I tried to capture all types of AWS managed policies in AWS IAM
This page has been translated by machine translation. View original
Good Evening, it's Chiba (Yuki).
It's summer vacation. Are you catching them??
This article is the 12th entry of the 'Summer Vacation Independent Research Relay' by Classmethod volunteers.
This blog relay project is an initiative by members who regularly follow cloud and AI, aiming to output not just "tried it" but also "built it" and "researched/studied it".
We hope this will not only provide new insights but also contribute ideas to the development of our company and community, so we appreciate your company.
Let's get right into it. This article is about 'Catching All Types of AWS Managed Policies in AWS IAM'.
Prologue
Summer vacation means collecting, doesn't it.
Stag beetles, rhinoceros beetles, cicadas... catching all sorts of things is a familiar activity. You've probably had that experience too.
I thought about returning to my childhood heart and catching some cicadas, but "I tried catching cicadas" is hard to write a blog about. Even if I tried to write it, there's already a pioneer who catches cicada larvae and streams the emergence live[1], so I can't help but feel like I'd just be following in someone's footsteps.
So what to do instead. Something that comes in many varieties and is fun to catch. That's right, AWS Managed Policies. "AWS Managed Policy" is a bit long, so I'll call them ManePori. There are over 1500 types of ManePori, you know.
In that case, "gotta get 'em" sounds better than "catch 'em", so let's go with that.
Alright, ManePori, gotta get 'em all!
Opening
Since we're here, let's get pumped up before we start.
I'll fire myself up with some original lyrics that just popped into my head.
ManePori, gotta get 'em allll!
Cha-ra cha-ra ra-ra~ Cha~ cha-ra-cha!
Even inside EC2, inside S3, inside Lambda, inside RDS
Inside DynamoDB, inside CloudFront, inside that girl's SQS (Queue!)
Still not yet, still not yet
Still not yet, still not yet, it's tough but
I'll definitely get 'em all
ManePori, gotta get 'em yeah Yeah Yeah Yeah
Goodbye Bye-Bye to Tokyo Region
I'm heading out on a journey with this one (EC2!)
Deploying like crazy with hardened code
Adding more instances, on to the next zone
There's no guarantee that things will always go well
The SLA is 99.9% though (that's true)
Always, always monitoring 24/365
CloudWatch is here (Alarm Alarm Alarm!)
Ah, I want to become
the longed-for Administrator, I must become one, I absolutely will!
(※When requesting privilege escalation, please submit an application form in the prescribed format after obtaining approval from your supervisor. Access will be granted within approximately 5 business days.)
Cha-ra cha-ra ra-ra~ Cha~ cha-ra-cha-cha!
Alright, let's do this.
What are AWS Managed Policies in AWS IAM
AWS managed policies are a type of policy in AWS IAM.
Among the various types of policies, they are overwhelmingly most often considered in the context of identity-based policies. Identity-based policies are, simply put, policies that are used by attaching them to IAM identities (users/IAM roles/IAM groups).
What is often considered as the counterpart is resource-based policies, which are associated with resources like S3 buckets and Lambda functions. Please forget about resource-based policies for now.
Identity-based policies can be broadly classified as follows:
- Managed policies: Can be attached to multiple identities, version-controllable
- Customer managed policies: Policies managed by the customer
- AWS managed policies: Policies managed by AWS
- Inline policies: Embedded in a single identity, not an independent resource
From https://speakerdeck.com/yukihirochiba/i-am-iam-lover
AWS managed policies are managed by AWS, as the name suggests. As new services and features are added day by day, new policies are created and versions are updated to keep pace with them.
It is not an exaggeration to say that understanding AWS managed policies means understanding AWS itself. Well, it's a slight exaggeration, but it's very important.
So let's go get those ManePori.
Deprecation of AWS IAM Managed Policies
There was one important note before getting them.
ManePori sometimes disappear.
The concept of deprecated AWS managed policies is as follows:
- If already attached to an IAM identity, it can continue to be used
- Cannot be attached to new IAM identities (
IsAttachableis false) - If not attached to one or more IAM identities, the policy will not appear in the list
In other words, if it's connected to something it'll stay around, but the moment that connection disappears, it runs away.
I haven't been able to track down the details of all previously deprecated AWS managed policies, but my gut feeling is there were around 10 to 20 of them.
Please be aware that the methods and information covered in this blog may diverge in minor ways going forward, and running them in different environments may return different results.
So let's go get those ManePori.
I Tried Catching All AWS Managed Policies in AWS IAM
The working environment for this task is as follows:
- macOS
- Zsh version:
zsh 5.9 (arm64-apple-darwin25.0) - AWS CLI version:
aws-cli/2.36.19 Python/3.14.6 Darwin/25.5.0 exe/arm64
Copy and run the command below as-is, and the ManePori information will be copied to your clipboard.
