AWS Services That Work with IAM
Many AWS services are integrated with AWS Identity and Access Management. The following tables group these services by category and show the IAM permission types each service supports, tips to help you write policies to control service access, and links to related information.
Specifically, each table provides the following information:
Action-level permissions. The service supports specifying individual actions in a policy's
Actionelement. If the service does not support action-level permissions, policies for the service use*in theActionelement. For a list of all of the permissions for the AWS services can be used in IAM policies, see AWS Service Actions and Condition Context Keys for Use in IAM Policies.Resource-level permissions. The service has one or more APIs that support specifying individual resources (using ARNs) in the policy's
Resourceelement. If an API does not support resource-level permissions then that statement in the policy must use*in theResourceelement. See the footnotes after each table for more information.Resource-based permissions. The service enables you to attach policies to the service's resources in addition to IAM users, groups, and roles. The policies specify who can access that resource by including a
Principalelement.Tag-based permissions. The service supports testing resource tags in a
Conditionelement.Temporary security credentials. The service lets users make requests using temporary security credentials that are obtained by calling AWS STS APIs like AssumeRole or GetFederationToken. Temporary credentials are commonly used in federation scenarios. For more information, see Temporary Security Credentials.
More information. Links to more information in the documentation of the product.
Compute Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Elastic Compute Cloud (Amazon EC2) | Yes | Yes¹ | No | Yes¹ | Yes |
| Amazon EC2 Container Registry (Amazon ECR) | Yes | Yes | No | Yes | |
| Amazon EC2 Container Service (Amazon ECS) | Yes | Yes² | No | No | Yes |
| AWS Elastic Beanstalk | Yes | Yes³ | No | No | Yes |
| AWS Lambda | Yes | Yes | Yes⁴ | No | Yes |
| Auto Scaling | Yes | No | No | No | Yes |
| Elastic Load Balancing | Yes | Yes⁵ | No | No | Yes |
¹ Amazon EC2 supports resource-level permissions and tags only for some APIs. For more information, see Supported Resources and Conditions for Amazon EC2 API Actions in the Amazon EC2 User Guide for Linux Instances.
² Amazon ECS supports resource-level permissions only for some APIs. For more information, see Supported Resource-Level Permissions for Amazon ECS API Actions in the Amazon EC2 Container Service Developer Guide.
³ Only some API actions for Elastic Beanstalk can be used as permissions against specific resources. For more information, see Resources and Conditions for Elastic Beanstalk Actions in the AWS Elastic Beanstalk Developer Guide.
⁴ The only AWS Lambda API action that can be specified in a resource-based policy is lambda:InvokeFunction. For more information, see Using Resource-Based Policies for AWS Lambda (Lambda Function Policies) in the AWS Lambda Developer Guide.
⁵ Only some API actions for Elastic Load Balancing can be used as permissions against specific resources. For more information, see Control Access to Your Load Balancer in the Elastic Load Balancing User Guide.
Storage and Content Delivery Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Simple Storage Service (Amazon S3) | Yes | Yes | Yes | Yes | Yes |
| Amazon Elastic Block Store (Amazon EBS) | Yes | Yes¹ | No | Yes | Yes |
| Amazon EFS | Yes | Yes | No | No | Yes |
| Amazon Glacier | Yes | Yes | Yes | Yes | Yes |
| AWS Snowball and AWS Snowball Edge | Yes | No | No | No | Yes |
| AWS Storage Gateway | Yes | Yes | No | No | Yes |
¹ For information about which EBS actions support resource-level permissions, see Supported Resources and Conditions for Amazon EC2 API Actions in the Amazon EC2 User Guide for Linux Instances.
Database Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Relational Database Service (Amazon RDS) | Yes | Yes | No | Yes | Yes |
| Amazon DynamoDB | Yes | Yes | No | No | Yes |
| Amazon ElastiCache | Yes | No | No | No | Yes |
| Amazon Redshift | Yes | Yes | No | No | Yes |
| Amazon SimpleDB | Yes | Yes | No | No | Yes |
Networking and Content Delivery Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Virtual Private Cloud (Amazon VPC) | Yes | Yes¹ | Yes² | Yes | Yes |
| Yes³ | No | No | No | Yes | |
| AWS Direct Connect | Yes | No | No | No | Yes |
| Amazon Route 53 | Yes | Yes | No | No | Yes |
¹ In an IAM user policy, you cannot restrict permissions to a specific Amazon VPC
endpoint. Any Action element that includes the ec2:*VpcEndpoint* or
ec2:DescribePrefixLists API actions must specify ""Resource":
"*"". For more information, see Controlling the Use of
Endpoints in the Amazon VPC User Guide.
² Amazon VPC supports attaching a single resource policy to a VPC endpoint to restrict what can be accessed through that endpoint. For more information about using resource-based policies to control access to resources from specific Amazon VPC endpoints, see Using Endpoint Policies in the Amazon VPC User Guide.
³ CloudFront does not support action-level permissions for creating CloudFront key pairs. You must use an AWS root account to create a CloudFront key pair. For more information, see Creating CloudFront Key Pairs for Your Trusted Signers in the Amazon CloudFront Developer Guide.
