Amazon services that work with IAM - Amazon Identity and Access Management
ComputeContainersStorageDatabaseDeveloper toolsSecurity, identity, & complianceCryptography & PKIMachine learningManagement and governanceMigration & transferMobileNetworking & content deliveryMediaAnalyticsApplication integrationBusiness applicationsSatelliteInternet of ThingsRoboticsQuantum ComputingBlockchainGame developmentAR & VRCustomer enablementCustomer engagementEnd user computingBilling and cost managementAdditional resources
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon services that work with IAM

The Amazon services listed below are grouped by their Amazon product categories and include information about what IAM features they support:

  • Service – You can choose the name of a service to view the Amazon documentation about IAM authorization and access for that service.

  • Actions – You can specify individual actions in a policy. If the service does not support this feature, then All actions is selected in the visual editor. In a JSON policy document, you must use * in the Action element. For a list of actions in each service, see Actions, Resources, and Condition Keys for Amazon Services.

  • Resource-level permissions – You can use ARNs to specify individual resources in the policy. If the service does not support this feature, then All resources is chosen in the policy visual editor. In a JSON policy document, you must use * in the Resource element. Some actions, such as List* actions, do not support specifying an ARN because they are designed to return multiple resources. If a service supports this feature for some resources but not others, it is indicated by Partial in the table. See the documentation for that service for more information.

  • Resource-based policies – You can attach resource-based policies to a resource within the service. Resource-based policies include a Principal element to specify which IAM identities can access that resource. For more information, see Identity-based policies and resource-based policies.

  • ABAC (authorization based on tags) – To control access based on tags, you provide tag information in the condition element of a policy using the aws:ResourceTag/key-name, aws:RequestTag/key-name, or aws:TagKeys condition keys. If a service supports all three condition keys for every resource type, then the value is Yes for the service. If a service supports all three condition keys for only some resource types, then the value is Partial. For more information about defining permissions based on attributes such as tags, see What is ABAC for Amazon?. To view a tutorial with steps for setting up ABAC, see Use attribute-based access control (ABAC).

  • Temporary credentials – You can use short-term credentials that you obtain when you sign in using IAM Identity Center, switch roles in the console, or that you generate using Amazon STS in the Amazon CLI or Amazon API. You can access services with a No value only while using your long-term IAM user credentials. This includes a user name and password or your user access keys. For more information, see Temporary security credentials in IAM.

  • Service-linked roles – A service-linked role is a special type of service role that gives the service permission to access resources in other services on your behalf. Choose the Yes link to see the documentation for services that support these roles. This column does not indicate if the service uses standard service roles. For more information, see Using service-linked roles.

  • More information – If a service doesn't fully support a feature, you can review the footnotes for an entry to view the limitations and links to related information.

Compute services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon App Runner Yes Yes No Yes Yes Yes
Amazon Batch Yes Partial No Yes Yes Yes
Amazon Elastic Compute Cloud (Amazon EC2) Yes Partial No Yes Yes Partial¹
Amazon EC2 Auto Scaling Yes Yes No Yes Yes Yes
EC2 Image Builder Yes Yes No Yes Yes Yes
Amazon EC2 Instance Connect Yes Yes No No Yes No
Amazon Elastic Beanstalk Yes Partial No Yes Yes Yes
Amazon Elastic Inference Yes Yes No No Yes No
Amazon Elastic Load Balancing Yes Partial No Partial Yes Yes
Amazon Lambda Yes Yes Yes Partial² Yes Partial³
Amazon Lightsail Yes Partial⁴ No Partial⁴ Yes Yes
Amazon Outposts Yes Yes No No Yes Yes
Amazon Recycle Bin Yes Yes No Yes Yes No
Amazon Serverless Application Repository Yes Yes Yes No Yes No
Amazon SimSpace Weaver Yes Yes No Yes Yes No

¹ Amazon EC2 service-linked roles can be used only for the following features: Spot Instance Requests, Spot Fleet Requests, Amazon EC2 Fleets, and Fast launching for Windows instances.

² Amazon Lambda supports attribute-based access control (ABAC) for API actions that use a Lambda function as the required resource. Layers, event source mappings, and code signing config resources are not supported.

³ Amazon Lambda doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.