WORKDIR=$(mktemp -d)
aws iam list-policies --scope AWS --output json \
| jq -r '.Policies[].Arn' > "$WORKDIR/arns.txt"
total=$(wc -l < "$WORKDIR/arns.txt" | tr -d ' ')
echo "Target policy count: $total items"
xargs -P 10 -I {} sh -c '
arn="$1"
file="'"$WORKDIR"'/$(printf "%s" "$arn" | md5 -q).json"
aws iam get-policy --policy-arn "$arn" --output json | jq -c ".Policy" > "$file"
echo done
' _ {} < "$WORKDIR/arns.txt" \
| { c=0; while read -r _; do c=$((c+1)); printf "\rProgress: %d/%d" "$c" "$total"; done; echo; }
jq -s -r '
["Policy Name","Path","Default Version","Created At","Updated At","Attachable","Description"],
(.[] | [.PolicyName, .Path, .DefaultVersionId, .CreateDate, .UpdateDate, .IsAttachable, (.Description // "")])
| @csv
' "$WORKDIR"/*.json | pbcopy
echo "Retrieved: $(ls "$WORKDIR"/*.json | wc -l | tr -d ' ') items copied to clipboard"
rm -rf "$WORKDIR"
The general flow is as follows:
- Create a temporary working folder with
mktemp -d - Retrieve a list of all AWS managed policy ARNs with
list-policiesand save to a text file - Run
get-policyin parallel for each ARN, saving the information in one file per policy - Combine all files into a single CSV with
jq -s - Copy the resulting CSV to the clipboard with
pbcopy - Display the completion count, delete the temporary folder, and exit
The AWS CLI commands being run are as follows:
aws iam list-policies can retrieve all policies at once, but it cannot retrieve the Description information. aws iam get-policy can retrieve Description in addition to the information available from list, but it targets a single policy at a time.
Therefore, we take the approach of retrieving the targets with list, then running get against each of them in sequence.
Here's an image of what it looks like when run:
Target policy count: 1564 items
Progress: 1564/1564
Retrieved: 1564 items copied to clipboard
The progress portion updates in real time. It takes at least a few minutes, so sit back and wait patiently. As of 2026/08/08, there were a total of 1564 ManePori.
After running it, paste the copied CSV wherever you like and it'll look something like this. Then just admire them to your heart's content.
I'm getting so pumped up~~~~!!
When Were AWS Managed Policies Created?
The date and time a ManePori was created can be checked with CreateDate. I've summarized the number of newly created ManePori by year.
AWS managed policies first appeared in February 2015. Since then, we can see that roughly 100-plus new policies are created each year, proportional to the expansion of new AWS services.
Let's break it down further and look at it on a monthly basis.
Setting aside the exception of a large batch being created all at once in February 2015 when AWS managed policies first appeared, the distribution shows around 40 items at most in a given month.
Looking at which time of year ManePori increases the most within a year, it's clearly November. This is when AWS re:Invent is held, so new services and new features are announced all at once, causing a corresponding increase. By keeping a close eye on newly created ManePori, you might be able to tell "wait, is something like this service going to be announced tomorrow...!" Or maybe not, who knows.
The Origin and the Pinnacle, AdministratorAccess
We know that AWS managed policies appeared in February 2015 — so what was the very first ManePori created? The answer is AdministratorAccess.
% aws iam list-policies \
--scope AWS \
--query "sort_by(Policies[? CreateDate <= '2015-02-12' ].{Arn:Arn,CreateDate:CreateDate},&CreateDate)" \
--output table \
--max-items 1000
---------------------------------------------------------------------------------------------------------
| ListPolicies |
+-------------------------------------------------------------------------+-----------------------------+
| Arn | CreateDate |
+-------------------------------------------------------------------------+-----------------------------+
| arn:aws:iam::aws:policy/AdministratorAccess | 2015-02-06T18:39:46+00:00 |
| arn:aws:iam::aws:policy/PowerUserAccess | 2015-02-06T18:39:47+00:00 |
| arn:aws:iam::aws:policy/ReadOnlyAccess | 2015-02-06T18:39:48+00:00 |
| arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess | 2015-02-06T18:39:49+00:00 |
| arn:aws:iam::aws:policy/CloudFrontFullAccess | 2015-02-06T18:39:50+00:00 |
| arn:aws:iam::aws:policy/AWSCloudHSMFullAccess | 2015-02-06T18:39:51+00:00 |
| arn:aws:iam::aws:policy/AWSCloudHSMReadOnlyAccess | 2015-02-06T18:39:52+00:00 |
……
You can see a variety of ManePori being created all at once. Dozens of them were created at roughly one-second intervals.
AdministratorAccess was created first among all of them, and its version has not changed even once since then (it has not been updated).
Its definition is as follows, effectively making it a state where "anything that can be done with IAM can be done," which is why it requires no updates.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
Since such overwhelming power carries risks, this is a ManePori you deal with carefully depending on the situation.
Getting a List of AWS Service Prefixes Using AdministratorAccess
AdministratorAccess can, in a word, do anything. It has operational permissions for every "AWS service." So what specific "AWS services" can AdministratorAccess operate? There is a way to check that.
To get into the details, you would follow keywords like "AWS service prefix" and "AWS service namespace," but if you're interested in the specifics, please refer to this link. It's an article I wrote when I contributed to another media outlet.
Let's use the commands below to get a list of "AWS service names" and "AWS service namespaces."
- generate-service-last-accessed-details — AWS CLI 2.36.19 Command Reference
- get-service-last-accessed-details — AWS CLI 2.36.19 Command Reference
Copy and run the following as-is, and a CSV list will be copied to your clipboard.
