Amazon Batch IAM policies, roles, and permissions

By default, users don't have permission to create or modify Amazon Batch resources or to perform tasks using the Amazon Batch API, Amazon Batch console, or the Amazon CLI. To allow users to perform these actions, create IAM policies that grant users permission for the specific resources and API operations. Then, attach the policies to the users or groups that require those permissions.

When you attach a policy to a user or group of users, the policy either allows or denies the permissions to perform specific tasks on specific resources. For more information, see Permissions and Policies in the IAM User Guide. For more information about managing and creating custom IAM policies, see Managing IAM Policies.

Amazon Batch makes calls to other Amazon Web Services on your behalf. As a result, Amazon Batch must authenticate using your credentials. More specifically, Amazon Batch authenticates by creating an IAM role and policy that provides these permissions. Then, it associates the role with your compute environments when you create them. For more information, see Amazon ECS instance role, IAM Roles, Using Service-Linked Roles, and Creating a Role to Delegate Permissions to an Amazon Service in the IAM User Guide.

Getting Started

An IAM policy must grant or deny permissions to use one or more Amazon Batch actions.