⁴ Amazon Lightsail partially supports resource-level permissions and ABAC. For more information, see Actions, resources, and condition keys for Amazon Lightsail.

Containers services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon App2Container Yes No No No Yes No
Amazon App Runner Yes Yes No Yes Yes Yes
Amazon Elastic Container Registry (Amazon ECR) Yes Yes Yes Yes Yes Yes
Amazon Elastic Container Registry Public (Amazon ECR Public) Yes Yes No Yes Yes No
Amazon Elastic Container Service (Amazon ECS) Yes Partial¹ No Yes Yes Yes
Amazon Elastic Kubernetes Service (Amazon EKS) Yes Yes No Yes Yes Yes

¹ Only some Amazon ECS actions support resource-level permissions.

Storage services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Backup Yes Yes Yes Yes Yes Yes
Amazon Backup Gateway Yes Yes No Yes Yes No
Amazon Backup storage Yes No No No Yes No
Amazon Elastic Block Store (Amazon EBS) Yes Partial No Yes Yes No
Amazon Elastic Disaster Recovery Yes Yes No Yes Yes Yes
Amazon Elastic File System (Amazon EFS) Yes Yes Yes Partial Yes Yes
Amazon FSx Yes Yes No Yes Yes Yes
Amazon Import/Export Yes No No No Yes No
Amazon S3 Glacier Yes Yes Yes Yes Yes No
Amazon Simple Storage Service (Amazon S3) Yes Yes Yes Partial¹ Yes Partial²
Amazon Simple Storage Service (Amazon S3) on Amazon Outposts Yes Yes Yes No Yes No
Amazon Simple Storage Service (Amazon S3) Object Lambda Yes Yes No No Yes No
Amazon Snow Device Management Yes Yes No Yes Yes No
Amazon Snowball Yes No No No Yes No
Amazon Snowball Edge Yes No No No Yes No
Amazon Storage Gateway Yes Yes No Yes Yes No

¹ Amazon S3 supports tag-based authorization for only object resources.

² Amazon S3 supports service-linked roles for Amazon S3 Storage Lens.

Database services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Database Query Metadata Service Yes No No No Yes No
Amazon DocumentDB Elastic Clusters Yes Yes No Yes Yes No
Amazon DynamoDB Yes Yes No No Yes No
Amazon DynamoDB Accelerator (DAX) Yes Yes No No Yes Yes
Amazon ElastiCache Yes Yes No Yes Yes Yes
Amazon Keyspaces (for Apache Cassandra) Yes Yes No Yes Yes Yes
Amazon MediaImport Yes No No No No No
Amazon MemoryDB for Redis Yes Yes No Yes Yes Yes
Amazon Neptune Yes Yes No No Yes Yes
Amazon Performance Insights Yes Yes No No Yes No
Amazon Quantum Ledger Database (Amazon QLDB) Yes Yes No Yes Yes No
Amazon Redshift Yes Yes No Yes Yes Yes
Amazon Redshift Data API Yes Yes No No Yes No
Amazon Redshift Serverless Yes Yes Yes Yes Yes No
Amazon Relational Database Service (Amazon RDS)¹ Yes Yes No Yes Yes Yes
Amazon RDS Data API Yes Yes No No Yes No
Amazon RDS IAM Authentication Yes Yes No No Yes No
Amazon SimpleDB Yes Yes No No Yes No
Amazon SQL Workbench Yes Yes No Yes Yes No
Amazon Timestream Yes Yes No Yes Yes No

¹ Amazon Aurora is a fully managed relational database engine that's compatible with MySQL and PostgreSQL. You can choose the Aurora MySQL or Aurora PostgreSQL as the DB engine option when setting up new database servers through Amazon RDS. For more information, see Identity and access management for Amazon Aurora in the Amazon Aurora User Guide.

