View a markdown version of this page

Amazon managed policies for Amazon Resource Explorer - Amazon Resource Explorer
AWSResourceExplorerFullAccessAWSResourceExplorerReadOnlyAccessAWSResourceExplorerServiceRolePolicyAWSResourceExplorerOrganizationsAccessPolicy updates
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon managed policies for Amazon Resource Explorer

An Amazon managed policy is a standalone policy that is created and administered by Amazon. Amazon managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that Amazon managed policies might not grant least-privilege permissions for your specific use cases because they're available for all Amazon customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in Amazon managed policies. If Amazon updates the permissions defined in an Amazon managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. Amazon is most likely to update an Amazon managed policy when a new Amazon Web Services service is launched or new API operations become available for existing services.

For more information, see Amazon managed policies in the IAM User Guide.

General Amazon managed policies that include Resource Explorer permissions

  • AdministratorAccess – Grants full access to Amazon Web Services services and resources.

  • ReadOnlyAccess – Grants read-only access to Amazon Web Services services and resources.

  • ViewOnlyAccess – Grants permissions to view resources and basic metadata for Amazon Web Services services.

    Note

    The Resource Explorer Get* permissions included in the ViewOnlyAccess policy perform like List permissions although they return only a single value, because a Region can contain only one index and one default view.

Amazon managed policies for Resource Explorer

Amazon managed policy: AWSResourceExplorerFullAccess

You can assign the AWSResourceExplorerFullAccess policy to your IAM identities.

This policy grants permissions that allow full administrative control of the Resource Explorer service. You can perform all tasks involved in turning on and managing Resource Explorer in the Amazon Web Services Regions in your account. With this policy, the Resource Explorer console shows information from other integrated Amazon services and allows you to perform actions such as creating an application.

Permissions details

This policy includes permissions that allow all actions for Resource Explorer, including turning on and turning off Resource Explorer in Amazon Web Services Regions, creating or deleting an aggregator index for the account, creating, updating, and deleting views, and searching. This policy also includes permissions that are not part of Resource Explorer:

  • ec2:DescribeRegions – allows Resource Explorer to access the details about the Regions in your account.

  • ram:ListResources – allows Resource Explorer to list the resource shares that resources are part of.

  • ram:GetResourceShares – allows Resource Explorer to identify details about the resource shares that you own or that are shared with you.

  • iam:CreateServiceLinkedRole (included in the AWSResourceExplorerFullAccess managed policy) – allows Resource Explorer to create the required service-linked role when you turn on Resource Explorer by creating the first index.

  • organizations:DescribeOrganization – allows Resource Explorer to access information about your organization.

To see the latest version of this Amazon managed policy, see AWSResourceExplorerFullAccess in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSResourceExplorerReadOnlyAccess

You can assign the AWSResourceExplorerReadOnlyAccess policy to your IAM identities.

This policy grants read-only permissions that allows users to discover their resources with basic search access, and access other integrated Amazon services in the Resource Explorer console.

Permissions details

This policy includes permissions that allow users to perform the Resource Explorer Get*, List*, and Search operations to view information about Resource Explorer components and configuration settings, but doesn't allow users to change them. Users can also search. This policy also includes two permissions that are not part of Resource Explorer:

  • ec2:DescribeRegions – allows Resource Explorer to access the details about the Regions in your account.

  • ram:ListResources – allows Resource Explorer to list the resource shares that resources are part of.

  • ram:GetResourceShares – allows Resource Explorer to identify details about the resource shares that you own or that are shared with you.

  • organizations:DescribeOrganization – allows Resource Explorer to access information about your organization.

To see the latest version of this Amazon managed policy, see AWSResourceExplorerReadOnlyAccess in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSResourceExplorerServiceRolePolicy

You can't attach AWSResourceExplorerServiceRolePolicy to any IAM entities yourself. This policy can be attached only to a service-linked role that allows Resource Explorer to perform actions on your behalf. For more information, see Using service-linked roles for Resource Explorer.

This policy grants the permissions required for Resource Explorer to retrieve information about your resources. Resource Explorer populates the indexes it maintains in each Amazon Web Services Region that you register.

To see the latest version of this Amazon managed policy, AWSResourceExplorerServiceRolePolicy in the Amazon Managed Policy Reference Guide.

Amazon managed policy: AWSResourceExplorerOrganizationsAccess

You can assign AWSResourceExplorerOrganizationsAccess to your IAM identities.

This policy grants administrative permissions to Resource Explorer and grants read-only permissions to other Amazon Web Services services to support this access. The Amazon Organizations administrator needs these permissions to set up and manage multi-account search in the console.

Permissions details

This policy includes permissions that allow administrators to set up multi-account search for the organization:

  • ec2:DescribeRegions – Allows Resource Explorer to access the details about the Regions in your account.

  • ram:ListResources – Allows Resource Explorer to list the resource shares that resources are part of.

