpdateAssumeRolePolicy
• iam:UpdateCloudFrontPublicKey
• iam:UpdateGroup
• iam:UpdateLoginProfile
• iam:UpdateOpenIDConnectProviderThumbprint
• iam:UpdateRole
• iam:UpdateRoleDescription
• iam:UpdateSAMLProvider
• iam:UpdateSSHPublicKey
• iam:UpdateServerCertificate
• iam:UpdateServiceSpecificCredential
• iam:UpdateSigningCertificate
• iam:UpdateUser
• iam:UploadCloudFrontPublicKey
• iam:UploadSSHPublicKey
• iam:UploadServerCertificate
• iam:UploadSigningCertificate

AWS Audit Manager

• auditmanager:GetEvidenceFileUploadUrl

Amazon EC2

• ec2:CreateInstanceConnectEndpoint
• ec2:DeleteInstanceConnectEndpoint
• ec2:DescribeInstanceConnectEndpoints

AWS Support

• support:DescribeCreateCaseOptions
• support:DescribeSupportedLanguages

AWS Application Migration Service

• mgn:ListManagedAccounts
• mgn:PauseReplication
• mgn:ResumeReplication
• mgn:StopReplication

AWS Purchase Orders Console

• purchase-orders:ListTagsForResource
• purchase-orders:TagResource
• purchase-orders:UntagResource

Amazon CloudWatch Logs

• logs:DeleteAccountPolicy
• logs:DescribeAccountPolicies
• logs:PutAccountPolicy

AWS Database Migration Service

• dms:DescribeConversionConfiguration
• dms:DescribeDataProviders
• dms:DescribeExtensionPackAssociations
• dms:DescribeInstanceProfiles
• dms:DescribeMetadataModelAssessments
• dms:DescribeMetadataModelConversions
• dms:DescribeMetadataModelExportsAsScript
• dms:DescribeMetadataModelExportsToTarget
• dms:DescribeMetadataModelImports
• dms:DescribeMigrationProjects
• dms:ModifyConversionConfiguration
• dms:ModifyDataProvider
• dms:ModifyInstanceProfile
• dms:ModifyMigrationProject
• dms:StartExtensionPackAssociation
• dms:StartMetadataModelExportAsScript

AWS Payment Cryptography

• payment-cryptography:CreateAlias
• payment-cryptography:CreateKey
• payment-cryptography:DecryptData
• payment-cryptography:DeleteAlias
• payment-cryptography:DeleteKey
• payment-cryptography:EncryptData
• payment-cryptography:ExportKey
• payment-cryptography:GenerateCardValidationData
• payment-cryptography:GenerateMac
• payment-cryptography:GeneratePinData
• payment-cryptography:GetAlias
• payment-cryptography:GetKey
• payment-cryptography:GetParametersForExport
• payment-cryptography:GetParametersForImport
• payment-cryptography:GetPublicKeyCertificate
• payment-cryptography:ImportKey
• payment-cryptography:ListAliases
• payment-cryptography:ListKeys
• payment-cryptography:ListTagsForResource
• payment-cryptography:ReEncryptData
• payment-cryptography:RestoreKey
• payment-cryptography:StartKeyUsage
• payment-cryptography:StopKeyUsage
• payment-cryptography:TagResource
• payment-cryptography:TranslatePinData
• payment-cryptography:UntagResource
• payment-cryptography:UpdateAlias
• payment-cryptography:VerifyAuthRequestCryptogram
• payment-cryptography:VerifyCardValidationData
• payment-cryptography:VerifyMac
• payment-cryptography:VerifyPinData

AWS DataSync

• datasync:UpdateDiscoveryJob

Amazon QuickSight

• quicksight:ListCustomerManagedKeys
• quicksight:ListKMSKeysForUser
• quicksight:RegisterCustomerManagedKey
• quicksight:RemoveCustomerManagedKey

Amazon Rekognition

• rekognition:AssociateFaces
• rekognition:CreateUser
• rekognition:DeleteUser
• rekognition:DisassociateFaces
• rekognition:ListUsers
• rekognition:SearchUsers
• rekognition:SearchUsersByImage

Amazon EC2 Instance Connect

• ec2-instance-connect:OpenTunnel

AWS Elastic Disaster Recovery

• drs:AssociateSourceNetworkStack
• drs:CreateSourceNetwork
• drs:DeleteSourceNetwork
• drs:DescribeSourceNetworks
• drs:ExportSourceNetworkCfnTemplate
• drs:StartSourceNetworkRecovery
• drs:StartSourceNetworkReplication
• drs:StopSourceNetworkReplication

Amazon Inspector2

• inspector2:CancelSbomExport
• inspector2:CreateSbomExport
• inspector2:GetEncryptionKey
• inspector2:GetSbomExport
• inspector2:ResetEncryptionKey
• inspector2:UpdateEncryptionKey

AWS Security Hub

• securityhub:BatchDeleteAutomationRules
• securityhub:BatchGetAutomationRules
• securityhub:BatchUpdateAutomationRules
• securityhub:CreateAutomationRule
• securityhub:ListAutomationRules

AWS Well-Architected Tool

• wellarchitected:AssociateProfiles
• wellarchitected:CreateProfile
• wellarchitected:CreateProfileShare
• wellarchitected:DeleteProfile
• wellarchitected:DeleteProfileShare
• wellarchitected:DisassociateProfiles
• wellarchitected:GetProfile
• wellarchitected:GetProfileTemplate
• wellarchitected:ListProfileNotifications
• wellarchitected:ListProfileShares
• wellarchitected:ListProfiles
• wellarchitected:UpdateProfile
• wellarchitected:UpgradeProfileVersion

Amazon Verified Permissions

• verifiedpermissions:CreateIdentitySource
• verifiedpermissions:CreatePolicy
• verifiedpermissions:CreatePolicyStore
• verifiedpermissions:CreatePolicyTemplate
• verifiedpermissions:DeleteIdentitySource
• verifiedpermissions:DeletePolicy
• verifiedpermissions:DeletePolicyStore
• verifiedpermissions:DeletePolicyTemplate
• verifiedpermissions:GetIdentitySource
• verifiedpermissions:GetPolicy
• verifiedpermissions:GetPolicyStore
• verifiedpermissions:GetPolicyTemplate
• verifiedpermissions:GetSchema
• verifiedpermissions:IsAuthorized
• verifiedpermissions:IsAuthorizedWithToken
• verifiedpermissions:ListIdentitySources
• verifiedpermissions:ListPolicies
• verifiedpermissions:ListPolicyStores
• verifiedpermissions:ListPolicyTemplates
• verifiedpermissions:PutSchema
• verifiedpermissions:UpdateIdentitySource
• verifiedpermissions:UpdatePolicy
• verifiedpermissions:UpdatePolicyStore
• verifiedpermissions:UpdatePolicyTemplate

Amazon CodeGuru Security

• codeguru-security:GetMetricsSummary
• codeguru-security:ListFindingsMetrics
• codeguru-security:ListTagsForResource
• codeguru-security:TagResource
• codeguru-security:UntagResource

Amazon Connect

• connect:SearchHoursOfOperations
• connect:SearchPrompts
• connect:SearchQuickConnects

Amazon Connect Customer Profiles

• profile:CreateCalculatedAttributeDefinition
• profile:CreateEventStream
• profile:DeleteCalculatedAttributeDefinition
• profile:DeleteEventStream
• profile:GetCalculatedAttributeDefinition
• profile:GetCalculatedAttributeForProfile
• profile:GetEventStream
• profile:ListCalculatedAttributeDefinitions
• profile:ListCalculatedAttributesForProfile
• profile:ListEventStreams
• profile:UpdateCalculatedAttributeDefinition

Amazon SQS

• sqs:CancelMessageMoveTask
• sqs:ListMessageMoveTasks
• sqs:StartMessageMoveTask