POLICY_ARN="arn:aws:iam::aws:policy/AdministratorAccess"
job_id=$(aws iam generate-service-last-accessed-details --arn "$POLICY_ARN" --output text)
echo -n "Waiting for analysis job to complete"
while :; do
job_status=$(aws iam get-service-last-accessed-details --job-id "$job_id" --query 'JobStatus' --output text)
[ "$job_status" = "COMPLETED" ] && echo " Done" && break
[ "$job_status" = "FAILED" ] && echo " Failed" && exit 1
echo -n "."
sleep 1
done
{
echo "No.,ServiceName,ServiceNamespace"
marker=""; total=0
while :; do
extra_args=()
[ -n "$marker" ] && extra_args=(--marker "$marker")
resp=$(aws iam get-service-last-accessed-details --job-id "$job_id" "${extra_args[@]}" --output json)
echo "$resp" | jq -r '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace] | join(",")'
total=$((total + $(echo "$resp" | jq -r '.ServicesLastAccessed | length')))
echo "${total} items retrieved" >&2
[ "$(echo "$resp" | jq -r '.IsTruncated')" = "true" ] || break
marker=$(echo "$resp" | jq -r '.Marker')
done | awk '{print NR","$0}'
} | pbcopy
echo "Retrieval complete. Copied to clipboard"
Here is an example of what the output looks like when run.
Waiting for analysis job to complete... Done
200 items retrieved
400 items retrieved
454 items retrieved
Retrieval complete. Copied to clipboard
Since we have it, let's go ahead and paste the copied content as of 2026/08/08.
Collapse
Sorted alphabetically by AWS service namespace (rightmost column).
No.,ServiceName,ServiceNamespace
1,AWS App2Container,a2c
2,Alexa for Business,a4b
3,AWS IAM Access Analyzer,access-analyzer
4,AWS Account Management,account
5,AWS Certificate Manager,acm
6,AWS Private Certificate Authority,acm-pca
7,AWS Compute Optimizer Automation,aco-automation
8,AWS Action Recommendations,action-recommendations
9,AWS Activate,activate
10,AWS Agent Registry,agent-registry
11,Amazon WorkSpaces AgentAccess MCP Server,agentaccess-mcp
12,AWS DevOps Agent Service,aidevops
13,Amazon AI Operations,aiops
14,Amazon Managed Workflows for Apache Airflow,airflow
15,AWS MWAA Serverless,airflow-serverless
16,AWS Amplify,amplify
17,AWS Amplify Admin,amplifybackend
18,AWS Amplify UI Builder,amplifyuibuilder
19,Amazon OpenSearch Serverless,aoss
20,Manage - Amazon API Gateway,apigateway
21,Amazon AppIntegrations,app-integrations
22,AWS AppConfig,appconfig
23,AWS AppFabric,appfabric
24,Amazon AppFlow,appflow
25,AWS Application Auto Scaling,application-autoscaling
26,Amazon CloudWatch Application Signals,application-signals
27,Amazon CloudWatch Application Signals MCP Server,application-signals-mcp
28,AWS Application Transformation Service,application-transformation
29,Amazon CloudWatch Application Insights,applicationinsights
30,AWS App Mesh,appmesh
31,AWS App Mesh Preview,appmesh-preview
32,AWS App Runner,apprunner
33,Amazon AppStream 2.0,appstream
34,AWS App Studio,appstudio
35,AWS AppSync,appsync
36,AWS Mainframe Modernization Application Testing,apptest
37,Amazon Managed Service for Prometheus,aps
38,Amazon ARC Region switch,arc-region-switch
39,Amazon Application Recovery Controller - Zonal Shift,arc-zonal-shift
40,Application Discovery Arsenal,arsenal
41,AWS Artifact,artifact
42,Amazon Athena,athena
43,AWS Audit Manager,auditmanager
44,Amazon EC2 Auto Scaling,autoscaling
45,AWS Auto Scaling,autoscaling-plans
46,Claude Platform on AWS,aws-external-anthropic
47,AWS Marketplace,aws-marketplace
48,AWS Marketplace Management Portal,aws-marketplace-management
49,AWS Billing Console,aws-portal
50,AWS Connector Service,awsconnector
51,AWS B2B Data Interchange,b2bi
52,AWS Backup,backup
53,AWS Backup Gateway,backup-gateway
54,AWS Backup Search,backup-search
55,AWS Backup storage,backup-storage
56,AWS Batch,batch
57,AWS Billing and Cost Management Dashboards,bcm-dashboards
58,AWS Billing And Cost Management Data Exports,bcm-data-exports
59,AWS Billing And Cost Management Pricing Calculator,bcm-pricing-calculator
60,AWS Billing And Cost Management Recommended Actions,bcm-recommended-actions
61,Amazon Bedrock,bedrock
62,Amazon Bedrock Agentcore,bedrock-agentcore
63,Amazon Bedrock Powered by AWS Mantle,bedrock-mantle
64,Amazon Bedrock Web Search,bedrock-websearch
65,AWS Billing,billing
66,AWS Billing Conductor,billingconductor
67,Amazon Braket,braket
68,AWS Budget Service,budgets
69,AWS BugBust,bugbust
70,Amazon Connect Cases,cases
71,Amazon Keyspaces (for Apache Cassandra),cassandra
72,AWS Cost Explorer Service,ce
73,AWS Chatbot,chatbot
74,Amazon Chime,chime
75,AWS Clean Rooms,cleanrooms
76,AWS Clean Rooms ML,cleanrooms-ml
77,AWS Cloud9,cloud9
78,Amazon Cloud Directory,clouddirectory