Developer tools services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Cloud9 Yes Yes Yes Yes Yes Yes
Amazon Web Services Cloud Control API Yes No No No Yes No
Amazon CloudShell Yes Yes No No Yes No
Amazon CodeArtifact Yes Yes Yes Yes Yes No
Amazon CodeBuild Yes Yes Yes¹ Partial² Yes No
Amazon CodeCatalyst Yes Yes No Yes Yes No
Amazon CodeCommit Yes Yes No Yes Yes No
Amazon CodeDeploy Yes Yes No Yes Yes No
Amazon CodeDeploy secure host commands service Yes No No No Yes No
Amazon CodePipeline Yes Partial No Yes Yes No
AWS CodeStar Yes Partial No Yes Yes No
AWS CodeStar Connections Yes Yes No Yes Yes No
AWS CodeStar Notifications Yes Yes No Yes Yes Yes
Amazon CodeWhisperer Yes Yes No No Yes No
Amazon Fault Injection Simulator Yes Yes No Yes Yes Yes
Amazon Microservice Extractor for .NET Yes No No No Yes No
Amazon X-Ray Yes Partial³ No Partial⁴ Yes No

¹ CodeBuild supports cross-account resource sharing using Amazon RAM.

² CodeBuild supports ABAC for project-based actions.

³ X-Ray does not support resource-level permissions for all actions.

⁴ X-Ray supports tag-based access control for groups and sampling rules.

Security, identity, and compliance services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Artifact Yes Yes No No Yes No
Amazon Audit Manager Yes Yes No Yes Yes Yes
Amazon Cloud Directory Yes Yes No No Yes No
Amazon CodeGuru Security Yes No No No Yes No
Amazon Cognito Yes Yes No Yes Yes Yes
Amazon Cognito Sync Yes Yes No No Yes Yes
Amazon Cognito user pools Yes Yes No Yes Yes Yes
Amazon Detective Yes Yes No Yes Yes No
Amazon Directory Service Yes Yes No Yes Yes No
Amazon Firewall Manager Yes Yes No Yes Yes Partial
Amazon GuardDuty Yes Yes No Yes Yes Yes
Amazon IAM Identity Center (successor to Amazon Single Sign-On) Yes Yes No Yes Yes Yes
IAM Identity Center Directory Yes No No No Yes No
IAM Identity Center Identity Store Yes Yes No No Yes No
Amazon Identity Store Auth Yes No No No Yes No
Amazon Identity and Access Management (IAM) Yes Yes Partial¹ Partial² Partial³ No
Amazon Identity and Access Management Access Analyzer Yes Yes No Yes Yes Partial
Amazon Identity and Access Management Roles Anywhere Yes Yes No Yes Yes Yes
Amazon Identity Sync Yes Yes No No Yes No
Amazon Inspector Yes Yes No Yes Yes Yes
Amazon Inspector Classic Yes No No No Yes Yes
Amazon Macie Yes Yes No Yes Yes Yes
Amazon Network Firewall Yes Yes No Yes Yes Yes
Amazon Resource Access Manager (Amazon RAM) Yes Yes No Yes Yes Yes
Amazon Secrets Manager Yes Yes Yes Yes Yes No
Amazon Security Hub Yes Yes No Yes Yes Yes
Amazon Security Lake Yes No No No Yes Yes
Amazon Security Token Service (Amazon STS) Yes Partial⁴ No Yes Partial⁵ No
Amazon Shield Yes Yes No Yes Yes Yes
Amazon WAF Yes Yes No Yes Yes Yes
Amazon WAF Classic Yes Yes No Yes Yes Yes
Amazon WAF Regional Yes Yes No Yes Yes Yes

¹ IAM supports only one type of resource-based policy called a role trust policy, which is attached to an IAM role. For more information, see Granting a user permissions to switch roles.

² IAM supports tag-based access control for most IAM resources. For more information, see Tagging IAM resources.

³ Only some of the API actions for IAM can be called with temporary credentials. For more information, see Comparing your API options.

⁴ Amazon STS does not have "resources," but does allow restricting access in a similar way to users. For more information, see Denying Access to Temporary Security Credentials by Name.

⁵ Only some of the API operations for Amazon STS support calling with temporary credentials. For more information, see Comparing your API options.