AWS Elastic Load Balancing V2

• elasticloadbalancing:AddListenerCertificates
• elasticloadbalancing:AddTags
• elasticloadbalancing:CreateListener
• elasticloadbalancing:CreateLoadBalancer
• elasticloadbalancing:CreateRule
• elasticloadbalancing:CreateTargetGroup
• elasticloadbalancing:DeleteListener
• elasticloadbalancing:DeleteLoadBalancer
• elasticloadbalancing:DeleteRule
• elasticloadbalancing:DeleteTargetGroup
• elasticloadbalancing:DeregisterTargets
• elasticloadbalancing:DescribeAccountLimits
• elasticloadbalancing:DescribeListenerCertificates
• elasticloadbalancing:DescribeListeners
• elasticloadbalancing:DescribeLoadBalancerAttributes
• elasticloadbalancing:DescribeLoadBalancers
• elasticloadbalancing:DescribeRules
• elasticloadbalancing:DescribeSSLPolicies
• elasticloadbalancing:DescribeTags
• elasticloadbalancing:DescribeTargetGroupAttributes
• elasticloadbalancing:DescribeTargetGroups
• elasticloadbalancing:DescribeTargetHealth
• elasticloadbalancing:ModifyListener
• elasticloadbalancing:ModifyLoadBalancerAttributes
• elasticloadbalancing:ModifyRule
• elasticloadbalancing:ModifyTargetGroup
• elasticloadbalancing:ModifyTargetGroupAttributes
• elasticloadbalancing:RegisterTargets
• elasticloadbalancing:RemoveListenerCertificates
• elasticloadbalancing:RemoveTags
• elasticloadbalancing:SetIpAddressType
• elasticloadbalancing:SetRulePriorities
• elasticloadbalancing:SetSecurityGroups
• elasticloadbalancing:SetSubnets
• elasticloadbalancing:SetWebAcl

Amazon FinSpace

• finspace:ConnectKxCluster
• finspace:CreateKxChangeset
• finspace:CreateKxCluster
• finspace:CreateKxDatabase
• finspace:CreateKxEnvironment
• finspace:CreateKxUser
• finspace:DeleteKxCluster
• finspace:DeleteKxDatabase
• finspace:DeleteKxEnvironment
• finspace:DeleteKxUser
• finspace:GetKxChangeset
• finspace:GetKxCluster
• finspace:GetKxConnectionString
• finspace:GetKxDatabase
• finspace:GetKxEnvironment
• finspace:GetKxUser
• finspace:ListKxChangesets
• finspace:ListKxClusterNodes
• finspace:ListKxClusters
• finspace:ListKxDatabases
• finspace:ListKxEnvironments
• finspace:ListKxUsers
• finspace:MountKxDatabase
• finspace:UpdateKxClusterDatabases
• finspace:UpdateKxDatabase
• finspace:UpdateKxEnvironment
• finspace:UpdateKxEnvironmentNetwork
• finspace:UpdateKxUser

AWS IoT

• iot:CreatePackage
• iot:CreatePackageVersion
• iot:DeletePackage
• iot:DeletePackageVersion
• iot:GetPackage
• iot:GetPackageConfiguration
• iot:GetPackageVersion
• iot:ListPackageVersions
• iot:ListPackages
• iot:UpdatePackage
• iot:UpdatePackageConfiguration
• iot:UpdatePackageVersion