  • ram:GetResourceShares – Allows Resource Explorer to identify details about the resource shares that you own or that are shared with you.

  • organizations:ListAccounts – Allows Resource Explorer to identify the accounts within an organization.

  • organizations:ListRoots – Allows Resource Explorer to identify the root accounts within an organization.

  • organizations:ListOrganizationalUnitsForParent – Allows Resource Explorer to identify the organizational units (OUs) in a parent organizational unit or root.

  • organizations:ListAccountsForParent – Allows Resource Explorer to identify the accounts in an organization that are contained by the specified target root or an OU.

  • organizations:ListDelegatedAdministrators – Allows Resource Explorer to identify the Amazon accounts that are designated as delegated administrators in this organization.

  • organizations:ListAWSServiceAccessForOrganization – Allows Resource Explorer to identify a list of the Amazon Web Services services that are enabled to integrate with your organization.

  • organizations:DescribeOrganization – Allows Resource Explorer to retrieve information about the organization that the user's account belongs to.

  • organizations:EnableAWSServiceAccess – Allows Resource Explorer to enable the integration of an Amazon Web Services service (the service that is specified by ServicePrincipal) with Amazon Organizations.

  • organizations:DisableAWSServiceAccess – Allows Resource Explorer to disable the integration of an Amazon Web Services service (the service that is specified by ServicePrincipal) with Amazon Organizations.

  • organizations:RegisterDelegatedAdministrator – Allows Resource Explorer to enable the specified member account to administer the organization's features of the specified Amazon service.

  • organizations:DeregisterDelegatedAdministrator – Allows Resource Explorer to remove the specified member Amazon Web Services account as a delegated administrator for the specified Amazon Web Services service.

  • iam:GetRole – Allows Resource Explorer to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role.

  • iam:CreateServiceLinkedRole (included in the AWSResourceExplorerFullAccess managed policy) – Allows Resource Explorer to create the required service-linked role when you turn on Resource Explorer by creating the first index.

To see the latest version of this Amazon managed policy, see AWSResourceExplorerOrganizationsAccess in the Amazon Managed Policy Reference Guide.

Resource Explorer updates to Amazon managed policies

View details about updates to Amazon managed policies for Resource Explorer since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the Resource Explorer Document history page.

Change Description Date

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • access-analyzer:GetAnalyzer