Cryptography and PKI services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Certificate Manager (ACM) Yes Yes No Yes Yes Yes
Amazon Private Certificate Authority (Amazon Private CA) Yes Yes Yes Yes Yes No
Amazon CloudHSM Yes Yes No Yes Yes Yes
Amazon Key Management Service (Amazon KMS) Yes Yes Yes Yes Yes Yes
Amazon Signer Yes Yes Yes Yes Yes No

Machine learning services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon BugBust Yes Yes No Yes Yes Yes
Amazon CodeGuru Profiler Yes Yes No Yes Yes Yes
Amazon CodeGuru Reviewer Yes Yes No Yes Yes Yes
Amazon Comprehend Yes Yes No Yes Yes No
Amazon Comprehend Medical Yes No No No Yes No
Amazon DeepComposer Yes Yes No Yes Yes No
Amazon DeepLens Yes Yes No No Yes No
Amazon DeepRacer Yes Yes No Yes Yes Yes
Amazon DevOps Guru Yes Yes No No Yes Yes
Amazon Forecast Yes Yes No Yes Yes No
Amazon Fraud Detector Yes Yes No Yes Yes No
Ground Truth Labeling Yes No No No Yes No
Amazon HealthLake Yes Yes No Yes Yes No
Amazon Kendra Yes Yes No Yes Yes No
Amazon Kendra Intelligent Ranking Yes Yes No Yes Yes No
Amazon Lex Yes Yes No Yes Yes Yes
Amazon Lex V2 Yes Yes Yes Yes Yes Yes
Amazon Lookout for Equipment Yes Yes No Yes Yes No
Amazon Lookout for Metrics Yes Yes No Yes Yes No
Amazon Lookout for Vision Yes Yes No Yes Yes No
Amazon Machine Learning Yes Yes No No Yes No
Amazon Monitron Yes Yes No Yes Yes Yes
Amazon Omics Yes Yes No Yes Yes No
Amazon Panorama Yes Yes No Yes Yes Yes
Amazon Personalize Yes Yes No No Yes No
Amazon Polly Yes Yes No No Yes No
Amazon Rekognition Yes Yes No Yes Yes No
Amazon SageMaker Yes Yes No Yes Yes Partial¹
Amazon SageMaker geospatial capabilities Yes Yes No Yes Yes No
Amazon SageMaker Ground Truth Synthetic Yes No No No Yes No
Amazon Textract Yes No No No Yes No
Amazon Transcribe Yes Yes No Yes Yes No
Amazon Translate Yes Yes No Yes Yes No

¹ Service-linked roles are currently available for SageMaker Studio and SageMaker training jobs.

Management and governance services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Account Management Yes Yes No No Yes No
Application Auto Scaling Yes Yes No Yes Yes Yes
Amazon AppConfig Yes Yes No Yes Yes No
Amazon Auto Scaling Yes No No No Yes Yes
Amazon Chatbot Yes Yes No No Yes Yes
Amazon CloudFormation Yes Yes No Yes Yes No
Amazon CloudTrail Yes Yes Partial¹ Yes Yes Yes
Amazon CloudTrail Data Yes Yes No Yes Yes No
Amazon CloudWatch Yes Yes No Yes Yes Partial²
Amazon CloudWatch Application Insights Yes No No No Yes No
Amazon CloudWatch Evidently Yes Yes No Yes Yes No
Amazon CloudWatch Internet Monitor Yes Yes No Yes Yes No
Amazon CloudWatch Logs Yes Yes Yes Partial Yes Yes
Amazon CloudWatch Observability Access Manager Yes Yes No Yes Yes No
Amazon CloudWatch RUM Yes Yes No Yes Yes No
Amazon CloudWatch Synthetics Yes Yes No Yes Yes No
Amazon Compute Optimizer Yes No No No Yes Yes
Amazon Config Yes Partial³ No Yes Yes Yes
Amazon Control Tower Yes No No No Yes No
Amazon Data Lifecycle Manager Yes Yes No Yes Yes No
Amazon Health APIs And Notifications Yes Yes No No Yes No
Amazon Launch Wizard Yes No No No Yes No
Amazon License Manager Yes Yes No Yes Yes Yes
Amazon License Manager Linux Subscriptions Manager Yes No No No Yes No
Amazon License Manager User Subscriptions Yes No No No Yes Yes
Amazon Managed Grafana Yes Yes No Yes Yes Yes
Amazon Managed Service for Prometheus Yes Yes No Yes Yes No
Amazon Message Delivery Service Yes No No No Yes No
Amazon OpsWorks Yes Yes No No Yes No
Amazon OpsWorks Configuration Management Yes Yes No No Yes No
Amazon Organizations Yes Yes No Yes No Yes
Amazon Proton Yes Yes No Yes Yes Yes
Amazon Resilience Hub Yes Yes No Yes Yes No
Amazon Resource Explorer Yes Yes No Yes Yes No
Amazon Resource Groups Yes Yes No Yes Partial⁴ No
Amazon Resource Groups Tagging API Yes No No No Yes No
Amazon RHEL Knowledgebase Portal Yes No No No Yes No
Service Catalog Yes Yes No Yes Yes Yes
Service Quotas Yes Yes No Yes Yes No
Amazon Session Manager Message Gateway Service Yes No No No Yes No
Amazon Systems Manager Yes Yes No Yes Yes Yes
Amazon Systems Manager for SAP Yes Yes No Yes Yes No
Amazon Systems Manager GUI Connect Yes No No No Yes No
Amazon Systems Manager Incident Manager Yes Yes Yes Yes Yes Yes
Amazon Systems Manager Incident Manager Contacts Yes Yes Yes No Yes No
Tag Editor Yes No No No Yes No
Amazon Telco Network Builder Yes Yes No Yes Yes No
Amazon Trusted Advisor Partial⁵ Yes No No Partial Yes
Amazon Well-Architected Tool Yes Yes No Yes Yes No