Developer Tools and Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| AWS CodeCommit | Yes | Yes | No | No | Yes |
| AWS CodeBuild | Yes | Yes | No | No | Yes |
| AWS CodeDeploy | Yes | Yes | No | No | Yes |
| AWS CodePipeline | Yes | Yes¹ | No | No | Yes |
¹ Only some API actions for AWS CodePipeline can be used as permissions against specific resources. For more information, see the "Operation and Resource Syntax" section of AWS CodePipeline Access Permissions Reference in the AWS CodePipeline User Guide.
Management Tools and Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon CloudWatch | Yes | No | No | No | Yes |
| Amazon CloudWatch Events | Yes | Yes | No | No | Yes |
| Amazon CloudWatch Logs | Yes | Yes | No | No | Yes |
| AWS CloudFormation | Yes | Yes | No | No | Yes |
| AWS CloudTrail | Yes | Yes | No | No | Yes |
| AWS Config | Yes | No | No | No | Yes |
| AWS OpsWorks | Yes | Yes | Yes | No | Yes |
| AWS Service Catalog | Yes | Yes | No | No | Yes |
| AWS Trusted Advisor | Yes | Yes | No | No | Yes |
| AWS Health | Yes | No | No | No | Yes |
Security, Identity, and Compliance Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| AWS Identity and Access Management (IAM) | Yes | Yes | No | No | Yes¹ |
| AWS Security Token Service (AWS STS) | Yes | Yes² | No | No | Yes² |
| AWS Artifact | Yes | Yes | No | No | Yes |
| AWS Certificate Manager (ACM) | Yes | Yes | No | No | Yes |
| AWS Directory Service | Yes | No | No | No | Yes |
| AWS CloudHSM | Yes | No | No | No | No |
| AWS Key Management Service (AWS KMS) | Yes | Yes | Yes | No | Yes |
| AWS WAF | Yes | Yes | No | No | Yes |
¹ Only some of the API actions for IAM can be called with temporary credentials. For more information, see Comparing your API options
² AWS STS does not have "resources", but does allow restricting access in a similar way to users. For more information, see Denying Access to Temporary Security Credentials by Name. Only some of the APIs for AWS STS support calling with temporary credentials. For more information, see Comparing your API options.
Analytics Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon EMR (Amazon EMR) | Yes | No | No | No | Yes |
| Amazon CloudSearch | Yes | Yes | No | No | Yes |
| Amazon Elasticsearch Service | Yes | Yes | Yes | No | Yes |
| Amazon Kinesis | Yes | Yes | No | No | Yes |
| Amazon Kinesis Analytics | Yes | Yes | No | No | Yes |
| AWS Data Pipeline | Yes | Yes | No | Yes | Yes |
Artificial Intelligence
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Polly | Yes | Yes | No | No | Yes |
| Amazon Machine Learning | Yes | Yes | No | No | Yes |
Internet of Things
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| AWS IoT | Yes¹ | Yes² | Yes³ | No | Yes |
¹ For more information about AWS IoT action-level permissions, see AWS IoT Policy Actions in the AWS IoT User Guide.
² For information about which AWS IoT actions support resource-level permissions and which resources you can specify for each, see Action Resources in the AWS IoT Developer Guide.
³ Devices connected to AWS IoT are authenticated by using X.509 certificates. You can attach AWS IoT policies to an X.509 certificate to control what the device is authorized to do. For more information, see Create an AWS IoT Policy in the AWS IoT Developer Guide.
Game Development Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon GameLift | Yes | No | No | No | Yes |
Mobile Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Cognito | Yes | Yes | No | No | Yes |
| AWS Device Farm | Yes | No | No | No | Yes |
| Amazon Mobile Analytics | Yes | No | No | No | Yes |
| Amazon Pinpoint | Yes | Yes | No | No | Yes |
Application Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon API Gateway | Yes | Yes | No | No | Yes |
| Amazon Elastic Transcoder | Yes | Yes | No | No | Yes |
| Amazon Simple Workflow Service (Amazon SWF) | Yes | Yes | No | Yes | Yes |
Messaging Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon Simple Notification Service (Amazon SNS) | Yes | Yes | Yes | No | Yes |
| Amazon Simple Email Service (Amazon SES) | Yes | Yes¹ | No | No | Yes² |
| Amazon Simple Queue Service (Amazon SQS) | Yes | Yes | Yes | No | Yes |
¹ Amazon SES supports resource-level permissions in policies that grant permissions to delegate senders to access specific SES identities.
² Only the Amazon SES API supports temporary security credentials. The Amazon SES SMTP interface does not support SMTP credentials that are derived from temporary security credentials.
Business Productivity
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon WorkDocs | Yes | No | No | No | Yes |
| Amazon WorkMail | Yes | No | No | No | Yes |
Desktop and App Streaming Services
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| Amazon WorkSpaces | Yes | Yes | No | No | Yes |
| Amazon WAM | Yes | No | No | No | Yes |
| Amazon AppStream | Yes | No | No | No | Yes |
| Amazon AppStream 2.0 | Yes | No | No | No | Yes |
Additional Resources
Service and Related IAM Info | Supports the following permissions | ||||
| Action Level | Resource Level | Resource Based | Tag Based | Temporary Credentials | |
| AWS Billing and Cost Management | Yes | No | No | No | Yes |
| AWS Marketplace | Yes | Yes | No | No | Yes |
| AWS Support | No | No | No | No | Yes |
| AWS Trusted Advisor | Yes¹ | Yes | No | No | Yes¹ |
¹ API access to Trusted Advisor is through the AWS Support API and is controlled by AWS Support IAM policies.