79,AWS CloudFormation,cloudformation
80,Amazon CloudFront,cloudfront
81,Amazon CloudFront KeyValueStore,cloudfront-keyvaluestore
82,AWS CloudHSM,cloudhsm
83,Amazon CloudSearch,cloudsearch
84,AWS CloudShell,cloudshell
85,AWS CloudTrail,cloudtrail
86,AWS CloudTrail Data,cloudtrail-data
87,Amazon CloudWatch,cloudwatch
88,AWS CodeArtifact,codeartifact
89,AWS CodeBuild,codebuild
90,Amazon CodeCatalyst,codecatalyst
91,AWS CodeCommit,codecommit
92,AWS CodeConnections,codeconnections
93,AWS CodeDeploy,codedeploy
94,AWS CodeDeploy secure host commands service,codedeploy-commands-secure
95,Amazon CodeGuru,codeguru
96,Amazon CodeGuru Profiler,codeguru-profiler
97,Amazon CodeGuru Reviewer,codeguru-reviewer
98,Amazon CodeGuru Security,codeguru-security
99,AWS CodePipeline,codepipeline
100,AWS CodeStar,codestar
101,AWS CodeStar Connections,codestar-connections
102,AWS CodeStar Notifications,codestar-notifications
103,Amazon CodeWhisperer,codewhisperer
104,Amazon Cognito Identity,cognito-identity
105,Amazon Cognito User Pools,cognito-idp
106,Amazon Cognito Sync,cognito-sync
107,Amazon Comprehend,comprehend
108,Amazon Comprehend Medical,comprehendmedical
109,AWS Compute Optimizer,compute-optimizer
110,AWS Config,config
111,Amazon Connect,connect
112,Amazon Connect Outbound Campaigns,connect-campaigns
113,AWS Console Mobile App,consoleapp
114,AWS Consolidated Billing,consolidatedbilling
115,AWS Control Catalog,controlcatalog
116,AWS Control Tower,controltower
117,AWS Cost Optimization Hub,cost-optimization-hub
118,AWS Cost and Usage Report,cur
119,AWS Customer Verification Service,customer-verification
120,AWS Glue DataBrew,databrew
121,AWS Data Exchange,dataexchange
122,AWS Data Pipeline,datapipeline
123,AWS DataSync,datasync
124,Amazon DataZone,datazone
125,Amazon DynamoDB Accelerator (DAX),dax
126,Database Query Metadata Service,dbqms
127,AWS Deadline Cloud,deadline
128,Amazon Detective,detective
129,AWS Device Farm,devicefarm
130,Amazon DevOps Guru,devops-guru
131,AWS Direct Connect,directconnect
132,AWS Application Discovery Service,discovery
133,Amazon Data Lifecycle Manager,dlm
134,AWS Database Migration Service,dms
135,Amazon DocumentDB Elastic Clusters,docdb-elastic
136,AWS Elastic Disaster Recovery,drs
137,AWS Directory Service,ds
138,AWS Directory Service Data,ds-data
139,Amazon Aurora DSQL,dsql
140,Amazon DynamoDB,dynamodb
141,Amazon Elastic Block Store,ebs
142,Amazon EC2,ec2
143,Amazon EC2 Instance Connect,ec2-instance-connect
144,Amazon Message Delivery Service,ec2messages
145,Amazon Elastic Container Registry,ecr
146,Amazon Elastic Container Registry Public,ecr-public
147,Amazon Elastic Container Service,ecs
148,Amazon ECS MCP Service,ecs-mcp
149,Amazon Elastic Kubernetes Service,eks
150,Amazon EKS Auth,eks-auth
151,Amazon EKS MCP Server,eks-mcp
152,Amazon ElastiCache,elasticache
153,AWS Elastic Beanstalk,elasticbeanstalk
154,Amazon Elastic File System,elasticfilesystem
155,Elastic Load Balancing,elasticloadbalancing
156,Amazon Elastic MapReduce,elasticmapreduce
157,Amazon Elastic Transcoder,elastictranscoder
158,AWS Elemental Appliances and Software Activation Service,elemental-activations
159,AWS Elemental Appliances and Software,elemental-appliances-software
160,AWS Elemental Inference,elemental-inference
161,AWS Elemental Support Cases,elemental-support-cases
162,AWS Elemental Support Content,elemental-support-content
163,Amazon EMR on EKS (EMR Containers),emr-containers
164,Amazon EMR Serverless,emr-serverless
165,AWS Entity Resolution,entityresolution
166,Amazon OpenSearch Service,es
167,Amazon EventBridge,events
168,AWS reInvent event pass amount charge to customer AWS account,eventsbilltoaws
169,Amazon CloudWatch Evidently,evidently
170,Amazon Elastic VMware Service,evs
171,Amazon API Gateway,execute-api
172,AWS FinOps Agent,finops-agent
173,Amazon FinSpace,finspace
174,Amazon FinSpace API,finspace-api
175,Amazon Kinesis Firehose,firehose
176,AWS Fault Injection Service,fis
177,AWS Firewall Manager,fms
178,Amazon Forecast,forecast
179,Amazon Fraud Detector,frauddetector
180,Amazon FreeRTOS,freertos
181,AWS Free Tier,freetier
182,Amazon FSx,fsx
183,Amazon GameLift Servers,gamelift
184,Amazon GameLift Streams,gameliftstreams
185,Amazon Location,geo
186,Amazon Location Service Maps,geo-maps
187,Amazon Location Service Places,geo-places
188,Amazon Location Service Routes,geo-routes
189,Amazon S3 Glacier,glacier
190,AWS Global Accelerator,globalaccelerator
191,AWS Glue,glue
192,Amazon Managed Grafana,grafana
193,AWS IoT Greengrass,greengrass
194,AWS Ground Station,groundstation
195,Amazon GroundTruth Labeling,groundtruthlabeling