  • access-analyzer:ListArchiveRules

  • acm-pca:DescribeCertificateAuthority

  • acm-pca:GetCertificateAuthorityCsr

  • acm-pca:ListTags

  • amplify:ListTagsForResource

  • app-integrations:GetApplication

  • app-integrations:GetEventIntegration

  • app-integrations:ListTagsForResource

  • appflow:DescribeFlow

  • appflow:ListTagsForResource

  • apprunner:DescribeService

  • apprunner:DescribeVpcConnector

  • appstream:ListTagsForResource

  • aps:DescribeRuleGroupsNamespace

  • aps:ListTagsForResource

  • auditmanager:GetAssessment

  • auditmanager:ListTagsForResource

  • backup-gateway:GetHypervisor

  • backup-gateway:ListTagsForResource

  • bedrock:GetInferenceProfile

  • codeartifact:DescribeDomain

  • codeartifact:DescribeRepository

  • codeartifact:GetDomainPermissionsPolicy

  • codeartifact:GetRepositoryPermissionsPolicy

  • codeartifact:ListTagsForResource

  • codedeploy:GetApplication

  • codedeploy:GetDeploymentConfig

  • codedeploy:ListTagsForResource

  • codeguru-profiler:DescribeProfilingGroup

  • codeguru-profiler:GetNotificationConfiguration

  • codeguru-profiler:GetPolicy

  • codeguru-profiler:ListTagsForResource

  • codeguru-reviewer:DescribeRepositoryAssociation

  • codeguru-reviewer:ListTagsForResource

  • cognito-identity:DescribeIdentityPool

  • cognito-idp:DescribeUserPool

  • cognito-idp:GetUserPoolMfaConfig

  • comprehend:DescribeFlywheel

  • comprehend:ListTagsForResource

  • connect:DescribeInstance

  • connect:DescribePhoneNumber

  • connect:DescribeQuickConnect

  • connect:DescribeRule

  • connect:DescribeUser

  • connect:GetTaskTemplate

  • connect:ListUserProficiencies

  • databrew:DescribeDataset

  • databrew:DescribeJob

  • databrew:DescribeProject

  • databrew:DescribeRecipe

  • databrew:DescribeRuleset

  • databrew:DescribeSchedule

  • databrew:ListTagsForResource

  • datasync:DescribeTask

  • datasync:ListTagsForResource

  • detective:DescribeOrganizationConfiguration

  • detective:ListTagsForResource

  • emr-containers:DescribeVirtualCluster

  • emr-serverless:GetApplication

  • fis:GetExperimentTemplate

  • fis:ListTagsForResource

  • gamelift:DescribeAlias

  • gamelift:DescribeBuild

  • gamelift:DescribeScript

  • gamelift:ListTagsForResource

  • gamelift:ValidateMatchmakingRuleSet

  • globalaccelerator:DescribeAccelerator

  • globalaccelerator:DescribeAcceleratorAttributes

  • globalaccelerator:DescribeEndpointGroup

  • globalaccelerator:DescribeListener

  • globalaccelerator:ListTagsForResource

  • grafana:DescribeWorkspace

  • grafana:DescribeWorkspaceAuthentication

  • grafana:DescribeWorkspaceConfiguration

  • grafana:ListTagsForResource

  • greengrass:DescribeComponent

  • greengrass:ListTagsForResource

  • groundstation:GetConfig

  • groundstation:GetMissionProfile

  • groundstation:ListTagsForResource

  • healthlake:DescribeFHIRDatastore

  • healthlake:ListTagsForResource

  • ivs:GetPlaybackKeyPair

  • ivs:ListTagsForResource

  • kms:GetKeyPolicy

  • profile:GetDomain

  • profile:GetProfileObjectType

  • profile:ListTagsForResource

  • schemas:DescribeDiscoverer

 August 15, 2026

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • auditmanager:ListAssessmentFrameworks

  • auditmanager:ListControls

  • cloudhsm:DescribeClusters

  • cloudtrail:ListTags

  • connect:ListQueueEmailAddresses

  • gamelift:ListFleets

  • gamelift:ListGameServerGroups

  • iot:ListCustomMetrics

  • iot:ListDimensions

  • iot:ListOTAUpdates

  • iot:ListStreams

  • iot:ListTunnels

  • partnercentral:GetBenefitApplication

  • partnercentral:ListBenefitApplications

  • partnercentral:ListTagsForResource

  • quicksight:ListFolders

  • rbin:ListRules

  • rbin:ListTagsForResource

  • rekognition:ListCollections

  • resiliencehub:ListAppAssessments

  • s3vectors:GetIndex

  • s3vectors:GetVectorBucket

  • s3vectors:ListIndexes

  • s3vectors:ListVectorBuckets

  • ses:ListEmailTemplates

  • swf:ListDomains

  • vpc-lattice:GetAccessLogSubscription

  • vpc-lattice:ListAccessLogSubscriptions

  • vpc-lattice:ListTagsForResource

 June 23, 2026

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • kinesis:ListTagsForResource

 February 04, 2026

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • events:ListTagsForResource

 December 16, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • dynamodb:DescribeTimeToLive

  • lambda:GetRuntimeManagementConfig

  • logs:DescribeResourcePolicies

 November 17, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • organizations:DescribeResourcePolicy

  • elasticloadbalancing:DescribeLoadBalancerPolicies

  • elasticloadbalancing:DescribeLoadBalancerPolicyTypes

  • elasticloadbalancing:DescribeTargetGroupAttributes

  • elasticloadbalancing:DescribeTargetHealth

  • kinesis:DescribeStreamSummary

  • kinesis:ListTagsForStream

 October 13, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • logs:ListTagsForResource

  • cloudformation:GetResource

  • cloudfront:GetDistribution

  • cloudfront:GetDistributionConfig

  • dynamodb:DescribeContinuousBackups

  • dynamodb:DescribeContributorInsights

  • dynamodb:DescribeKinesisStreamingDestination

  • dynamodb:DescribeTable

  • dynamodb:GetResourcePolicy

  • dynamodb:ListTagsOfResource

  • ecs:ListTagsForResource

  • elasticloadbalancing:DescribeCapacityReservation

  • elasticloadbalancing:DescribeLoadBalancerAttributes

  • elasticloadbalancing:DescribeTags

  • events:DescribeRule

  • events:ListTargetsByRule

  • iam:GetRole

  • iam:GetRolePolicy

  • iam:ListAttachedRolePolicies

  • iam:ListRolePolicies

  • lambda:GetEventSourceMapping

  • lambda:GetFunction

  • lambda:GetFunctionCodeSigningConfig

  • lambda:GetFunctionRecursionConfig

  • lambda:ListTags

  • logs:DescribeIndexPolicies

  • logs:GetDataProtectionPolicy

  • s3:GetAccelerateConfiguration

  • s3:GetAnalyticsConfiguration

  • s3:GetBucketCORS

  • s3:GetBucketLogging

  • s3:GetBucketMetadataTableConfiguration

  • s3:GetBucketNotification

  • s3:GetBucketObjectLockConfiguration

  • s3:GetBucketOwnershipControls

  • s3:GetBucketPublicAccessBlock

  • s3:GetBucketTagging

  • s3:GetBucketVersioning

  • s3:GetBucketWebsite

  • s3:GetEncryptionConfiguration

  • s3:GetIntelligentTieringConfiguration

  • s3:GetInventoryConfiguration

  • s3:GetLifecycleConfiguration

  • s3:GetMetricsConfiguration

  • s3:GetReplicationConfiguration

  • sns:GetDataProtectionPolicy

  • sns:GetTopicAttributes

  • sns:ListSubscriptionsByTopic

  • sns:ListTagsForResource

  • sqs:GetQueueAttributes

  • sqs:ListQueueTags

September 24, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • aoss:ListCollections