AWS Signer

• signer:GetRevocationStatus
• signer:SignPayload

Amazon CloudWatch Logs

• logs:StartLiveTail
• logs:StopLiveTail

AWS WAF V2

• wafv2:DescribeAllManagedProducts
• wafv2:DescribeManagedProductsByVendor

Amazon EC2

• ec2:AcceptAddressTransfer
• ec2:AcceptReservedInstancesExchangeQuote
• ec2:AcceptTransitGatewayMulticastDomainAssociations
• ec2:AcceptTransitGatewayPeeringAttachment
• ec2:AcceptTransitGatewayVpcAttachment
• ec2:AcceptVpcEndpointConnections
• ec2:AcceptVpcPeeringConnection
• ec2:AdvertiseByoipCidr
• ec2:AllocateAddress
• ec2:AllocateHosts
• ec2:AllocateIpamPoolCidr
• ec2:ApplySecurityGroupsToClientVpnTargetNetwork
• ec2:AssignIpv6Addresses
• ec2:AssignPrivateIpAddresses
• ec2:AssignPrivateNatGatewayAddress
• ec2:AssociateAddress
• ec2:AssociateClientVpnTargetNetwork
• ec2:AssociateDhcpOptions
• ec2:AssociateEnclaveCertificateIamRole
• ec2:AssociateIamInstanceProfile
• ec2:AssociateInstanceEventWindow
• ec2:AssociateIpamResourceDiscovery
• ec2:AssociateNatGatewayAddress
• ec2:AssociateRouteTable
• ec2:AssociateSubnetCidrBlock
• ec2:AssociateTransitGatewayMulticastDomain
• ec2:AssociateTransitGatewayPolicyTable
• ec2:AssociateTransitGatewayRouteTable
• ec2:AssociateTrunkInterface
• ec2:AssociateVerifiedAccessInstanceWebAcl
• ec2:AssociateVpcCidrBlock
• ec2:AttachClassicLinkVpc
• ec2:AttachInternetGateway
• ec2:AttachNetworkInterface
• ec2:AttachVerifiedAccessTrustProvider
• ec2:AttachVolume
• ec2:AttachVpnGateway
• ec2:AuthorizeClientVpnIngress
• ec2:AuthorizeSecurityGroupEgress
• ec2:AuthorizeSecurityGroupIngress
• ec2:BundleInstance
• ec2:CancelBundleTask
• ec2:CancelCapacityReservation
• ec2:CancelCapacityReservationFleets
• ec2:CancelConversionTask
• ec2:CancelExportTask
• ec2:CancelImageLaunchPermission
• ec2:CancelImportTask
• ec2:CancelReservedInstancesListing
• ec2:CancelSpotFleetRequests
• ec2:CancelSpotInstanceRequests
• ec2:ConfirmProductInstance
• ec2:CopyFpgaImage
• ec2:CopyImage
• ec2:CopySnapshot
• ec2:CreateCapacityReservation
• ec2:CreateCapacityReservationFleet
• ec2:CreateCarrierGateway
• ec2:CreateClientVpnEndpoint
• ec2:CreateClientVpnRoute
• ec2:CreateCoipCidr
• ec2:CreateCoipPool
• ec2:CreateCoipPoolPermission
• ec2:CreateCustomerGateway
• ec2:CreateDefaultSubnet
• ec2:CreateDefaultVpc
• ec2:CreateDhcpOptions
• ec2:CreateEgressOnlyInternetGateway
• ec2:CreateFleet
• ec2:CreateFlowLogs
• ec2:CreateFpgaImage
• ec2:CreateImage
• ec2:CreateInstanceEventWindow
• ec2:CreateInstanceExportTask
• ec2:CreateInternetGateway
• ec2:CreateIpam
• ec2:CreateIpamPool
• ec2:CreateIpamResourceDiscovery
• ec2:CreateIpamScope
• ec2:CreateKeyPair
• ec2:CreateLaunchTemplate
• ec2:CreateLaunchTemplateVersion
• ec2:CreateLocalGatewayRoute
• ec2:CreateLocalGatewayRouteTable
• ec2:CreateLocalGatewayRouteTablePermission
• ec2:CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation
• ec2:CreateLocalGatewayRouteTableVpcAssociation
• ec2:CreateManagedPrefixList
• ec2:CreateNatGateway
• ec2:CreateNetworkAcl
• ec2:CreateNetworkAclEntry
• ec2:CreateNetworkInsightsAccessScope
• ec2:CreateNetworkInsightsPath
• ec2:CreateNetworkInterface
• ec2:CreateNetworkInterfacePermission
• ec2:CreatePlacementGroup
• ec2:CreatePublicIpv4Pool
• ec2:CreateReplaceRootVolumeTask
• ec2:CreateReservedInstancesListing
• ec2:CreateRestoreImageTask
• ec2:CreateRoute
• ec2:CreateRouteTable
• ec2:CreateSecurityGroup
• ec2:CreateSnapshot
• ec2:CreateSnapshots
• ec2:CreateSpotDatafeedSubscription
• ec2:CreateStoreImageTask
• ec2:CreateSubnet
• ec2:CreateSubnetCidrReservation
• ec2:CreateTags
• ec2:CreateTrafficMirrorFilter
• ec2:CreateTrafficMirrorFilterRule
• ec2:CreateTrafficMirrorSession
• ec2:CreateTrafficMirrorTarget
• ec2:CreateTransitGateway
• ec2:CreateTransitGatewayConnect
• ec2:CreateTransitGatewayConnectPeer
• ec2:CreateTransitGatewayMulticastDomain
• ec2:CreateTransitGatewayPeeringAttachment
• ec2:CreateTransitGatewayPolicyTable
• ec2:CreateTransitGatewayPrefixListReference
• ec2:CreateTransitGatewayRoute
• ec2:CreateTransitGatewayRouteTable
• ec2:CreateTransitGatewayRouteTableAnnouncement
• ec2:CreateTransitGatewayVpcAttachment
• ec2:CreateVerifiedAccessEndpoint
• ec2:CreateVerifiedAccessGroup
• ec2:CreateVerifiedAccessInstance
• ec2:CreateVerifiedAccessTrustProvider
• ec2:CreateVolume
• ec2:CreateVpc
• ec2:CreateVpcEndpoint
• ec2:CreateVpcEndpointConnectionNotification
• ec2:CreateVpcEndpointServiceConfiguration
• ec2:CreateVpcPeeringConnection
• ec2:CreateVpnConnection
• ec2:CreateVpnConnectionRoute
• ec2:CreateVpnGateway
• ec2:DeleteCarrierGateway
• ec2:DeleteClientVpnEndpoint
• ec2:DeleteClientVpnRoute
• ec2:DeleteCoipCidr
• ec2:DeleteCoipPool
• ec2:DeleteCoipPoolPermission
• ec2:DeleteCustomerGateway
• ec2:DeleteDhcpOptions
• ec2:DeleteEgressOnlyInternetGateway
• ec2:DeleteFleets
• ec2:DeleteFlowLogs
• ec2:DeleteFpgaImage
• ec2:DeleteInstanceEventWindow
• ec2:DeleteInternetGateway
• ec2:DeleteIpam
• ec2:DeleteIpamPool
• ec2:DeleteIpamResourceDiscovery
• ec2:DeleteIpamScope
• ec2:DeleteKeyPair
• ec2:DeleteLaunchTemplate
• ec2:DeleteLaunchTemplateVersions
• ec2:DeleteLocalGatewayRoute
• ec2:DeleteLocalGatewayRouteTable
• ec2:DeleteLocalGatewayRouteTablePermission
• ec2:DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation
• ec2:DeleteLocalGatewayRouteTableVpcAssociation
• ec2:DeleteManagedPrefixList
• ec2:DeleteNatGateway
• ec2:DeleteNetworkAcl
• ec2:DeleteNetworkAclEntry
• ec2:DeleteNetworkInsightsAccessScope
• ec2:DeleteNetworkInsightsAccessScopeAnalysis
• ec2:DeleteNetworkInsightsAnalysis
• ec2:DeleteNetworkInsightsPath
• ec2:DeleteNetworkInterface
• ec2:DeleteNetworkInterfacePermission
• ec2:DeletePlacementGroup
• ec2:DeletePublicIpv4Pool
• ec2:DeleteQueuedReservedInstances
• ec2:DeleteResourcePolicy
• ec2:DeleteRoute
• ec2:DeleteRouteTable
• ec2:DeleteSecurityGroup
• ec2:DeleteSnapshot
• ec2:DeleteSpotDatafeedSubscription
• ec2:DeleteSubnet
• ec2:DeleteSubnetCidrReservation
• ec2:DeleteTags
• ec2:DeleteTrafficMirrorFilter
• ec2:DeleteTrafficMirrorFilterRule
• ec2:DeleteTrafficMirrorSession
• ec2:DeleteTrafficMirrorTarget
• ec2:DeleteTransitGateway
• ec2:DeleteTransitGatewayConnect
• ec2:DeleteTransitGatewayConnectPeer
• ec2:DeleteTransitGatewayMulticastDomain
• ec2:DeleteTransitGatewayPeeringAttachment
• ec2:DeleteTransitGatewayPolicyTable
• ec2:DeleteTransitGatewayPrefixListReference
• ec2:DeleteTransitGatewayRoute
• ec2:DeleteTransitGatewayRouteTable
• ec2:DeleteTransitGatewayRouteTableAnnouncement
• ec2:DeleteTransitGatewayVpcAttachment
• ec2:DeleteVerifiedAccessEndpoint
• ec2:DeleteVerifiedAccessGroup
• ec2:DeleteVerifiedAccessInstance
• ec2:DeleteVerifiedAccessTrustProvider
• ec2:DeleteVolume
• ec2:DeleteVpc
• ec2:DeleteVpcEndpointConnectionNotifications