196,Amazon GuardDuty,guardduty
197,AWS Health APIs and Notifications,health
198,Amazon Connect Health,health-agent
199,AWS HealthLake,healthlake
200,Amazon Honeycode,honeycode
201,AWS Identity and Access Management,iam
202,AWS Identity Sync,identity-sync
203,AWS Identity Store,identitystore
204,AWS Identity Store Auth,identitystore-auth
205,Amazon EC2 Image Builder,imagebuilder
206,AWS Import Export,importexport
207,Amazon Inspector,inspector
208,Amazon InspectorScan,inspector-scan
209,Amazon Inspector2,inspector2
210,Amazon Inspector2 Telemetry Channel,inspector2-telemetry
211,AWS Interconnect,interconnect
212,Amazon CloudWatch Internet Monitor,internetmonitor
213,AWS Invoicing Service,invoicing
214,AWS IoT,iot
215,AWS IoT Device Tester,iot-device-tester
216,AWS IoT Analytics,iotanalytics
217,AWS IoT Core Device Advisor,iotdeviceadvisor
218,AWS IoT Events,iotevents
219,AWS IoT Fleet Hub for Device Management,iotfleethub
220,AWS IoT FleetWise,iotfleetwise
221,AWS IoT Jobs DataPlane,iotjobsdata
222,AWS IoT Managed Integrations,iotmanagedintegrations
223,AWS IoT SiteWise,iotsitewise
224,AWS IoT TwinMaker,iottwinmaker
225,AWS IoT Wireless,iotwireless
226,AWS IQ,iq
227,AWS IQ Permissions,iq-permission
228,Amazon Interactive Video Service,ivs
229,Amazon Interactive Video Service Chat,ivschat
230,Amazon Managed Streaming for Apache Kafka,kafka
231,Apache Kafka APIs for Amazon MSK clusters,kafka-cluster
232,Amazon Managed Streaming for Kafka Connect,kafkaconnect
233,Amazon Kendra,kendra
234,Amazon Kendra Intelligent Ranking,kendra-ranking
235,Amazon Kinesis Data Streams,kinesis
236,Amazon Kinesis Analytics,kinesisanalytics
237,Amazon Kinesis Video Streams,kinesisvideo
238,AWS Key Management Service,kms
239,AWS Lake Formation,lakeformation
240,AWS Lambda,lambda
241,AWS Launch Wizard,launchwizard
242,Amazon Lex,lex
243,AWS License Manager,license-manager
244,AWS License Manager Linux Subscriptions Manager,license-manager-linux-subscriptions
245,AWS License Manager User Subscriptions,license-manager-user-subscriptions
246,Amazon Lightsail,lightsail
247,Amazon CloudWatch Logs,logs
248,Amazon Lookout for Equipment,lookoutequipment
249,Amazon Lookout for Metrics,lookoutmetrics
250,Amazon Lookout for Vision,lookoutvision
251,AWS Mainframe Modernization Service,m2
252,Amazon Machine Learning,machinelearning
253,Amazon Macie,macie2
254,Amazon Managed Blockchain,managedblockchain
255,Amazon Managed Blockchain Query,managedblockchain-query
256,AWS Migration Acceleration Program Credits,mapcredits
257,AWS Marketplace Commerce Analytics Service,marketplacecommerceanalytics
258,Amazon Mechanical Turk,mechanicalturk
259,AWS Elemental MediaConnect,mediaconnect
260,AWS Elemental MediaConvert,mediaconvert
261,AmazonMediaImport,mediaimport
262,AWS Elemental MediaLive,medialive
263,AWS Elemental MediaPackage,mediapackage
264,AWS Elemental MediaPackage VOD,mediapackage-vod
265,AWS Elemental MediaPackage V2,mediapackagev2
266,AWS Elemental MediaStore,mediastore
267,AWS Elemental MediaTailor,mediatailor
268,AWS HealthImaging,medical-imaging
269,Amazon MemoryDB,memorydb
270,AWS Migration Hub,mgh
271,AWS Application Migration Service,mgn
272,AWS Migration Hub Orchestrator,migrationhub-orchestrator
273,AWS Migration Hub Strategy Recommendations,migrationhub-strategy
274,Amazon Mobile Analytics,mobileanalytics
275,Amazon Pinpoint,mobiletargeting
276,Amazon Monitron,monitron
277,Multi-party approval,mpa
278,Amazon MQ,mq
279,Amazon Neptune,neptune-db
280,Amazon Neptune Analytics,neptune-graph
281,AWS Network Firewall,network-firewall
282,AWS Shield network security director,network-security-director
283,Network Flow Monitor,networkflowmonitor
284,AWS Network Manager,networkmanager
285,AWS Network Manager Chat,networkmanager-chat
286,Amazon CloudWatch Network Synthetic Monitor,networkmonitor
287,Amazon Nimble Studio,nimble
288,AWS User Notifications,notifications
289,AWS User Notifications Contacts,notifications-contacts
290,Amazon Nova Act,nova-act
291,Amazon CloudWatch Observability Access Manager,oam
292,Amazon CloudWatch Observability Admin Service,observabilityadmin
293,AWS Service - Oracle Database@AWS,odb
294,AWS HealthOmics,omics
295,Amazon One Enterprise,one
296,Amazon OpenSearch,opensearch
297,AWS OpsWorks,opsworks
298,AWS OpsWorks Configuration Management,opsworks-cm
299,AWS Organizations,organizations
300,Amazon OpenSearch Ingestion,osis
301,AWS Outposts,outposts
302,AWS Panorama,panorama
303,AWS Partner Central,partnercentral
304,AWS Partner central account management,partnercentral-account-management
305,AWS Payment Cryptography,payment-cryptography