  • app-integrations:ListApplications

  • appconfig:ListEnvironments

  • appconfig:ListExtensionAssociations

  • bedrock:ListAgentAliases

  • cloudtrail:ListDashboards

  • comprehend:ListFlywheels

  • connect:ListEvaluationForms

  • connect:ListInstanceAttributes

  • connect:ListPrompts

  • connect:ListRoutingProfileQueues

  • connect:ListRoutingProfiles

  • connect:ListSecurityProfiles

  • devicefarm:ListInstanceProfiles

  • directconnect:DescribeDirectConnectGateways

  • ec2:DescribeInstanceConnectEndpoints

  • ec2:DescribeVpcBlockPublicAccessExclusions

  • eks:DescribeAccessEntry

  • eks:DescribeAddon

  • eks:DescribeFargateProfile

  • eks:DescribeIdentityProviderConfig

  • eks:DescribeNodegroup

  • eks:ListAccessEntries

  • eks:ListAddons

  • eks:ListFargateProfiles

  • eks:ListIdentityProviderConfigs

  • eks:ListNodegroups

  • fms:ListPolicies

  • fms:ListProtocolsLists

  • fsx:DescribeBackups

  • glue:ListDataQualityRulesets

  • glue:ListRegistries

  • iottwinmaker:ListSyncJobs

  • ivs:ListEncoderConfigurations

  • ivs:ListIngestConfigurations

  • ivs:ListPlaybackRestrictionPolicies

  • ivs:ListStorageConfigurations

  • lightsail:GetBuckets

  • lightsail:GetCertificates

  • lightsail:GetContainerServices

  • macie2:ListAllowLists

  • macie2:ListCustomDataIdentifiers

  • macie2:ListFindingsFilters

  • mediatailor:ListVodSources

  • network-firewall:ListRuleGroups

  • organizations:ListPolicies

  • partnercentral:ListEngagementInvitations

  • partnercentral:ListEngagements

  • partnercentral:ListOpportunities

  • partnercentral:ListResourceSnapshotJobs

  • partnercentral:ListResourceSnapshots

  • profile:ListIntegrations

  • profile:ListProfileObjectTypes

  • resiliencehub:ListApps

  • route53-recovery-control-config:ListRoutingControls

  • route53-recovery-readiness:ListCells

  • s3:ListStorageLensGroups

  • s3express:ListAllMyDirectoryBuckets

  • sagemaker:ListHubContents

  • sagemaker:ListMonitoringSchedules

  • ssm-incidents:ListResponsePlans

  • verifiedpermissions:ListPolicyStores

  • vpc-lattice:ListListeners

  • vpc-lattice:ListServiceNetworkServiceAssociations

  • vpc-lattice:ListServiceNetworks

  • vpc-lattice:ListServices

  • vpc-lattice:ListTargetGroups

  • wafv2:ListIPSets

  • wafv2:ListRegexPatternSets

  • wafv2:ListRuleGroups

  • wisdom:ListContents

  • workspaces-web:ListPortals

 September 15, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions for Amazon policy best practices

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were removed for resource types that are not currently supported by Resource Explorer. For the latest version of this policy, see AWSResourceExplorerServiceRolePolicy in the Amazon Managed Policy Reference Guide.

The following permissions were removed for unsupported resource types:

  • amplify:ListBackendEnvironments

  • amplifyuibuilder:ListComponents

  • amplifyuibuilder:ListThemes

  • backup:ListFrameworks

  • bedrock:ListBlueprints

  • bedrock:ListCustomModels

  • directconnect:DescribeConnections

  • directconnect:DescribeDirectConnectGateways

  • directconnect:DescribeLags

  • directconnect:DescribeVirtualInterfaces

  • dynamodb:ListStreams

  • ec2:DescribeElasticGpus

  • ec2:DescribeExportImageTasks

  • ec2:DescribeExportTasks

  • ec2:DescribeImportImageTasks

  • ec2:DescribeImportSnapshotTasks

  • ec2:DescribeVpcEndpointServices

  • ecs:ListTasks

  • eks:ListAccessEntries

  • eks:ListAddons

  • eks:ListFargateProfiles

  • eks:ListIdentityProviderConfigs

  • eks:ListNodegroups

  • elasticache:DescribeCacheSecurityGroups

  • fms:ListPolicies

  • fms:ListProtocolsLists

  • fsx:DescribeStorageVirtualMachines

  • fsx:DescribeVolumes

  • iottwinmaker:ListScenes

  • iottwinmaker:ListSyncJobs

  • kinesis:ListStreamConsumers

  • kms:ListAliases

  • lambda:ListAliases

  • lambda:ListLayerVersions

  • lambda:ListLayers

  • lex:ListBots

  • lightsail:GetBuckets

  • lightsail:GetCertificates

  • lightsail:GetContainerServices

  • logs:DescribeLogStreams

  • macie2:ListAllowLists

  • macie2:ListCustomDataIdentifiers

  • macie2:ListFindingsFilters

  • redshift:DescribeScheduledActions

  • resiliencehub:ListApps

  • resource-explorer-2:ListIndexes

  • robomaker:ListRobotApplications

  • robomaker:ListSimulationApplications

  • sagemaker:ListDataQualityJobDefinitions

  • sagemaker:ListModelBiasJobDefinitions

  • sagemaker:ListModelExplainabilityJobDefinitions

  • sagemaker:ListModelQualityJobDefinitions

  • sagemaker:ListMonitoringSchedules

  • scheduler:ListSchedules

  • ssm-incidents:ListResponsePlans

  • ssm:DescribeAutomationExecutions

  • ssm:DescribePatchBaselines

  • ssm:ListInventoryEntries

  • timestream:ListDatabases

  • timestream:ListScheduledQueries

  • xray:GetGroups

 September 5, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • apigateway:restapis/deployments

  • apigateway:restapis/resources/methods

  • apigateway:restapis/resources

  • apigateway:restapis/stages

  • apigateway:apis

  • apigateway:apis/routes

  • apigateway:apis/stages

  • appmesh:mesh/virtualGateway/gatewayRoute

  • appmesh:mesh/virtualRouter/route

  • appmesh:mesh/virtualGateway

  • appmesh:mesh/virtualRouter

  • apprunner:autoscalingconfiguration

  • apprunner:connection

  • autoscaling:autoScalingGroup

  • backup-gateway:hypervisor

  • batch:job-definition

  • bedrock:agent

  • bedrock:application-inference-profile

  • bedrock:data-automation-project

  • bedrock:flow

  • bedrock:guardrail

  • bedrock:knowledge-base

  • bedrock:prompt

  • bedrock:prompt-router

  • chime:app-instance

  • chime:app-instance/bot

  • chime:app-instance/user

  • chime:media-insights-pipeline-configuration

  • chime:media-pipeline

  • chime:media-pipeline-kinesis-video-stream-pool

  • chime:sma

  • chime:vc

  • config:config-rule

  • connect:instance/operating-hours

  • dms:cert

  • eks:eks-anywhere-subscription

  • eks:podidentityassociation

  • emr-containers:jobtemplates

  • emr-containers:virtualclusters/endpoints

  • emr-containers:securityconfigurations

  • events:api-destination

  • gamelift:script

  • guardduty:detector

  • guardduty:malware-protection-plan

  • guardduty:detector/publishingDestination

  • inspector2:filter

  • iot:billinggroup

  • iot:fleetmetric

  • iot:scheduledaudit

  • iot:thinggroup

  • iot:thingtype

  • iotfleethub:application

  • iotsitewise:access-policy

  • iotsitewise:portal

  • iotsitewise:project

  • iotwireless:Destination

  • iotwireless:DeviceProfile

  • iotwireless:FuotaTask

  • iotwireless:MulticastGroup

  • iotwireless:SidewalkAccount

  • iotwireless:WirelessDevice

  • iotwireless:WirelessGateway

  • iotwireless:WirelessGatewayTaskDefinition

  • ivs:playback-key

  • kendra:index/access-control-configuration

  • kendra:index/data-source

  • kendra:index/faq

  • kendra:index/featured-results-set

  • kendra:index/query-suggestions-block-list

  • kendra:index/thesaurus

  • kendra:index/experience

  • kinesisvideo:channel

  • license-manager:grant

  • mediapackage-vod:assets

  • mediastore:container

  • mediatailor:channel

  • mediatailor:liveSource

  • memorydb:snapshot

  • mobiletargeting:templates/SMS

  • mobiletargeting:templates/PUSH

  • mobiletargeting:templates/EMAIL

  • mq:configuration

  • profile:domains

  • proton:environment-template

  • proton:service-template

  • redshift:hsmclientcertificate

  • s3:multiregionaccesspoint

  • sagemaker:action

  • sagemaker:algorithm

  • sagemaker:app

  • sagemaker:artifact

  • sagemaker:code-repository

  • sagemaker:context

  • sagemaker:endpoint-config

  • sagemaker:experiment

  • sagemaker:experiment-trial

  • sagemaker:experiment-trial-component

  • sagemaker:human-task-ui

  • sagemaker:image-version

  • sagemaker:inference-component

  • sagemaker:inference-experiment

  • sagemaker:model-package-group

  • sagemaker:model-package

  • sagemaker:model-card

  • sagemaker:notebook-instance-lifecycle-config

  • sagemaker:project

  • sagemaker:space

  • sagemaker:user-profile

  • sagemaker:workforce

  • sagemaker:cluster

  • sagemaker:flow-definition

  • sagemaker:hub

  • sagemaker:mlflow-tracking-server

  • sagemaker:studio-lifecycle-config

  • sagemaker:workteam

  • ses:dedicated-ip-pool

  • ssm:session

  • synthetics:canary

  • transfer:server

  • transfer:user

 August 4, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to allow Resource Explorer to manage indexes and views