• ec2:DeleteVpcEndpointServiceConfigurations
• ec2:DeleteVpcEndpoints
• ec2:DeleteVpcPeeringConnection
• ec2:DeleteVpnConnection
• ec2:DeleteVpnConnectionRoute
• ec2:DeleteVpnGateway
• ec2:DeprovisionByoipCidr
• ec2:DeprovisionIpamPoolCidr
• ec2:DeprovisionPublicIpv4PoolCidr
• ec2:DeregisterImage
• ec2:DeregisterInstanceEventNotificationAttributes
• ec2:DeregisterTransitGatewayMulticastGroupMembers
• ec2:DeregisterTransitGatewayMulticastGroupSources
• ec2:DescribeAccountAttributes
• ec2:DescribeAddressTransfers
• ec2:DescribeAddresses
• ec2:DescribeAddressesAttribute
• ec2:DescribeAggregateIdFormat
• ec2:DescribeAvailabilityZones
• ec2:DescribeAwsNetworkPerformanceMetricSubscriptions
• ec2:DescribeBundleTasks
• ec2:DescribeByoipCidrs
• ec2:DescribeCapacityReservationFleets
• ec2:DescribeCapacityReservations
• ec2:DescribeCarrierGateways
• ec2:DescribeClassicLinkInstances
• ec2:DescribeClientVpnAuthorizationRules
• ec2:DescribeClientVpnConnections
• ec2:DescribeClientVpnEndpoints
• ec2:DescribeClientVpnRoutes
• ec2:DescribeClientVpnTargetNetworks
• ec2:DescribeCoipPools
• ec2:DescribeConversionTasks
• ec2:DescribeCustomerGateways
• ec2:DescribeDhcpOptions
• ec2:DescribeEgressOnlyInternetGateways
• ec2:DescribeElasticGpus
• ec2:DescribeExportImageTasks
• ec2:DescribeExportTasks
• ec2:DescribeFastLaunchImages
• ec2:DescribeFastSnapshotRestores
• ec2:DescribeFleetHistory
• ec2:DescribeFleetInstances
• ec2:DescribeFleets
• ec2:DescribeFlowLogs
• ec2:DescribeFpgaImageAttribute
• ec2:DescribeFpgaImages
• ec2:DescribeHostReservationOfferings
• ec2:DescribeHostReservations
• ec2:DescribeHosts
• ec2:DescribeIamInstanceProfileAssociations
• ec2:DescribeIdFormat
• ec2:DescribeIdentityIdFormat
• ec2:DescribeImageAttribute
• ec2:DescribeImages
• ec2:DescribeImportImageTasks
• ec2:DescribeImportSnapshotTasks
• ec2:DescribeInstanceAttribute
• ec2:DescribeInstanceCreditSpecifications
• ec2:DescribeInstanceEventNotificationAttributes
• ec2:DescribeInstanceEventWindows
• ec2:DescribeInstanceStatus
• ec2:DescribeInstanceTypeOfferings
• ec2:DescribeInstanceTypes
• ec2:DescribeInstances
• ec2:DescribeInternetGateways
• ec2:DescribeIpamPools
• ec2:DescribeIpamResourceDiscoveries
• ec2:DescribeIpamResourceDiscoveryAssociations
• ec2:DescribeIpamScopes
• ec2:DescribeIpams
• ec2:DescribeIpv6Pools
• ec2:DescribeKeyPairs
• ec2:DescribeLaunchTemplateVersions
• ec2:DescribeLaunchTemplates
• ec2:DescribeLocalGatewayRouteTablePermissions
• ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
• ec2:DescribeLocalGatewayRouteTableVpcAssociations
• ec2:DescribeLocalGatewayRouteTables
• ec2:DescribeLocalGatewayVirtualInterfaceGroups
• ec2:DescribeLocalGatewayVirtualInterfaces
• ec2:DescribeLocalGateways
• ec2:DescribeManagedPrefixLists
• ec2:DescribeMovingAddresses
• ec2:DescribeNatGateways
• ec2:DescribeNetworkAcls
• ec2:DescribeNetworkInsightsAccessScopeAnalyses
• ec2:DescribeNetworkInsightsAccessScopes
• ec2:DescribeNetworkInsightsAnalyses
• ec2:DescribeNetworkInsightsPaths
• ec2:DescribeNetworkInterfaceAttribute
• ec2:DescribeNetworkInterfacePermissions
• ec2:DescribeNetworkInterfaces
• ec2:DescribePlacementGroups
• ec2:DescribePrefixLists
• ec2:DescribePrincipalIdFormat
• ec2:DescribePublicIpv4Pools
• ec2:DescribeRegions
• ec2:DescribeReplaceRootVolumeTasks
• ec2:DescribeReservedInstances
• ec2:DescribeReservedInstancesListings
• ec2:DescribeReservedInstancesModifications
• ec2:DescribeReservedInstancesOfferings
• ec2:DescribeRouteTables
• ec2:DescribeScheduledInstanceAvailability
• ec2:DescribeScheduledInstances
• ec2:DescribeSecurityGroupReferences
• ec2:DescribeSecurityGroupRules
• ec2:DescribeSecurityGroups
• ec2:DescribeSnapshotAttribute
• ec2:DescribeSnapshotTierStatus
• ec2:DescribeSnapshots
• ec2:DescribeSpotDatafeedSubscription
• ec2:DescribeSpotFleetInstances
• ec2:DescribeSpotFleetRequestHistory
• ec2:DescribeSpotFleetRequests
• ec2:DescribeSpotInstanceRequests
• ec2:DescribeSpotPriceHistory
• ec2:DescribeStaleSecurityGroups
• ec2:DescribeStoreImageTasks
• ec2:DescribeSubnets
• ec2:DescribeTags
• ec2:DescribeTrafficMirrorFilters
• ec2:DescribeTrafficMirrorSessions
• ec2:DescribeTrafficMirrorTargets
• ec2:DescribeTransitGatewayAttachments
• ec2:DescribeTransitGatewayConnectPeers
• ec2:DescribeTransitGatewayConnects
• ec2:DescribeTransitGatewayMulticastDomains
• ec2:DescribeTransitGatewayPeeringAttachments
• ec2:DescribeTransitGatewayPolicyTables
• ec2:DescribeTransitGatewayRouteTableAnnouncements
• ec2:DescribeTransitGatewayRouteTables
• ec2:DescribeTransitGatewayVpcAttachments
• ec2:DescribeTransitGateways
• ec2:DescribeTrunkInterfaceAssociations
• ec2:DescribeVerifiedAccessEndpoints
• ec2:DescribeVerifiedAccessGroups
• ec2:DescribeVerifiedAccessInstanceLoggingConfigurations
• ec2:DescribeVerifiedAccessInstanceWebAclAssociations
• ec2:DescribeVerifiedAccessInstances
• ec2:DescribeVerifiedAccessTrustProviders
• ec2:DescribeVolumeAttribute
• ec2:DescribeVolumeStatus
• ec2:DescribeVolumes
• ec2:DescribeVolumesModifications
• ec2:DescribeVpcAttribute
• ec2:DescribeVpcClassicLink
• ec2:DescribeVpcClassicLinkDnsSupport
• ec2:DescribeVpcEndpointConnectionNotifications
• ec2:DescribeVpcEndpointConnections
• ec2:DescribeVpcEndpointServiceConfigurations
• ec2:DescribeVpcEndpointServicePermissions
• ec2:DescribeVpcEndpointServices
• ec2:DescribeVpcEndpoints
• ec2:DescribeVpcPeeringConnections
• ec2:DescribeVpcs
• ec2:DescribeVpnConnections
• ec2:DescribeVpnGateways
• ec2:DetachClassicLinkVpc
• ec2:DetachInternetGateway
• ec2:DetachNetworkInterface
• ec2:DetachVerifiedAccessTrustProvider
• ec2:DetachVolume
• ec2:DetachVpnGateway
• ec2:DisableAddressTransfer
• ec2:DisableAwsNetworkPerformanceMetricSubscription
• ec2:DisableEbsEncryptionByDefault
• ec2:DisableFastLaunch
• ec2:DisableFastSnapshotRestores
• ec2:DisableImageDeprecation
• ec2:DisableIpamOrganizationAdminAccount
• ec2:DisableSerialConsoleAccess
• ec2:DisableTransitGatewayRouteTablePropagation
• ec2:DisableVgwRoutePropagation
• ec2:DisableVpcClassicLink
• ec2:DisableVpcClassicLinkDnsSupport
• ec2:DisassociateAddress
• ec2:DisassociateClientVpnTargetNetwork
• ec2:DisassociateEnclaveCertificateIamRole
• ec2:DisassociateIamInstanceProfile
• ec2:DisassociateInstanceEventWindow
• ec2:DisassociateIpamResourceDiscovery
• ec2:DisassociateNatGatewayAddress
• ec2:DisassociateRouteTable
• ec2:DisassociateSubnetCidrBlock
• ec2:DisassociateTransitGatewayMulticastDomain
• ec2:DisassociateTransitGatewayPolicyTable
• ec2:DisassociateTransitGatewayRouteTable
• ec2:DisassociateTrunkInterface
• ec2:DisassociateVerifiedAccessInstanceWebAcl
• ec2:DisassociateVpcCidrBlock
• ec2:EnableAddressTransfer
• ec2:EnableAwsNetworkPerformanceMetricSubscription
• ec2:EnableEbsEncryptionByDefault