306,AWS Payments,payments
307,AWS Private CA Connector for Active Directory,pca-connector-ad
308,AWS Private CA Connector for SCEP,pca-connector-scep
309,AWS Parallel Computing Service,pcs
310,Amazon Personalize,personalize
311,AWS Performance Insights,pi
312,Amazon EventBridge Pipes,pipes
313,Amazon Polly,polly
314,AWS Price List,pricing
315,AWS PricingPlanManager Service,pricingplanmanager
316,AWS service providing managed private networks,private-networks
317,Amazon Connect Customer Profiles,profile
318,AWS Proton,proton
319,AWS Purchase Orders Console,purchase-orders
320,Amazon Q,q
321,Amazon Q Business Q Apps,qapps
322,Amazon Q Business,qbusiness
323,Amazon Q Developer,qdeveloper
324,Amazon QLDB,qldb
325,Amazon QuickSight,quicksight
326,AWS Resource Access Manager (RAM),ram
327,AWS Recycle Bin,rbin
328,Amazon RDS,rds
329,Amazon RDS Data API,rds-data
330,Amazon RDS IAM Authentication,rds-db
331,Amazon Redshift,redshift
332,Amazon Redshift Data API,redshift-data
333,Amazon Redshift Serverless,redshift-serverless
334,AWS Migration Hub Refactor Spaces,refactor-spaces
335,Amazon Rekognition,rekognition
336,AWS rePost Private,repostspace
337,Amazon Bio Discovery,researchstudio
338,AWS Resilience Hub,resiliencehub
339,Tag Editor,resource-explorer
340,AWS Resource Explorer,resource-explorer-2
341,AWS Resource Groups,resource-groups
342,Amazon RHEL Knowledgebase Portal,rhelkb
343,AWS RoboMaker,robomaker
344,AWS Identity and Access Management Roles Anywhere,rolesanywhere
345,Amazon Route 53,route53
346,Amazon Route 53 Recovery Cluster,route53-recovery-cluster
347,Amazon Route 53 Recovery Controls,route53-recovery-control-config
348,Amazon Route 53 Recovery Readiness,route53-recovery-readiness
349,Amazon Route 53 Domains,route53domains
350,AWS Route53 Global Resolver,route53globalresolver
351,Amazon Route 53 Profiles,route53profiles
352,Amazon Route 53 Resolver,route53resolver
353,AWS RTB Fabric,rtbfabric
354,AWS CloudWatch RUM,rum
355,Amazon S3,s3
356,Amazon S3 Object Lambda,s3-object-lambda
357,Amazon S3 on Outposts,s3-outposts
358,Amazon S3 Express,s3express
359,Amazon S3 Files,s3files
360,Amazon S3 Tables,s3tables
361,Amazon S3 Vectors,s3vectors
362,Amazon SageMaker,sagemaker
363,Amazon SageMaker data science assistant,sagemaker-data-science-assistant
364,Amazon SageMaker geospatial capabilities,sagemaker-geospatial
365,Amazon SageMaker with MLflow,sagemaker-mlflow
366,Amazon SageMaker Unified Studio MCP,sagemaker-unified-studio-mcp
367,AWS Savings Plans,savingsplans
368,Amazon EventBridge Scheduler,scheduler
369,Amazon EventBridge Schemas,schemas
370,AWS Supply Chain,scn
371,Amazon SimpleDB,sdb
372,AWS Secrets Manager,secretsmanager
373,AWS Security Incident Response,security-ir
374,AWS Security Agent,securityagent
375,AWS Security Hub,securityhub
376,Amazon Security Lake,securitylake
377,AWS Serverless Application Repository,serverlessrepo
378,AWS Service Catalog,servicecatalog
379,AWS Cloud Map,servicediscovery
380,AWS Microservice Extractor for .NET,serviceextract
381,Service Quotas,servicequotas
382,Amazon SES,ses
383,AWS Shield,shield
384,AWS Signer,signer
385,AWS Signin,signin
386,AWS SimSpace Weaver,simspaceweaver
387,AWS Server Migration Service,sms
388,Amazon Pinpoint SMS and Voice Service,sms-voice
389,AWS Snow Device Management,snow-device-management
390,AWS Snowball,snowball
391,Amazon SNS,sns
392,AWS End User Messaging Social,social-messaging
393,AWS SQL Workbench,sqlworkbench
394,Amazon SQS,sqs
395,AWS Systems Manager,ssm
396,AWS Systems Manager Incident Manager Contacts,ssm-contacts
397,AWS Systems Manager GUI Connect,ssm-guiconnect
398,AWS Systems Manager Incident Manager,ssm-incidents
399,AWS Systems Manager Quick Setup,ssm-quicksetup
400,AWS Systems Manager for SAP,ssm-sap
401,Amazon Message Gateway Service,ssmmessages
402,AWS IAM Identity Center,sso
403,AWS IAM Identity Center directory,sso-directory
404,AWS IAM Identity Center OIDC service,sso-oauth
405,AWS Step Functions,states
406,AWS Storage Gateway,storagegateway
407,AWS Security Token Service,sts
408,AWS Support,support
409,AWS Support Console,support-console
410,AWS Support App in Slack,supportapp
411,AWS Support Authorization,supportauthz
412,AWS Support Plans,supportplans
413,AWS Sustainability,sustainability
414,Amazon Simple Workflow Service,swf
415,Amazon CloudWatch Synthetics,synthetics
416,Amazon Resource Group Tagging API,tag
417,AWS Tax Settings,tax
418,Amazon Textract,textract
419,Amazon WorkSpaces Thin Client,thinclient
420,Amazon Timestream,timestream
421,Amazon Timestream InfluxDB,timestream-influxdb
422,AWS Tiros,tiros