¹ Amazon CloudTrail supports resource-based policies only on CloudTrail channels used for CloudTrail Lake integrations with event sources outside of Amazon.

² Amazon CloudWatch service-linked roles cannot be created using the Amazon Web Services Management Console, and support only the Alarm Actions feature.

³ Amazon Config supports resource-level permissions for multi-account multi-Region data aggregation and Amazon Config Rules. For a list of supported resources, see the Multi-Account Multi-Region Data Aggregation section and Amazon Config Rules section of Amazon Config API Guide.

⁴ Users can assume a role with a policy that allows Amazon Resource Groups operations.

⁵ API access to Trusted Advisor is through the Amazon Web Services Support API and is controlled by Amazon Web Services Support IAM policies.

Migration and transfer services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Application Discovery Service Yes No No No Yes Yes
Amazon Application Discovery Arsenal Yes No No No Yes No
Amazon Application Migration Service Yes Yes No Yes Yes Yes
Amazon Connector Service Yes No No No Yes No
Amazon Transfer Family Yes Yes No Yes Yes No
Amazon Database Migration Service Yes Yes No¹ Yes Yes Yes
Amazon DataSync Yes Yes No Yes Yes Yes
Amazon Mainframe Modernization Yes Yes No Yes Yes Yes
Amazon Migration Hub Yes Yes No No Yes Yes
Amazon Migration Hub Orchestrator Yes Yes No Yes Yes No
Amazon Migration Hub Refactor Spaces Yes Yes No Yes Yes Yes
Amazon Migration Hub Strategy Recommendations Yes No No No Yes Yes
Amazon Server Migration Service Yes No No No Yes Yes

¹ You can create and modify policies that are attached to Amazon KMS encryption keys you create to encrypt data migrated to supported target endpoints. The supported target endpoints include Amazon Redshift and Amazon S3. For more information, see Creating and Using Amazon KMS Keys to Encrypt Amazon Redshift Target Data and Creating Amazon KMS Keys to Encrypt Amazon S3 Target Objects in the Amazon Database Migration Service User Guide.

Mobile services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Amplify Yes Yes No Yes Yes No
Amazon Amplify Admin Yes Yes No No Yes No
Amazon Amplify UI Builder Yes Yes No Yes Yes No
Amazon AppSync Yes Yes No Yes Yes No
Amazon Device Farm Yes Yes No Yes Yes Yes
Amazon Location Service Yes Yes No Yes Yes No

Networking and content delivery services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon API Gateway Yes Yes Yes No Yes Yes
Amazon API Gateway Management Yes Yes No Yes Yes No
Amazon API Gateway Management V2 Yes Yes No Yes Yes No