• ec2:EnableFastLaunch
• ec2:EnableFastSnapshotRestores
• ec2:EnableImageDeprecation
• ec2:EnableIpamOrganizationAdminAccount
• ec2:EnableReachabilityAnalyzerOrganizationSharing
• ec2:EnableSerialConsoleAccess
• ec2:EnableTransitGatewayRouteTablePropagation
• ec2:EnableVgwRoutePropagation
• ec2:EnableVolumeIO
• ec2:EnableVpcClassicLink
• ec2:EnableVpcClassicLinkDnsSupport
• ec2:ExportClientVpnClientCertificateRevocationList
• ec2:ExportClientVpnClientConfiguration
• ec2:ExportImage
• ec2:ExportTransitGatewayRoutes
• ec2:GetAssociatedEnclaveCertificateIamRoles
• ec2:GetAssociatedIpv6PoolCidrs
• ec2:GetAwsNetworkPerformanceData
• ec2:GetCapacityReservationUsage
• ec2:GetCoipPoolUsage
• ec2:GetConsoleOutput
• ec2:GetConsoleScreenshot
• ec2:GetDefaultCreditSpecification
• ec2:GetEbsDefaultKmsKeyId
• ec2:GetEbsEncryptionByDefault
• ec2:GetFlowLogsIntegrationTemplate
• ec2:GetGroupsForCapacityReservation
• ec2:GetHostReservationPurchasePreview
• ec2:GetInstanceTypesFromInstanceRequirements
• ec2:GetInstanceUefiData
• ec2:GetIpamAddressHistory
• ec2:GetIpamDiscoveredAccounts
• ec2:GetIpamDiscoveredResourceCidrs
• ec2:GetIpamPoolAllocations
• ec2:GetIpamPoolCidrs
• ec2:GetIpamResourceCidrs
• ec2:GetLaunchTemplateData
• ec2:GetManagedPrefixListAssociations
• ec2:GetManagedPrefixListEntries
• ec2:GetNetworkInsightsAccessScopeAnalysisFindings
• ec2:GetNetworkInsightsAccessScopeContent
• ec2:GetPasswordData
• ec2:GetReservedInstancesExchangeQuote
• ec2:GetResourcePolicy
• ec2:GetSerialConsoleAccessStatus
• ec2:GetSpotPlacementScores
• ec2:GetSubnetCidrReservations
• ec2:GetTransitGatewayAttachmentPropagations
• ec2:GetTransitGatewayMulticastDomainAssociations
• ec2:GetTransitGatewayPolicyTableAssociations
• ec2:GetTransitGatewayPolicyTableEntries
• ec2:GetTransitGatewayPrefixListReferences
• ec2:GetTransitGatewayRouteTableAssociations
• ec2:GetTransitGatewayRouteTablePropagations
• ec2:GetVerifiedAccessEndpointPolicy
• ec2:GetVerifiedAccessGroupPolicy
• ec2:GetVerifiedAccessInstanceWebAcl
• ec2:GetVpnConnectionDeviceSampleConfiguration
• ec2:GetVpnConnectionDeviceTypes
• ec2:GetVpnTunnelReplacementStatus
• ec2:ImportByoipCidrToIpam
• ec2:ImportClientVpnClientCertificateRevocationList
• ec2:ImportImage
• ec2:ImportInstance
• ec2:ImportKeyPair
• ec2:ImportSnapshot
• ec2:ImportVolume
• ec2:ListImagesInRecycleBin
• ec2:ListSnapshotsInRecycleBin
• ec2:ModifyAddressAttribute
• ec2:ModifyAvailabilityZoneGroup
• ec2:ModifyCapacityReservation
• ec2:ModifyCapacityReservationFleet
• ec2:ModifyClientVpnEndpoint
• ec2:ModifyDefaultCreditSpecification
• ec2:ModifyEbsDefaultKmsKeyId
• ec2:ModifyFleet
• ec2:ModifyFpgaImageAttribute
• ec2:ModifyHosts
• ec2:ModifyIdFormat
• ec2:ModifyIdentityIdFormat
• ec2:ModifyImageAttribute
• ec2:ModifyInstanceAttribute
• ec2:ModifyInstanceCapacityReservationAttributes
• ec2:ModifyInstanceCreditSpecification
• ec2:ModifyInstanceEventStartTime
• ec2:ModifyInstanceEventWindow
• ec2:ModifyInstanceMaintenanceOptions
• ec2:ModifyInstanceMetadataOptions
• ec2:ModifyInstancePlacement
• ec2:ModifyIpam
• ec2:ModifyIpamPool
• ec2:ModifyIpamResourceCidr
• ec2:ModifyIpamResourceDiscovery
• ec2:ModifyIpamScope
• ec2:ModifyLaunchTemplate
• ec2:ModifyLocalGatewayRoute
• ec2:ModifyManagedPrefixList
• ec2:ModifyNetworkInterfaceAttribute
• ec2:ModifyPrivateDnsNameOptions
• ec2:ModifyReservedInstances
• ec2:ModifySecurityGroupRules
• ec2:ModifySnapshotAttribute
• ec2:ModifySnapshotTier
• ec2:ModifySpotFleetRequest
• ec2:ModifySubnetAttribute
• ec2:ModifyTrafficMirrorFilterNetworkServices
• ec2:ModifyTrafficMirrorFilterRule
• ec2:ModifyTrafficMirrorSession
• ec2:ModifyTransitGateway
• ec2:ModifyTransitGatewayPrefixListReference
• ec2:ModifyTransitGatewayVpcAttachment
• ec2:ModifyVerifiedAccessEndpoint
• ec2:ModifyVerifiedAccessEndpointPolicy
• ec2:ModifyVerifiedAccessGroup
• ec2:ModifyVerifiedAccessGroupPolicy
• ec2:ModifyVerifiedAccessInstance
• ec2:ModifyVerifiedAccessInstanceLoggingConfiguration
• ec2:ModifyVerifiedAccessTrustProvider
• ec2:ModifyVolume
• ec2:ModifyVolumeAttribute
• ec2:ModifyVpcAttribute
• ec2:ModifyVpcEndpoint
• ec2:ModifyVpcEndpointConnectionNotification
• ec2:ModifyVpcEndpointServiceConfiguration
• ec2:ModifyVpcEndpointServicePayerResponsibility
• ec2:ModifyVpcEndpointServicePermissions
• ec2:ModifyVpcPeeringConnectionOptions
• ec2:ModifyVpcTenancy
• ec2:ModifyVpnConnection
• ec2:ModifyVpnConnectionOptions
• ec2:ModifyVpnTunnelCertificate
• ec2:ModifyVpnTunnelOptions
• ec2:MonitorInstances
• ec2:MoveAddressToVpc
• ec2:MoveByoipCidrToIpam
• ec2:PauseVolumeIO
• ec2:ProvisionByoipCidr
• ec2:ProvisionIpamPoolCidr
• ec2:ProvisionPublicIpv4PoolCidr
• ec2:PurchaseHostReservation
• ec2:PurchaseReservedInstancesOffering
• ec2:PurchaseScheduledInstances
• ec2:PutResourcePolicy
• ec2:RebootInstances
• ec2:RegisterImage
• ec2:RegisterInstanceEventNotificationAttributes
• ec2:RegisterTransitGatewayMulticastGroupMembers
• ec2:RegisterTransitGatewayMulticastGroupSources
• ec2:RejectTransitGatewayMulticastDomainAssociations
• ec2:RejectTransitGatewayPeeringAttachment
• ec2:RejectTransitGatewayVpcAttachment
• ec2:RejectVpcEndpointConnections
• ec2:RejectVpcPeeringConnection
• ec2:ReleaseAddress
• ec2:ReleaseHosts
• ec2:ReleaseIpamPoolAllocation
• ec2:ReplaceIamInstanceProfileAssociation
• ec2:ReplaceNetworkAclAssociation
• ec2:ReplaceNetworkAclEntry
• ec2:ReplaceRoute
• ec2:ReplaceRouteTableAssociation
• ec2:ReplaceTransitGatewayRoute
• ec2:ReplaceVpnTunnel
• ec2:ReportInstanceStatus
• ec2:RequestSpotFleet
• ec2:RequestSpotInstances
• ec2:ResetAddressAttribute
• ec2:ResetEbsDefaultKmsKeyId
• ec2:ResetFpgaImageAttribute
• ec2:ResetImageAttribute
• ec2:ResetInstanceAttribute
• ec2:ResetNetworkInterfaceAttribute
• ec2:ResetSnapshotAttribute
• ec2:RestoreAddressToClassic
• ec2:RestoreImageFromRecycleBin
• ec2:RestoreManagedPrefixListVersion
• ec2:RestoreSnapshotFromRecycleBin
• ec2:RestoreSnapshotTier
• ec2:RevokeClientVpnIngress
• ec2:RevokeSecurityGroupEgress
• ec2:RevokeSecurityGroupIngress
• ec2:RunInstances
• ec2:RunScheduledInstances
• ec2:SearchLocalGatewayRoutes
• ec2:SearchTransitGatewayMulticastGroups
• ec2:SearchTransitGatewayRoutes
• ec2:SendDiagnosticInterrupt
• ec2:SendSpotInstanceInterruptions
• ec2:StartInstances
• ec2:StartNetworkInsightsAccessScopeAnalysis
• ec2:StartNetworkInsightsAnalysis
• ec2:StartVpcEndpointServicePrivateDnsVerification
• ec2:StopInstances
• ec2:TerminateClientVpnConnections
• ec2:TerminateInstances
• ec2:UnassignIpv6Addresses
• ec2:UnassignPrivateIpAddresses
• ec2:UnassignPrivateNatGatewayAddress
• ec2:UnmonitorInstances
• ec2:UpdateSecurityGroupRuleDescriptionsEgress
• ec2:UpdateSecurityGroupRuleDescriptionsIngress
• ec2:WithdrawByoipCidr