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. The following permissions were added that allow Resource Explorer to create, manage, and delete indexes and views:

  • UpdateIndexType

  • CreateIndex

  • CreateView

  • AssociateDefaultView

  • DeleteIndex

 July 23, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer modified the permissions in the service-linked role policy AWSResourceExplorerServiceRolePolicy. Permissions were added that allows Resource Explorer to view additional resource types:

  • appconfig:applications

  • appconfig:deploymentstrategies

  • ce:getanomalymonitors

  • ce:getanomalysubscriptions

  • cloudformation:resources

  • cloudfront:continuousdeploymentpolicies

  • cloudtrail:channels

  • codedeploy:applications

  • codedeploy:deploymentconfigs

  • events:archives

  • events:endpoints

  • gamelift:locations

  • groundstation:missionprofiles

  • inspector:assessmenttemplates

  • iot:cacertificates

  • iot:certificates

  • iotdeviceadvisor:suitedefinitions

  • iotfleetwise:decodermanifests

  • iotfleetwise:modelmanifests

  • iotfleetwise:signalcatalogs

  • managedblockchain:accessors

  • oam:sink

  • omics:referencestores

  • omics:rungroups

  • omics:workflows

  • personalize:solutions

  • pipes:pipes

  • scheduler:schedulegroups

  • scheduler:schedules

  • schemas:discoverers

  • transfer:certificates

  • transfer:connectors

  • transfer:profiles

 May 7, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows Resource Explorer to view additional resource types:

  • cloud9:environment

  • cloudtrail:eventdatastore

  • connect:instance/rule

  • connect:instance/task-template

  • connect:phone-number

  • datapipeline:pipeline

  • dax:cache

  • devicefarm:project

  • devicefarm:testgrid-project

  • ds:directory

  • ec2:ipam-resource-discovery

  • ec2:ipam-resource-discovery-association

  • elasticloadbalancing:listener-rule/net

  • events:connection

  • forecast:dataset-import-job

  • forecast:forecast

  • forecast:forecast-export-job

  • forecast:predictor

  • forecast:predictor-backtest-export-job

  • geo:map

  • grafana:workspaces

  • groundstation:dataflow-endpoint-group

  • iot:ruledestination

  • iotfleetwise:vehicle

  • ivschat:logging-configuration

  • ivschat:room

  • lookoutmetrics:AnomalyDetector

  • m2:env

  • outposts:site

  • quicksight:theme

  • route53-recovery-control:cluster

  • route53-recovery-control:controlpanel/safetyrule

  • route53-recovery-readiness:readiness-check

  • route53resolver:firewall-rule-group-association

  • rum:appmonitor

  • sagemaker:app-image-config

  • servicediscovery:service

  • synthetics:group

  • transfer:agreement

  • transfer:profile

  • workspaces:connectionalias

 March 21, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows Resource Explorer to view additional resource types:

  • acm:certificate

  • codepipeline:webhook

  • comprehend:document-classifier

  • comprehend:entity-recognizer

  • databrew:job

  • databrew:project

  • dataexchange:data-sets

  • dms:es

  • dms:subgrp

  • elasticmapreduce:cluster

  • emr-containers:virtualclusters

  • frauddetector:external-model

  • frauddetector:model

  • fsx:file-system

  • glacier:vaults

  • glue:crawler

  • greengrass:connectorsDefinition

  • greengrass:coresDefinition

  • greengrass:devicesDefinition

  • greengrass:functionsDefinition

  • greengrass:loggersDefinition

  • greengrass:resourcesDefinition

  • greengrass:subscriptionsDefinition

  • mq:broker

  • route53:domain

  • ses:contact-list

  • ses:configuration-set

  • ses:identity

  • storagegateway:gateway

 January 6, 2025

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows Resource Explorer to view additional resource types:

  • IamAction(value=apigateway:Get)