Amazon App Mesh

Yes Yes No Yes Yes Yes

Amazon App Mesh Preview

Yes Yes No No Yes Yes
Amazon Client VPN Yes Yes No No Yes Yes

Amazon CloudFront

Yes Yes No Yes Yes Partial¹

Amazon Cloud Map

Yes Yes No Yes Yes No
Amazon Direct Connect Yes Yes No Yes Yes Yes
Amazon Global Accelerator Yes Yes No Yes Yes Yes
Amazon Network Manager Yes Yes No Yes Yes Yes²
Amazon Private 5G Yes Yes No Yes Yes No
Amazon Route 53 Yes Yes No No Yes No
Amazon Route 53 Application Recovery Controller - Zonal Shift Yes Yes No No Yes No
Amazon Route 53 Domains Yes No No No No No
Amazon Route 53 Recovery Cluster Yes Yes No No Yes No
Amazon Route 53 Recovery Control Config Yes Yes No Yes Yes No
Amazon Route 53 Recovery Readiness Yes Yes No Yes Yes Yes
Amazon Route 53 Resolver Yes Yes No Yes Yes Yes
Amazon Site-to-Site VPN Yes Yes No No Yes Yes
Amazon Tiros API (for Reachability Analyzer) Yes No No No No No
Amazon Virtual Private Cloud (Amazon VPC) Yes Partial³ Partial⁴ Yes Yes Partial⁵
Amazon VPC Lattice Yes Yes No Yes Yes No
Amazon VPC Lattice Services Yes Yes No No Yes No

¹ Amazon CloudFront doesn't have service-linked roles, but Lambda@Edge does. For more information, see Service-Linked Roles for Lambda@Edge in the Amazon CloudFront Developer Guide.

² Amazon Cloud WAN also supports service-linked roles. For more information, see Amazon Cloud WAN service-linked roles in the Amazon VPC Amazon Cloud WAN Guide.

³ In an IAM user policy, you cannot restrict permissions to a specific Amazon VPC endpoint. Any Action element that includes the ec2:*VpcEndpoint* or ec2:DescribePrefixLists API actions must specify ""Resource": "*"". For more information, see Identity and access management for VPC endpoints and VPC endpoint services in the Amazon PrivateLink Guide.

⁴ Amazon VPC supports attaching a single resource policy to a VPC endpoint to restrict what can be accessed through that endpoint. For more information about using resource-based policies to control access to resources from specific Amazon VPC endpoints, see Control access to services using endpoint policies in the Amazon PrivateLink Guide.

⁵ Amazon VPC doesn't have service-linked roles, but Amazon Transit Gateway does. For more information, see Use service-linked roles for transit gateway in the Amazon VPC Amazon Transit Gateway Guide.

Media services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Elastic Transcoder Yes Yes No No Yes No
Amazon Elemental Appliances and Software Yes Yes No Yes Yes No
Amazon Elemental Appliances and Software Activation Service Yes Yes No Yes Yes No
AWS Elemental MediaConnect Yes Yes No No Yes No
AWS Elemental MediaConvert Yes Yes No Yes Yes No
AWS Elemental MediaLive Yes Yes No Yes Yes No
AWS Elemental MediaPackage Yes Yes No Yes Yes Partial¹
AWS Elemental MediaPackage VOD Yes Yes No Yes Yes Partial¹
AWS Elemental MediaStore Yes Yes Yes Yes Yes No
AWS Elemental MediaTailor Yes Yes No Yes Yes Yes
Amazon Elemental Support Cases Yes No No No Yes No
Amazon Elemental Support Content Yes No No No Yes No
Amazon Interactive Video Service Yes Yes No Yes Yes Yes
Amazon Interactive Video Service Chat Yes Yes No Yes Yes No
Amazon Kinesis Video Streams Yes Yes No Yes Yes No
Amazon Nimble Studio Yes Yes No Yes Yes No

¹ MediaPackage supports service-linked roles for publishing customer access logs to CloudWatch but not for other API actions.