Amazon Athena

• athena:DeleteCapacityReservation

AWS CloudTrail

• cloudtrail:StartEventDataStoreIngestion
• cloudtrail:StopEventDataStoreIngestion

Amazon Elastic Compute Cloud (EC2)

• ec2:AcceptAddressTransfer
• ec2:AcceptReservedInstancesExchangeQuote
• ec2:AcceptTransitGatewayMulticastDomainAssociations
• ec2:AcceptTransitGatewayPeeringAttachment
• ec2:AcceptTransitGatewayVpcAttachment
• ec2:AcceptVpcEndpointConnections
• ec2:AcceptVpcPeeringConnection
• ec2:AdvertiseByoipCidr
• ec2:AllocateAddress
• ec2:AllocateHosts
• ec2:AllocateIpamPoolCidr
• ec2:ApplySecurityGroupsToClientVpnTargetNetwork
• ec2:AssignIpv6Addresses
• ec2:AssignPrivateIpAddresses
• ec2:AssignPrivateNatGatewayAddress
• ec2:AssociateAddress
• ec2:AssociateClientVpnTargetNetwork
• ec2:AssociateDhcpOptions
• ec2:AssociateEnclaveCertificateIamRole
• ec2:AssociateIamInstanceProfile
• ec2:AssociateInstanceEventWindow
• ec2:AssociateIpamResourceDiscovery
• ec2:AssociateNatGatewayAddress
• ec2:AssociateRouteTable
• ec2:AssociateSubnetCidrBlock
• ec2:AssociateTransitGatewayMulticastDomain
• ec2:AssociateTransitGatewayPolicyTable
• ec2:AssociateTransitGatewayRouteTable
• ec2:AssociateTrunkInterface
• ec2:AssociateVerifiedAccessInstanceWebAcl
• ec2:AssociateVpcCidrBlock
• ec2:AttachClassicLinkVpc
• ec2:AttachInternetGateway
• ec2:AttachNetworkInterface
• ec2:AttachVerifiedAccessTrustProvider
• ec2:AttachVolume
• ec2:AttachVpnGateway
• ec2:AuthorizeClientVpnIngress
• ec2:AuthorizeSecurityGroupEgress
• ec2:AuthorizeSecurityGroupIngress
• ec2:BundleInstance
• ec2:CancelBundleTask
• ec2:CancelCapacityReservation
• ec2:CancelCapacityReservationFleets
• ec2:CancelConversionTask
• ec2:CancelExportTask
• ec2:CancelImageLaunchPermission
• ec2:CancelImportTask
• ec2:CancelReservedInstancesListing
• ec2:CancelSpotFleetRequests
• ec2:CancelSpotInstanceRequests
• ec2:ConfirmProductInstance
• ec2:CopyFpgaImage
• ec2:CopyImage
• ec2:CopySnapshot
• ec2:CreateCapacityReservation
• ec2:CreateCapacityReservationFleet
• ec2:CreateCarrierGateway
• ec2:CreateClientVpnEndpoint
• ec2:CreateClientVpnRoute
• ec2:CreateCoipCidr
• ec2:CreateCoipPool
• ec2:CreateCoipPoolPermission
• ec2:CreateCustomerGateway
• ec2:CreateDefaultSubnet
• ec2:CreateDefaultVpc
• ec2:CreateDhcpOptions
• ec2:CreateEgressOnlyInternetGateway
• ec2:CreateFleet
• ec2:CreateFlowLogs
• ec2:CreateFpgaImage
• ec2:CreateImage
• ec2:CreateInstanceEventWindow
• ec2:CreateInstanceExportTask
• ec2:CreateInternetGateway
• ec2:CreateIpam
• ec2:CreateIpamPool
• ec2:CreateIpamResourceDiscovery
• ec2:CreateIpamScope
• ec2:CreateKeyPair
• ec2:CreateLaunchTemplate
• ec2:CreateLaunchTemplateVersion
• ec2:CreateLocalGatewayRoute
• ec2:CreateLocalGatewayRouteTable
• ec2:CreateLocalGatewayRouteTablePermission
• ec2:CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation
• ec2:CreateLocalGatewayRouteTableVpcAssociation
• ec2:CreateManagedPrefixList
• ec2:CreateNatGateway
• ec2:CreateNetworkAcl
• ec2:CreateNetworkAclEntry
• ec2:CreateNetworkInsightsAccessScope
• ec2:CreateNetworkInsightsPath
• ec2:CreateNetworkInterface
• ec2:CreateNetworkInterfacePermission
• ec2:CreatePlacementGroup
• ec2:CreatePublicIpv4Pool
• ec2:CreateReplaceRootVolumeTask
• ec2:CreateReservedInstancesListing
• ec2:CreateRestoreImageTask
• ec2:CreateRoute
• ec2:CreateRouteTable
• ec2:CreateSecurityGroup
• ec2:CreateSnapshot
• ec2:CreateSnapshots
• ec2:CreateSpotDatafeedSubscription
• ec2:CreateStoreImageTask
• ec2:CreateSubnet
• ec2:CreateSubnetCidrReservation
• ec2:CreateTags
• ec2:CreateTrafficMirrorFilter
• ec2:CreateTrafficMirrorFilterRule
• ec2:CreateTrafficMirrorSession
• ec2:CreateTrafficMirrorTarget
• ec2:CreateTransitGateway
• ec2:CreateTransitGatewayConnect
• ec2:CreateTransitGatewayConnectPeer
• ec2:CreateTransitGatewayMulticastDomain
• ec2:CreateTransitGatewayPeeringAttachment
• ec2:CreateTransitGatewayPolicyTable
• ec2:CreateTransitGatewayPrefixListReference
• ec2:CreateTransitGatewayRoute
• ec2:CreateTransitGatewayRouteTable
• ec2:CreateTransitGatewayRouteTableAnnouncement
• ec2:CreateTransitGatewayVpcAttachment
• ec2:CreateVerifiedAccessEndpoint
• ec2:CreateVerifiedAccessGroup
• ec2:CreateVerifiedAccessInstance
• ec2:CreateVerifiedAccessTrustProvider
• ec2:CreateVolume
• ec2:CreateVpc
• ec2:CreateVpcEndpoint
• ec2:CreateVpcEndpointConnectionNotification
• ec2:CreateVpcEndpointServiceConfiguration
• ec2:CreateVpcPeeringConnection
• ec2:CreateVpnConnection
• ec2:CreateVpnConnectionRoute
• ec2:CreateVpnGateway
• ec2:DeleteCarrierGateway
• ec2:DeleteClientVpnEndpoint
• ec2:DeleteClientVpnRoute
• ec2:DeleteCoipCidr
• ec2:DeleteCoipPool
• ec2:DeleteCoipPoolPermission
• ec2:DeleteCustomerGateway
• ec2:DeleteDhcpOptions
• ec2:DeleteEgressOnlyInternetGateway
• ec2:DeleteFleets
• ec2:DeleteFlowLogs
• ec2:DeleteFpgaImage
• ec2:DeleteInstanceEventWindow
• ec2:DeleteInternetGateway
• ec2:DeleteIpam
• ec2:DeleteIpamPool
• ec2:DeleteIpamResourceDiscovery
• ec2:DeleteIpamScope
• ec2:DeleteKeyPair
• ec2:DeleteLaunchTemplate
• ec2:DeleteLaunchTemplateVersions
• ec2:DeleteLocalGatewayRoute
• ec2:DeleteLocalGatewayRouteTable
• ec2:DeleteLocalGatewayRouteTablePermission
• ec2:DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation
• ec2:DeleteLocalGatewayRouteTableVpcAssociation
• ec2:DeleteManagedPrefixList
• ec2:DeleteNatGateway
• ec2:DeleteNetworkAcl
• ec2:DeleteNetworkAclEntry
• ec2:DeleteNetworkInsightsAccessScope
• ec2:DeleteNetworkInsightsAccessScopeAnalysis
• ec2:DeleteNetworkInsightsAnalysis
• ec2:DeleteNetworkInsightsPath
• ec2:DeleteNetworkInterface
• ec2:DeleteNetworkInterfacePermission
• ec2:DeletePlacementGroup
• ec2:DeletePublicIpv4Pool
• ec2:DeleteQueuedReservedInstances
• ec2:DeleteResourcePolicy
• ec2:DeleteRoute
• ec2:DeleteRouteTable
• ec2:DeleteSecurityGroup
• ec2:DeleteSnapshot
• ec2:DeleteSpotDatafeedSubscription
• ec2:DeleteSubnet
• ec2:DeleteSubnetCidrReservation
• ec2:DeleteTags
• ec2:DeleteTrafficMirrorFilter
• ec2:DeleteTrafficMirrorFilterRule
• ec2:DeleteTrafficMirrorSession
• ec2:DeleteTrafficMirrorTarget
• ec2:DeleteTransitGateway
• ec2:DeleteTransitGatewayConnect
• ec2:DeleteTransitGatewayConnectPeer
• ec2:DeleteTransitGatewayMulticastDomain
• ec2:DeleteTransitGatewayPeeringAttachment
• ec2:DeleteTransitGatewayPolicyTable
• ec2:DeleteTransitGatewayPrefixListReference
• ec2:DeleteTransitGatewayRoute
• ec2:DeleteTransitGatewayRouteTable
• ec2:DeleteTransitGatewayRouteTableAnnouncement
• ec2:DeleteTransitGatewayVpcAttachment
• ec2:DeleteVerifiedAccessEndpoint
• ec2:DeleteVerifiedAccessGroup
• ec2:DeleteVerifiedAccessInstance
• ec2:DeleteVerifiedAccessTrustProvider
• ec2:DeleteVolume
• ec2:DeleteVpc
• ec2:DeleteVpcEndpointConnectionNotifications
• ec2:DeleteVpcEndpointServiceConfigurations