423,AWS Telco Network Builder,tnb
424,Amazon Transcribe,transcribe
425,AWS Transfer Family,transfer
426,AWS Transform,transform
427,AWS Transform custom,transform-custom
428,Amazon Translate,translate
429,AWS Trusted Advisor,trustedadvisor
430,AWS Diagnostic tools,ts
431,AWS User Subscriptions,user-subscriptions
432,AWS User Experience Customization,uxc
433,AWS Marketplace Vendor Insights,vendor-insights
434,AWS Verified Access,verified-access
435,Amazon Verified Permissions,verifiedpermissions
436,Amazon Connect Voice ID,voiceid
437,Amazon VPC Lattice,vpc-lattice
438,Amazon VPC Lattice Services,vpc-lattice-svcs
439,AWS PrivateLink,vpce
440,AWS WAF,waf
441,AWS WAF Regional,waf-regional
442,AWS WAF V2,wafv2
443,Amazon WorkSpaces Application Manager,wam
444,AWS Well-Architected Tool,wellarchitected
445,AWS Wickr,wickr
446,Amazon Q in Connect,wisdom
447,Amazon WorkDocs,workdocs
448,Amazon WorkLink,worklink
449,Amazon WorkMail,workmail
450,Amazon WorkMail Message Flow,workmailmessageflow
451,Amazon WorkSpaces,workspaces
452,AWS WorkSpaces Managed Instances,workspaces-instances
453,Amazon WorkSpaces Secure Browser,workspaces-web
454,AWS X-Ray,xray
Try to find your favorite "AWS service." I think most of you have probably never seen some of these.
422,AWS Tiros,tiros
423,AWS Telco Network Builder,tnb
What are the paths in AWS managed policies, and how many are there?
Managed policies have paths. When creating customer managed policies, many people probably don't consciously set a path and just leave it as the default /.
The paths in AWS managed policies were as follows.
| Path | Count | Notes |
|---|---|---|
| / | 968 | Default |
| /aws-service-role/ | 355 | For AWS Service-Linked Roles (SLR) |
| /service-role/ | 225 | For AWS service roles |
| /job-function/ | 11 | For AWS managed policies for job functions |
| /root-task/ | 5 | For executing privileged tasks in Organizations member accounts |
The default is overwhelmingly the most common.
Both AWS Service-Linked Roles (SLR) and AWS service roles are roles used by AWS services, but SLRs are more specialized. There is never more than one SLR per AWS service, and the SLR is managed by the AWS service itself. Customers cannot edit them.
AWS managed policies for job functions are pre-defined with the permissions likely needed for each job function. AdministratorAccess is one of them. Depending on when they were introduced, you may encounter some historical cases where a policy is a job function AWS managed policy but its path is not /job-function/.
/root-task/ was unfamiliar to me, but it enables privileged tasks on member accounts in an AWS Organizations environment. Some tasks that previously required the root user can now be performed by temporarily granting privileges.
The following managed policies were all created together on November 6, 2024 (UTC).
- SQSUnlockQueuePolicy
- S3UnlockBucketPolicy
- IAMAuditRootUserCredentials
- IAMCreateRootUserPassword
- IAMDeleteRootUserCredentials
What is the longest AWS managed policy name, and what is the shortest?
What is the managed policy with the longest policy name, or conversely the shortest? Here are the TOP 5 for each.
Longest Policy Name TOP 5
| Policy Name | Characters | Path | Version | Creation Date |
|---|---|---|---|---|
| AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy | 75 | /service-role/ | v1 | 2023-08-01T15:06:46+00:00 |
| AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity | 72 | /service-role/ | v4 | 2024-01-19T20:08:36+00:00 |
| AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy | 72 | / | v1 | 2024-11-16T00:25:12+00:00 |
| AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy | 71 | /service-role/ | v1 | 2023-08-01T15:06:24+00:00 |
| AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy | 70 | / | v1 | 2024-11-16T00:11:14+00:00 |
Shortest Policy Name TOP 5
| Policy Name | Characters | Path | Version | Creation Date |
|---|---|---|---|---|
| Billing | 7 | /job-function/ | 30 | 2016-11-10T17:33:18+00:00 |
| AWSDenyAll | 10 | / | 2 | 2019-05-01T22:36:14+00:00 |
| SupportUser | 11 | /job-function/ | 11 | 2016-11-10T17:21:53+00:00 |
| AWSConnector | 12 | / | 3 | 2015-02-11T17:14:31+00:00 |
| LexBotPolicy | 12 | /aws-service-role/ | 2 | 2017-02-17T22:18:13+00:00 |
It does seem like there is a trend toward longer names over time. The average came out to just over 30 characters.
| Item | Value |
|---|---|
| Mean | 33.20 |
| Median | 32 |
| Min | 7 |
| Max | 75 |
| Mode | 33 |
By the way, the upper limit appears to be 125 characters.
What about descriptions?
Let's do the same for descriptions.