  • airflow:ListEnvironments

  • appflow:ListFlows

  • appmesh:ListMeshes

  • appmesh:ListVirtualNodes

  • appmesh:ListVirtualServices

  • auditmanager:GetAccountStatus

  • auditmanager:ListAssessments

  • backup:ListBackupVaults

  • codeguru-reviewer:ListRepositoryAssociations

  • connect:ListInstances

  • connect:ListQuickConnects

  • connect:ListUsers

  • databrew:ListSchedules

  • datasync:ListLocations

  • datasync:ListTasks

  • dms:DescribeEndpoints

  • dms:DescribeReplicationInstances

  • dms:DescribeReplicationTasks

  • eks:ListClusters

  • gamelift:DescribeGameSessionQueues

  • gamelift:DescribeMatchmakingConfigurations

  • gamelift:DescribeMatchmakingRuleSets

  • gamelift:ListBuilds

  • glue:ListMLTransforms

  • groundstation:ListConfigs

  • guardduty:ListDetectors

  • guardduty:ListFilters

  • guardduty:ListIPSets

  • guardduty:ListThreatIntelSets

  • iotsitewise:ListDashboards

  • iotsitewise:ListPortals

  • iotsitewise:ListProjects

  • iotwireless:ListServiceProfiles

  • ivs:ListRecordingConfigurations

  • kendra:ListIndices

  • macie2:ListCustomDataIdentifiers

  • macie2:ListFindingsFilters

  • memorydb:DescribeSubnetGroups

  • mobiletargeting:GetCampaigns

  • proton:ListEnvironmentAccountConnections

  • quicksight:DescribeAccountSubscription

  • quicksight:ListDataSets

  • quicksight:ListDataSources

  • quicksight:ListTemplates

  • ram:GetResourceShares

  • robomaker:ListRobotApplications

  • robomaker:ListSimulationApplications

  • route53resolver:ListResolverQueryLogConfigs

  • sagemaker:ListDomains

  • sagemaker:ListEndpoints

  • sagemaker:ListFeatureGroups

  • sagemaker:ListImages

  • sagemaker:ListPipelines

  • transfer:ListWorkflows

  • workspaces:DescribeWorkspaces

 November 21, 2024

AWSResourceExplorerServiceRolePolicy - Updated policy permissions to view additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows Resource Explorer to view additional resource types:

  • apprunner:ListVpcConnectors

  • backup:ListReportPlans

  • emr-serverless:ListApplications

  • events:ListEventBuses

  • geo:ListPlaceIndexes

  • geo:ListTrackers

  • greengrass:ListComponents

  • greengrass:ListComponentVersions

  • iot:ListRoleAliases

  • iottwinmaker:ListComponentTypes

  • iottwinmaker:ListEntities

  • iottwinmaker:ListScenes

  • kafka:ListConfigurations

  • kms:ListKeys

  • kinesisanalytics:ListApplications

  • lex:ListBots

  • lex:ListBotAliases

  • mediapackage-vod:ListPackagingConfigurations

  • mediapackage-vod:ListPackagingGroups

  • mq:ListBrokers

  • personalize:ListDatasetGroups

  • personalize:ListDatasets

  • personalize:ListSchemas

  • route53:ListHealthChecks

  • route53:ListHostedZones

  • secretsmanager:ListSecrets

 December 12, 2023

New managed policy

Resource Explorer added the following Amazon managed policy:

 November 14, 2023

Updated managed policies

Resource Explorer updated the following Amazon managed policies to support multi-account search:

 November 14, 2023

AWSResourceExplorerServiceRolePolicy – Updated policy to support multi-account search with Organizations

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows the Resource Explorer to support multi-account search with Organizations:

  • organizations:ListAWSServiceAccessForOrganization

  • organizations:DescribeAccount

  • organizations:DescribeOrganization

  • organizations:ListAccounts

  • organizations:ListDelegatedAdministrators

 November 14, 2023

AWSResourceExplorerServiceRolePolicy – Updated policy to support additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows the service to index the following resource types:

  • accessanalyzer:analyzer

  • acmpca:certificateauthority

  • amplify:app

  • amplify:backendenvironment

  • amplify:branch

  • amplify:domainassociation

  • amplifyuibuilder:component

  • amplifyuibuilder:theme

  • appintegrations:eventintegration

  • apprunner:service

  • appstream:appblock

  • appstream:application

  • appstream:fleet

  • appstream:imagebuilder

  • appstream:stack

  • appsync:graphqlapi

  • aps:rulegroupsnamespace

  • aps:workspace

  • apigateway:restapi

  • apigateway:deployment

  • athena:datacatalog

  • athena:workgroup

  • autoscaling:autoscalinggroup

  • backup:backupplan

  • batch:computeenvironment

  • batch:jobqueue

  • batch:schedulingpolicy

  • cloudformation:stack

  • cloudformation:stackset

  • cloudfront:fieldlevelencryptionconfig

  • cloudfront:fieldlevelencryptionprofile

  • cloudfront:originaccesscontrol

  • cloudtrail:trail

  • codeartifact:domain

  • codeartifact:repository

  • codecommit:repository

  • codeguruprofiler:profilinggroup

  • codestarconnections:connection

  • databrew:dataset

  • databrew:recipe

  • databrew:ruleset

  • detective:graph

  • directoryservices:directory

  • ec2:carriergateway

  • ec2:verifiedaccessendpoint

  • ec2:verifiedaccessgroup

  • ec2:verifiedaccessinstance

  • ec2:verifiedaccesstrustprovider

  • ecr:repository

  • elasticache:cachesecuritygroup

  • elasticfilesystem:accesspoint

  • events:rule

  • evidently:experiment

  • evidently:feature

  • evidently:launch

  • evidently:project

  • finspace:environment

  • firehose:deliverystream

  • faultinjectionsimulator:experimenttemplate

  • forecast:datasetgroup

  • forecast:dataset

  • frauddetector:detector

  • frauddetector:entitytype

  • frauddetector:eventtype

  • frauddetector:label

  • frauddetector:outcome

  • frauddetector:variable

  • gamelift:alias

  • globalaccelerator:accelerator

  • globalaccelerator:endpointgroup

  • globalaccelerator:listener

  • glue:database

  • glue:job

  • glue:table

  • glue:trigger

  • greengrass:group

  • healthlake:fhirdatastore

  • iam:virtualmfadevice

  • imagebuilder:componentbuildversion

  • imagebuilder:component

  • imagebuilder:containerrecipe

  • imagebuilder:distributionconfiguration

  • imagebuilder:imagebuildversion

  • imagebuilder:imagepipeline

  • imagebuilder:imagerecipe

  • imagebuilder:image

  • imagebuilder:infrastructureconfiguration

  • iot:authorizer

  • iot:jobtemplate

  • iot:mitigationaction

  • iot:provisioningtemplate

  • iot:securityprofile

  • iot:thing

  • iot:topicruledestination

  • iotanalytics:channel

  • iotanalytics:dataset

  • iotanalytics:datastore

  • iotanalytics:pipeline

  • iotevents:alarmmodel

  • iotevents:detectormodel

  • iotevents:input

  • iotsitewise:assetmodel

  • iotsitewise:asset

  • iotsitewise:gateway

  • iottwinmaker:workspace

  • ivs:channel

  • ivs:streamkey

  • kafka:cluster

  • kinesisvideo:stream

  • lambda:alias

  • lambda:layerversion

  • lambda:layer

  • lookoutmetrics:alert

  • lookoutvision:project

  • mediapackage:channel

  • mediapackage:originendpoint

  • mediatailor:playbackconfiguration

  • memorydb:acl

  • memorydb:cluster

  • memorydb:parametergroup

  • memorydb:user

  • mobiletargeting:app

  • mobiletargeting:segment

  • mobiletargeting:template

  • networkfirewall:firewallpolicy

  • networkfirewall:firewall

  • networkmanager:globalnetwork

  • networkmanager:device

  • networkmanager:link

  • networkmanager:attachment

  • networkmanager:corenetwork

  • panorama:package

  • qldb:journalkinesisstreamsforledger

  • qldb:ledger

  • rds:bluegreendeployment

  • refactorspaces:application

  • refactorspaces:environment

  • refactorspaces:route

  • refactorspaces:service

  • rekognition:project

  • resiliencehub:app

  • resiliencehub:resiliencypolicy

  • resourcegroups:group

  • route53:recoverygroup

  • route53:resourceset

  • route53:firewalldomain

  • route53:firewallrulegroup

  • route53:resolverendpoint

  • route53:resolverrule

  • sagemaker:model

  • sagemaker:notebookinstance

  • signer:signingprofile

  • ssmincidents:responseplan

  • ssm:inventoryentry

  • ssm:resourcedatasync

  • states:activity

  • timestream:database

  • wisdom:assistant

  • wisdom:assistantassociation

  • wisdom:knowledgebase

 October 17, 2023

AWSResourceExplorerServiceRolePolicy – Updated policy to support additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows the service to index the following resource types:

  • codebuild:project

  • codepipeline:pipeline

  • cognito:identitypool

  • cognito:userpool

  • ecr:repository

  • efs:filesystem

  • elasticbeanstalk:application

  • elasticbeanstalk:applicationversion

  • elasticbeanstalk:environment

  • iot:policy

  • iot:topicrule

  • stepfunctions:statemachine

  • s3:bucket

 August 1, 2023

AWSResourceExplorerServiceRolePolicy – Updated policy to support additional resource types

Resource Explorer added permissions to the service-linked role policy AWSResourceExplorerServiceRolePolicy that allows the service to index the following resource types:

  • elasticache:cluster

  • elasticache:globalreplicationgroup

  • elasticache:parametergroup

  • elasticache:replicationgroup

  • elasticache:reserved-instance

  • elasticache:snapshot

  • elasticache:subnetgroup

  • elasticache:user

  • elasticache:usergroup

  • lambda:code-signing-config

  • lambda:event-source-mapping

  • sqs:queue

 March 7, 2023
New managed policies

Resource Explorer added the following Amazon managed policies:

 November 7, 2022

Resource Explorer started tracking changes

Resource Explorer started tracking changes for its Amazon managed policies.

 November 7, 2022