• ec2:DeleteVpcEndpoints
• ec2:DeleteVpcPeeringConnection
• ec2:DeleteVpnConnection
• ec2:DeleteVpnConnectionRoute
• ec2:DeleteVpnGateway
• ec2:DeprovisionByoipCidr
• ec2:DeprovisionIpamPoolCidr
• ec2:DeprovisionPublicIpv4PoolCidr
• ec2:DeregisterImage
• ec2:DeregisterInstanceEventNotificationAttributes
• ec2:DeregisterTransitGatewayMulticastGroupMembers
• ec2:DeregisterTransitGatewayMulticastGroupSources
• ec2:DescribeAccountAttributes
• ec2:DescribeAddressTransfers
• ec2:DescribeAddresses
• ec2:DescribeAddressesAttribute
• ec2:DescribeAggregateIdFormat
• ec2:DescribeAvailabilityZones
• ec2:DescribeAwsNetworkPerformanceMetricSubscriptions
• ec2:DescribeBundleTasks
• ec2:DescribeByoipCidrs
• ec2:DescribeCapacityReservationFleets
• ec2:DescribeCapacityReservations
• ec2:DescribeCarrierGateways
• ec2:DescribeClassicLinkInstances
• ec2:DescribeClientVpnAuthorizationRules
• ec2:DescribeClientVpnConnections
• ec2:DescribeClientVpnEndpoints
• ec2:DescribeClientVpnRoutes
• ec2:DescribeClientVpnTargetNetworks
• ec2:DescribeCoipPools
• ec2:DescribeConversionTasks
• ec2:DescribeCustomerGateways
• ec2:DescribeDhcpOptions
• ec2:DescribeEgressOnlyInternetGateways
• ec2:DescribeElasticGpus
• ec2:DescribeExportImageTasks
• ec2:DescribeExportTasks
• ec2:DescribeFastLaunchImages
• ec2:DescribeFastSnapshotRestores
• ec2:DescribeFleetHistory
• ec2:DescribeFleetInstances
• ec2:DescribeFleets
• ec2:DescribeFlowLogs
• ec2:DescribeFpgaImageAttribute
• ec2:DescribeFpgaImages
• ec2:DescribeHostReservationOfferings
• ec2:DescribeHostReservations
• ec2:DescribeHosts
• ec2:DescribeIamInstanceProfileAssociations
• ec2:DescribeIdFormat
• ec2:DescribeIdentityIdFormat
• ec2:DescribeImageAttribute
• ec2:DescribeImages
• ec2:DescribeImportImageTasks
• ec2:DescribeImportSnapshotTasks
• ec2:DescribeInstanceAttribute
• ec2:DescribeInstanceCreditSpecifications
• ec2:DescribeInstanceEventNotificationAttributes
• ec2:DescribeInstanceEventWindows
• ec2:DescribeInstanceStatus
• ec2:DescribeInstanceTypeOfferings
• ec2:DescribeInstanceTypes
• ec2:DescribeInstances
• ec2:DescribeInternetGateways
• ec2:DescribeIpamPools
• ec2:DescribeIpamResourceDiscoveries
• ec2:DescribeIpamResourceDiscoveryAssociations
• ec2:DescribeIpamScopes
• ec2:DescribeIpams
• ec2:DescribeIpv6Pools
• ec2:DescribeKeyPairs
• ec2:DescribeLaunchTemplateVersions
• ec2:DescribeLaunchTemplates
• ec2:DescribeLocalGatewayRouteTablePermissions
• ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations
• ec2:DescribeLocalGatewayRouteTableVpcAssociations
• ec2:DescribeLocalGatewayRouteTables
• ec2:DescribeLocalGatewayVirtualInterfaceGroups
• ec2:DescribeLocalGatewayVirtualInterfaces
• ec2:DescribeLocalGateways
• ec2:DescribeManagedPrefixLists
• ec2:DescribeMovingAddresses
• ec2:DescribeNatGateways
• ec2:DescribeNetworkAcls
• ec2:DescribeNetworkInsightsAccessScopeAnalyses
• ec2:DescribeNetworkInsightsAccessScopes
• ec2:DescribeNetworkInsightsAnalyses
• ec2:DescribeNetworkInsightsPaths
• ec2:DescribeNetworkInterfaceAttribute
• ec2:DescribeNetworkInterfacePermissions
• ec2:DescribeNetworkInterfaces
• ec2:DescribePlacementGroups
• ec2:DescribePrefixLists
• ec2:DescribePrincipalIdFormat
• ec2:DescribePublicIpv4Pools
• ec2:DescribeRegions
• ec2:DescribeReplaceRootVolumeTasks
• ec2:DescribeReservedInstances
• ec2:DescribeReservedInstancesListings
• ec2:DescribeReservedInstancesModifications
• ec2:DescribeReservedInstancesOfferings
• ec2:DescribeRouteTables
• ec2:DescribeScheduledInstanceAvailability
• ec2:DescribeScheduledInstances
• ec2:DescribeSecurityGroupReferences
• ec2:DescribeSecurityGroupRules
• ec2:DescribeSecurityGroups
• ec2:DescribeSnapshotAttribute
• ec2:DescribeSnapshotTierStatus
• ec2:DescribeSnapshots
• ec2:DescribeSpotDatafeedSubscription
• ec2:DescribeSpotFleetInstances
• ec2:DescribeSpotFleetRequestHistory
• ec2:DescribeSpotFleetRequests
• ec2:DescribeSpotInstanceRequests
• ec2:DescribeSpotPriceHistory
• ec2:DescribeStaleSecurityGroups
• ec2:DescribeStoreImageTasks
• ec2:DescribeSubnets
• ec2:DescribeTags
• ec2:DescribeTrafficMirrorFilters
• ec2:DescribeTrafficMirrorSessions
• ec2:DescribeTrafficMirrorTargets
• ec2:DescribeTransitGatewayAttachments
• ec2:DescribeTransitGatewayConnectPeers
• ec2:DescribeTransitGatewayConnects
• ec2:DescribeTransitGatewayMulticastDomains
• ec2:DescribeTransitGatewayPeeringAttachments
• ec2:DescribeTransitGatewayPolicyTables
• ec2:DescribeTransitGatewayRouteTableAnnouncements
• ec2:DescribeTransitGatewayRouteTables
• ec2:DescribeTransitGatewayVpcAttachments
• ec2:DescribeTransitGateways
• ec2:DescribeTrunkInterfaceAssociations
• ec2:DescribeVerifiedAccessEndpoints
• ec2:DescribeVerifiedAccessGroups
• ec2:DescribeVerifiedAccessInstanceLoggingConfigurations
• ec2:DescribeVerifiedAccessInstanceWebAclAssociations
• ec2:DescribeVerifiedAccessInstances
• ec2:DescribeVerifiedAccessTrustProviders
• ec2:DescribeVolumeAttribute
• ec2:DescribeVolumeStatus
• ec2:DescribeVolumes
• ec2:DescribeVolumesModifications
• ec2:DescribeVpcAttribute
• ec2:DescribeVpcClassicLink
• ec2:DescribeVpcClassicLinkDnsSupport
• ec2:DescribeVpcEndpointConnectionNotifications
• ec2:DescribeVpcEndpointConnections
• ec2:DescribeVpcEndpointServiceConfigurations
• ec2:DescribeVpcEndpointServicePermissions
• ec2:DescribeVpcEndpointServices
• ec2:DescribeVpcEndpoints
• ec2:DescribeVpcPeeringConnections
• ec2:DescribeVpcs
• ec2:DescribeVpnConnections
• ec2:DescribeVpnGateways
• ec2:DetachClassicLinkVpc
• ec2:DetachInternetGateway
• ec2:DetachNetworkInterface
• ec2:DetachVerifiedAccessTrustProvider
• ec2:DetachVolume
• ec2:DetachVpnGateway
• ec2:DisableAddressTransfer
• ec2:DisableAwsNetworkPerformanceMetricSubscription
• ec2:DisableEbsEncryptionByDefault
• ec2:DisableFastLaunch
• ec2:DisableFastSnapshotRestores
• ec2:DisableImageDeprecation
• ec2:DisableIpamOrganizationAdminAccount
• ec2:DisableSerialConsoleAccess
• ec2:DisableTransitGatewayRouteTablePropagation
• ec2:DisableVgwRoutePropagation
• ec2:DisableVpcClassicLink
• ec2:DisableVpcClassicLinkDnsSupport
• ec2:DisassociateAddress
• ec2:DisassociateClientVpnTargetNetwork
• ec2:DisassociateEnclaveCertificateIamRole
• ec2:DisassociateIamInstanceProfile
• ec2:DisassociateInstanceEventWindow
• ec2:DisassociateIpamResourceDiscovery
• ec2:DisassociateNatGatewayAddress
• ec2:DisassociateRouteTable
• ec2:DisassociateSubnetCidrBlock
• ec2:DisassociateTransitGatewayMulticastDomain
• ec2:DisassociateTransitGatewayPolicyTable
• ec2:DisassociateTransitGatewayRouteTable
• ec2:DisassociateTrunkInterface
• ec2:DisassociateVerifiedAccessInstanceWebAcl
• ec2:DisassociateVpcCidrBlock
• ec2:EnableAddressTransfer
• ec2:EnableAwsNetworkPerformanceMetricSubscription
• ec2:EnableEbsEncryptionByDefault
