Service summary (list of actions)

If the policy does not grant permissions to all the actions, resources, and conditions defined for the service in the policy, then a warning banner appears at the top of the page. The service summary then includes details about the problem. To learn how policy summaries help you to understand and troubleshoot the permissions that your policy grants, see My policy does not grant the expected permissions.

Next to the Back link appears the name of the service (in this case S3). The service summary for this service includes the list of allowed actions that are defined in the policy. If instead, the text (Explicitly denied) appears next to the name of a service, then the actions listed in the service summary table are explicitly denied.

Choose { } JSON to see additional details about the policy. You can do this to view all conditions that are applied to the actions. (If you are viewing the service summary for an inline policy that is attached directly to a user, you must close the service summary dialog box and return to the policy summary to access the JSON policy document.)

To view the summary for a specific action, type keywords into the search box to reduce the list of available actions.

Action (2 of 69 actions) – This column lists the actions that are defined within the policy and provides the resources and conditions for each action. If the policy grants permissions to the action, then the action name links to the action summary table. The count indicates the number of recognized actions that provide permissions. The total is the number of known actions for the service. In this example, 2 actions provide permissions out of 69 total known S3 actions.

Show/Hide remaining 67 – Choose this link to expand or hide the table to include actions that are known but do not provide permissions for this service. Expanding the link also displays warnings for any elements that do not provide permissions.

Unrecognized resource types – This policy includes at least one unrecognized resource type within the policy for this service. You can use this warning to check whether a resource type might include a typo. If the resource type is correct, then the service might not fully support policy summaries, might be in preview, or might be a custom service. To request policy summary support for a specific resource type in a generally available (GA) service, see Service does not support IAM policy summaries. In this example, the autoscling service name is missing an a.

Unrecognized actions – This policy includes at least one unrecognized action within the policy for this service. You can use this warning to check whether an action might include a typo. If the action name is correct, then the service might not fully support policy summaries, might be in preview, or might be a custom service. To request policy summary support for a specific action in a generally available (GA) service, see Service does not support IAM policy summaries. In this example, the DeletObject action is missing an e.

For those actions that IAM recognizes, the table groups these actions into at least one or up to four sections, depending on the level of access that the policy allows or denies. The sections are List, Read, Write, and Permissions management. You can also see the number of actions that are defined out of the total number of actions available within each access level. To view the access level classification that is assigned to each action in a service, see Actions, Resources, and Condition Keys for Amazon Services.

The ellipses (…) indicate that all the actions are included in the page, but we are showing only the rows with information relevant to this policy. When you view this page in the Amazon Web Services Management Console, you see all the actions for your service.

(No access) – This policy includes an action that does not provide permissions.

Actions that provide permissions include a link to the action summary.

Resource – This column shows the resources that the policy defines for the service. IAM does not check whether the resource applies to each action. In this example, actions in the S3 service are allowed on only the developer_bucket Amazon S3 bucket resource. Depending on the information that the service provides to IAM, you might see an ARN such as arn:aws:s3:::developer_bucket/*, or you might see the defined resource type, such as BucketName = developer_bucket.

Resource warning – For actions with resources that do not provide full permissions, you see one of the following warnings:

For the ListAllMyBuckets action, this policy includes the last warning because the action does not support resource-level permissions and does not support the s3:x-amz-acl condition key. If you fix either the resource problem or the condition problem, the remaining issue appears in a detailed warning.

Request condition – This column tells whether the actions associated with the resource are subject to conditions. To learn more about those conditions, choose { } JSON to review the JSON policy document.

Condition warning – For actions with conditions that do not provide full permissions, you see one of the following warnings:

For GetObject, this policy includes the s3:x-amz-acl condition key, which will not work with this action. Although the action supports the resource, the policy does not grant any permissions for this action because the condition will never be true for this action.