Analytics services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Athena Yes Yes No Yes Yes No
Amazon Clean Rooms Yes Yes No Yes Yes No
Amazon CloudSearch Yes Yes No No Yes No
Amazon Data Exchange Yes Yes No Yes Yes No
Amazon Data Pipeline Yes Yes No Partial Yes No
Amazon DataZone Yes No No No Yes No
Amazon DataZone Control Yes Yes No Yes Yes No
Amazon OpenSearch Service Yes Yes Yes Yes Yes Yes
Amazon OpenSearch Serverless Yes Yes No Yes Yes Yes
Amazon EMR Yes Yes No Yes Yes Yes
Amazon EMR on EKS Yes Yes No Yes Yes Yes
Amazon EMR Serverless Yes Yes No Yes Yes Yes
Amazon FinSpace Yes Yes No Yes Yes No
Amazon FinSpace API Yes Yes No No Yes No
Amazon Glue Yes Yes Yes Partial Yes No
Amazon Glue DataBrew Yes Yes No Yes Yes No
Amazon Kinesis Data Analytics Yes Yes No Yes Yes No
Amazon Kinesis Data Analytics V2 Yes Yes No Yes Yes No
Amazon Kinesis Data Firehose Yes Yes No Yes Yes No
Amazon Kinesis Data Streams Yes Yes No No Yes No
Amazon Lake Formation Yes No No No Yes Yes
Amazon Managed Streaming for Apache Kafka (MSK) Yes Yes No Yes Yes Yes
Amazon Managed Streaming for Kafka Connect Yes Yes No No Yes Yes
Apache Kafka APIs for Amazon MSK clusters Yes Yes No No Yes No
Amazon Managed Workflows for Apache Airflow Yes Yes No Yes Yes No
Amazon QuickSight Yes Yes No Yes Yes No

Application integration services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon AppFlow Yes Yes No Yes Yes No
Amazon EventBridge Yes Yes Yes Yes Yes No
Amazon EventBridge Pipes Yes Yes No Yes Yes No
Amazon EventBridge Scheduler Yes Yes No Yes Yes No
Amazon EventBridge Schemas Yes Yes Yes Yes Yes No
Amazon MQ Yes Yes No Yes Yes Yes
Amazon Simple Notification Service (Amazon SNS) Yes Yes Yes Yes Yes No
Amazon Simple Queue Service (Amazon SQS) Yes Yes Yes Yes Yes No
Amazon Step Functions Yes Yes No Yes Yes No
Amazon Simple Workflow Service (Amazon SWF) Yes Yes No Yes Yes No

Business applications services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Alexa for Business Yes Yes No Yes Yes No
Amazon Chime Yes Yes No Yes Yes Yes
Amazon Honeycode Yes Yes No No Yes No
Amazon Supply Chain Yes Yes No Yes Yes No
Amazon WorkMail Yes Yes No Yes Yes Yes
Amazon WorkMail Message Flow Yes Yes No No Yes No

Satellite services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Ground Station Yes Yes No Yes Yes No

Internet of Things services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
FreeRTOS Yes Yes No Yes Yes No
Amazon IoT Yes Yes Partial¹ Yes Yes No
Amazon IoT 1-Click Yes Yes No Yes Yes No
Amazon IoT Analytics Yes Yes No Yes Yes No
Amazon IoT Core Device Advisor Yes Yes No Yes Yes No
Amazon IoT Device Tester Yes No No No Yes No
Amazon IoT Events Yes Yes No Yes Yes No
Fleet Hub for Amazon IoT Device Management Yes Yes No Yes Yes No
Amazon IoT FleetWise Yes Yes No Yes Yes No
Amazon IoT Greengrass Yes Yes No Yes Yes No
Amazon IoT Greengrass V2 Yes Yes No Yes Yes No
Amazon IoT Jobs DataPlane Yes Yes No No Yes No
Amazon IoT RoboRunner Yes Yes No No Yes No
Amazon IoT SiteWise Yes Yes No Yes Yes Yes
Amazon IoT TwinMaker Yes Yes No Yes Yes No
Amazon IoT Wireless Yes Yes No Yes Yes No

¹ Devices connected to Amazon IoT are authenticated by using X.509 certificates or using Amazon Cognito Identities. You can attach Amazon IoT policies to an X.509 certificate or Amazon Cognito Identity to control what the device is authorized to do. For more information, see Security and Identity for Amazon IoT in the Amazon IoT Developer Guide.