• ec2:EnableFastLaunch
• ec2:EnableFastSnapshotRestores
• ec2:EnableImageDeprecation
• ec2:EnableIpamOrganizationAdminAccount
• ec2:EnableReachabilityAnalyzerOrganizationSharing
• ec2:EnableSerialConsoleAccess
• ec2:EnableTransitGatewayRouteTablePropagation
• ec2:EnableVgwRoutePropagation
• ec2:EnableVolumeIO
• ec2:EnableVpcClassicLink
• ec2:EnableVpcClassicLinkDnsSupport
• ec2:ExportClientVpnClientCertificateRevocationList
• ec2:ExportClientVpnClientConfiguration
• ec2:ExportImage
• ec2:ExportTransitGatewayRoutes
• ec2:GetAssociatedEnclaveCertificateIamRoles
• ec2:GetAssociatedIpv6PoolCidrs
• ec2:GetAwsNetworkPerformanceData
• ec2:GetCapacityReservationUsage
• ec2:GetCoipPoolUsage
• ec2:GetConsoleOutput
• ec2:GetConsoleScreenshot
• ec2:GetDefaultCreditSpecification
• ec2:GetEbsDefaultKmsKeyId
• ec2:GetEbsEncryptionByDefault
• ec2:GetFlowLogsIntegrationTemplate
• ec2:GetGroupsForCapacityReservation
• ec2:GetHostReservationPurchasePreview
• ec2:GetInstanceTypesFromInstanceRequirements
• ec2:GetInstanceUefiData
• ec2:GetIpamAddressHistory
• ec2:GetIpamDiscoveredAccounts
• ec2:GetIpamDiscoveredResourceCidrs
• ec2:GetIpamPoolAllocations
• ec2:GetIpamPoolCidrs
• ec2:GetIpamResourceCidrs
• ec2:GetLaunchTemplateData
• ec2:GetManagedPrefixListAssociations
• ec2:GetManagedPrefixListEntries
• ec2:GetNetworkInsightsAccessScopeAnalysisFindings
• ec2:GetNetworkInsightsAccessScopeContent
• ec2:GetPasswordData
• ec2:GetReservedInstancesExchangeQuote
• ec2:GetResourcePolicy
• ec2:GetSerialConsoleAccessStatus
• ec2:GetSpotPlacementScores
• ec2:GetSubnetCidrReservations
• ec2:GetTransitGatewayAttachmentPropagations
• ec2:GetTransitGatewayMulticastDomainAssociations
• ec2:GetTransitGatewayPolicyTableAssociations
• ec2:GetTransitGatewayPolicyTableEntries
• ec2:GetTransitGatewayPrefixListReferences
• ec2:GetTransitGatewayRouteTableAssociations
• ec2:GetTransitGatewayRouteTablePropagations
• ec2:GetVerifiedAccessEndpointPolicy
• ec2:GetVerifiedAccessGroupPolicy
• ec2:GetVerifiedAccessInstanceWebAcl
• ec2:GetVpnConnectionDeviceSampleConfiguration
• ec2:GetVpnConnectionDeviceTypes
• ec2:GetVpnTunnelReplacementStatus
• ec2:ImportByoipCidrToIpam
• ec2:ImportClientVpnClientCertificateRevocationList
• ec2:ImportImage
• ec2:ImportInstance
• ec2:ImportKeyPair
• ec2:ImportSnapshot
• ec2:ImportVolume
• ec2:ListImagesInRecycleBin
• ec2:ListSnapshotsInRecycleBin
• ec2:ModifyAddressAttribute
• ec2:ModifyAvailabilityZoneGroup
• ec2:ModifyCapacityReservation
• ec2:ModifyCapacityReservationFleet
• ec2:ModifyClientVpnEndpoint
• ec2:ModifyDefaultCreditSpecification
• ec2:ModifyEbsDefaultKmsKeyId
• ec2:ModifyFleet
• ec2:ModifyFpgaImageAttribute
• ec2:ModifyHosts
• ec2:ModifyIdFormat
• ec2:ModifyIdentityIdFormat
• ec2:ModifyImageAttribute
• ec2:ModifyInstanceAttribute
• ec2:ModifyInstanceCapacityReservationAttributes
• ec2:ModifyInstanceCreditSpecification
• ec2:ModifyInstanceEventStartTime
• ec2:ModifyInstanceEventWindow
• ec2:ModifyInstanceMaintenanceOptions
• ec2:ModifyInstanceMetadataOptions
• ec2:ModifyInstancePlacement
• ec2:ModifyIpam
• ec2:ModifyIpamPool
• ec2:ModifyIpamResourceCidr
• ec2:ModifyIpamResourceDiscovery
• ec2:ModifyIpamScope
• ec2:ModifyLaunchTemplate
• ec2:ModifyLocalGatewayRoute
• ec2:ModifyManagedPrefixList
• ec2:ModifyNetworkInterfaceAttribute
• ec2:ModifyPrivateDnsNameOptions
• ec2:ModifyReservedInstances
• ec2:ModifySecurityGroupRules
• ec2:ModifySnapshotAttribute
• ec2:ModifySnapshotTier
• ec2:ModifySpotFleetRequest
• ec2:ModifySubnetAttribute
• ec2:ModifyTrafficMirrorFilterNetworkServices
• ec2:ModifyTrafficMirrorFilterRule
• ec2:ModifyTrafficMirrorSession
• ec2:ModifyTransitGateway
• ec2:ModifyTransitGatewayPrefixListReference
• ec2:ModifyTransitGatewayVpcAttachment
• ec2:ModifyVerifiedAccessEndpoint
• ec2:ModifyVerifiedAccessEndpointPolicy
• ec2:ModifyVerifiedAccessGroup
• ec2:ModifyVerifiedAccessGroupPolicy
• ec2:ModifyVerifiedAccessInstance
• ec2:ModifyVerifiedAccessInstanceLoggingConfiguration
• ec2:ModifyVerifiedAccessTrustProvider
• ec2:ModifyVolume
• ec2:ModifyVolumeAttribute
• ec2:ModifyVpcAttribute
• ec2:ModifyVpcEndpoint
• ec2:ModifyVpcEndpointConnectionNotification
• ec2:ModifyVpcEndpointServiceConfiguration
• ec2:ModifyVpcEndpointServicePayerResponsibility
• ec2:ModifyVpcEndpointServicePermissions
• ec2:ModifyVpcPeeringConnectionOptions
• ec2:ModifyVpcTenancy
• ec2:ModifyVpnConnection
• ec2:ModifyVpnConnectionOptions
• ec2:ModifyVpnTunnelCertificate
• ec2:ModifyVpnTunnelOptions
• ec2:MonitorInstances
• ec2:MoveAddressToVpc
• ec2:MoveByoipCidrToIpam
• ec2:PauseVolumeIO
• ec2:ProvisionByoipCidr
• ec2:ProvisionIpamPoolCidr
• ec2:ProvisionPublicIpv4PoolCidr
• ec2:PurchaseHostReservation
• ec2:PurchaseReservedInstancesOffering
• ec2:PurchaseScheduledInstances
• ec2:PutResourcePolicy
• ec2:RebootInstances
• ec2:RegisterImage
• ec2:RegisterInstanceEventNotificationAttributes
• ec2:RegisterTransitGatewayMulticastGroupMembers
• ec2:RegisterTransitGatewayMulticastGroupSources
• ec2:RejectTransitGatewayMulticastDomainAssociations
• ec2:RejectTransitGatewayPeeringAttachment
• ec2:RejectTransitGatewayVpcAttachment
• ec2:RejectVpcEndpointConnections
• ec2:RejectVpcPeeringConnection
• ec2:ReleaseAddress
• ec2:ReleaseHosts
• ec2:ReleaseIpamPoolAllocation
• ec2:ReplaceIamInstanceProfileAssociation
• ec2:ReplaceNetworkAclAssociation
• ec2:ReplaceNetworkAclEntry
• ec2:ReplaceRoute
• ec2:ReplaceRouteTableAssociation
• ec2:ReplaceTransitGatewayRoute
• ec2:ReplaceVpnTunnel
• ec2:ReportInstanceStatus
• ec2:RequestSpotFleet
• ec2:RequestSpotInstances
• ec2:ResetAddressAttribute
• ec2:ResetEbsDefaultKmsKeyId
• ec2:ResetFpgaImageAttribute
• ec2:ResetImageAttribute
• ec2:ResetInstanceAttribute
• ec2:ResetNetworkInterfaceAttribute
• ec2:ResetSnapshotAttribute
• ec2:RestoreAddressToClassic
• ec2:RestoreImageFromRecycleBin
• ec2:RestoreManagedPrefixListVersion
• ec2:RestoreSnapshotFromRecycleBin
• ec2:RestoreSnapshotTier
• ec2:RevokeClientVpnIngress
• ec2:RevokeSecurityGroupEgress
• ec2:RevokeSecurityGroupIngress
• ec2:RunInstances
• ec2:RunScheduledInstances
• ec2:SearchLocalGatewayRoutes
• ec2:SearchTransitGatewayMulticastGroups
• ec2:SearchTransitGatewayRoutes
• ec2:SendDiagnosticInterrupt
• ec2:SendSpotInstanceInterruptions
• ec2:StartInstances
• ec2:StartNetworkInsightsAccessScopeAnalysis
• ec2:StartNetworkInsightsAnalysis
• ec2:StartVpcEndpointServicePrivateDnsVerification
• ec2:StopInstances
• ec2:TerminateClientVpnConnections
• ec2:TerminateInstances
• ec2:UnassignIpv6Addresses
• ec2:UnassignPrivateIpAddresses
• ec2:UnassignPrivateNatGatewayAddress
• ec2:UnmonitorInstances
• ec2:UpdateSecurityGroupRuleDescriptionsEgress
• ec2:UpdateSecurityGroupRuleDescriptionsIngress
• ec2:WithdrawByoipCidr