Robotics services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon RoboMaker Yes Yes No Yes Yes Yes

Quantum Computing Services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Braket Yes Yes No Yes Yes Yes

Blockchain services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Managed Blockchain Yes Yes No Yes Yes No

Game development services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon GameLift Yes Yes No Yes Yes No
Amazon GameSparks Yes Yes No Yes Yes No

AR & VR services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Sumerian Yes Yes No No Yes No

Customer enablement services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon IQ Yes Yes No No Yes No
Amazon IQ Permissions Yes Yes No No Yes No
Amazon Web Services Support Yes No No No Yes Yes
Amazon Web Services Support App in Slack Yes No No No Yes No
Amazon Web Services Support Plans Yes No No No Yes No

Customer engagement services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon AppIntegrations Yes Yes No Yes Yes Yes
Amazon Connect Yes Yes No Yes Yes Yes
Amazon Connect Cases Yes Yes No Yes Yes No
Amazon Connect Customer Profiles Yes Yes No Yes Yes No
Amazon Connect High-volume outbound communications Yes Yes No Yes Yes No
Amazon Connect Voice ID Yes Yes No Yes Yes No
Amazon Connect Wisdom Yes Yes No Yes Yes No
Amazon Pinpoint Yes Yes No Yes Yes No
Amazon Pinpoint Email Service Yes Yes No Yes Yes No
Amazon Pinpoint SMS and Voice Service Yes No No No Yes No
Amazon Pinpoint SMS and Voice Service v2 Yes Yes No Yes Yes No
Amazon Simple Email Service (Amazon SES) v2 Yes Partial¹ Yes Yes Partial² No

¹ You can only use resource-level permissions in policy statements that refer to actions related to sending email, such as ses:SendEmail or ses:SendRawEmail. For policy statements that refer to any other actions, the Resource element can only contain *.

² Only the Amazon SES API supports temporary security credentials. The Amazon SES SMTP interface does not support SMTP credentials that are derived from temporary security credentials.

End user computing services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon AppStream 2.0 Yes Yes No Yes Yes No
Amazon WAM Yes No No No Yes No
Amazon Wickr Yes Yes No Yes Yes No
Amazon WorkDocs Yes No No No Yes No
Amazon WorkSpaces Yes Yes No Yes Yes No
Amazon WorkSpaces Application Manager Yes No No No Yes No
Amazon WorkSpaces Web Yes Yes No Yes Yes Yes

Billing and cost management services

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Application Cost Profiler Service Yes No No No Yes No
Amazon Billing and Cost Management Yes No No No Yes No
Amazon Billing Conductor Yes Yes No Yes Yes No
Amazon CloudAssist service read write permissions Yes No No No Yes No
Amazon Consolidated Billing Yes No No No Yes No
Amazon Cost and Usage Report Yes Yes No No Yes No
Amazon Cost Explorer Yes Yes No Yes Yes No
Amazon Fapiao Management Yes No No No Yes No
Amazon Free Tier Yes No No No Yes No
Amazon Invoicing Service Yes No No No Yes No
Amazon Payments Yes No No No Yes No
Amazon Price List Yes No No No Yes No
Amazon Purchase Orders Console Yes No No No Yes No
Amazon Savings Plans Yes Yes No Yes Yes No
Amazon Sustainability Yes No No No Yes No
Amazon Tax Settings Yes No No No Yes No

Additional resources

Service Actions Resource-level permissions Resource-based policies ABAC Temporary credentials Service-linked roles
Amazon Activate Yes No No No Yes No
Amazon Budget Service Yes Yes No No No No
Amazon Web Services Marketplace Yes No No No Yes Yes
Amazon Web Services Marketplace Catalog Yes Yes No Yes Yes No
Amazon Marketplace Commerce Analytics Yes No No No No No
Amazon Web Services Marketplace Discovery Yes No No No Yes No
Amazon Web Services Marketplace Management Portal Yes No No No Yes No
Amazon Marketplace Metering Service Yes No No No Yes No
Amazon Web Services Marketplace Private Marketplace Yes No No No Yes No
Amazon Web Services Marketplace Seller Reporting Yes Yes No No Yes No
Amazon Web Services Marketplace Vendor Insights Yes Yes No Yes Yes No
Amazon Mechanical Turk Yes No No No Yes No