Longest Description TOP 5
| Policy Name | Path | Version | Creation Date | Description Characters |
|---|---|---|---|---|
| AWSElasticDisasterRecoveryReplicationServerPolicy | /service-role/ | 3 | 2021-11-17T13:34:00+00:00 | 738 |
| AWSRefactoringToolkitFullAccess | / | 8 | 2022-10-25T16:41:15+00:00 | 726 |
| AmazonCognitoUnAuthedIdentitiesSessionPolicy | / | 4 | 2023-07-19T23:04:05+00:00 | 723 |
| AmazonEBSCSIDriverEKSClusterScopedPolicy | / | 2 | 2026-04-16T17:27:16+00:00 | 679 |
Shortest Description TOP 5
| Policy Name | Version | Creation Date | Description Characters |
|---|---|---|---|
| AWSDenyAll | 2 | 2019-05-01T22:36:14+00:00 | 16 |
| AWSRoboMakerServiceRolePolicy | 1 | 2018-11-26T05:33:19+00:00 | 24 |
| AWSRoboMakerServicePolicy | 6 | 2018-11-26T06:30:08+00:00 | 24 |
| AWSIQFullAccess | 2 | 2019-04-04T23:13:42+00:00 | 30 |
| LexBotPolicy | 2 | 2017-02-17T22:18:13+00:00 | 31 |
It also seems like descriptions tend to get longer over time.
The longest at 738 characters looks something like this.
This policy is attached to the Elastic Disaster Recovery Replication server's instance role. This policy allows the Elastic Disaster Recovery (DRS) Replication Servers, which are EC2 instances launched by Elastic Disaster Recovery - to communicate with the DRS service, and to create EBS snapshots in your AWS account. An IAM role with this policy is attached (as an EC2 Instance Profile) by Elastic Disaster Recovery to the DRS Replication Servers which are automatically launched and terminated by DRS, as needed. DRS Replication Servers are used to facilitate data replication from your external servers to AWS, as part of the recovery process managed by DRS. We do not recommend that you attach this policy to your IAM users or roles.
The shortest at 16 characters looks like this. Beautiful.
Deny all access.
The average is around 120 characters. It's a tough call whether long and detailed is better, or short and readable.
| Item | Value |
|---|---|
| Mean | 117.57 |
| Median | 89 |
| Min | 16 |
| Max | 738 |
| Mode | 72 |
The upper limit for descriptions appears to be 1000 characters.
While we're at it, let's also look at the most frequently updated AWS managed policy
Let's also look at version counts. To be precise, this refers to the "default version."
Most Versions TOP 5
| Policy Name | Version | Path | Creation Date |
|---|---|---|---|
| ReadOnlyAccess | v188 | / | 2015-02-06T18:39:48+00:00 |
| AWSConfigServiceRolePolicy | v94 | /aws-service-role/ | 2018-05-30T23:31:46+00:00 |
| SecurityAudit | v91 | / | 2015-02-06T18:41:01+00:00 |
| SageMakerStudioProjectProvisioningRolePolicy | v81 | /service-role/ | 2024-11-20T21:58:39+00:00 |
| SageMakerStudioProjectUserRolePolicy | v73 | / | 2024-11-20T21:59:23+00:00 |
ReadOnlyAccess, which we always rely on, is overwhelmingly ahead. It's surprising that SageMaker-related policies have such a high update frequency.
Policies that are only at v1—meaning they have never been updated—number 623, which is overwhelmingly the most common. It seems that updates tend to stay mostly in the single digits.
Some noteworthy AWS managed policies
After collecting so many managed policies, here are a few rare ones that caught my attention. If you already knew all of them, you can call yourself a managed policy expert.
AWSCompromisedKeyQuarantineV3
This is an emergency quarantine policy that AWS applies when an IAM user's credentials have been leaked or exposed. It limits the impact on existing resources while suppressing unauthorized charges and damage. Do not delete it without instructions from AWS Support.
- Version:
3 - Path:
/ - Creation Date: August 21, 2024 17:36:49 UTC
- Last Updated: March 16, 2026 16:27:14 UTC
- Policy Details: AWS Managed Policy Reference
AWSBugBustPlayerAccess
This is a policy for players participating in AWS BugBust events. It provides the access needed for participants to perform bug fixing and code quality improvement activities within the event.
- Version:
1 - Path:
/ - Creation Date: June 24, 2021 07:15:00 UTC
- Policy Details: AWS Managed Policy Reference
ReInventTicketApprovalAccess
This is a policy for reviewing and approving charges when billing AWS re:Invent attendance pass fees to an AWS account. That's kind of interesting.
- Version:
1 - Path:
/ - Creation Date: June 10, 2026 18:57:15 UTC
- Reference: Bill to AWS for re:Invent
- Policy Details: AWS Managed Policy Reference
Ending
The word "one hundred and fifty-one" suddenly came to mind. As image colors, red and green come to mind first, followed by blue and yellow.
Various other numbers came to mind as well, so I put them together with the number of managed policies in a chart.
As for the number of managed policies, more is definitely, absolutely, solidly better. Its continued growth is something to keep an eye on.
Closing
So there you have it — I caught a whole lot of managed policies. There are too many to keep, so I released them all for now.
I hope to encounter them again somewhere.
That wraps up the 12th entry in the "Summer Break Independent Research Relay," titled "I Caught Every Single Type of AWS IAM AWS Managed Policy."
Next time, Yoshida Tatsuya is planning "Turning a Gaming PC into a Server — On-Premises Server Exposure I've Been Putting Off Forever." Stay tuned!!
This was brought to you by Chiba Yuki (@batchicchi).
References
- 7 年間溜めた AWS IAM AWS 管理ポリシーへの愛を語りました #devio2022 | DevelopersIO
- AWS 管理ポリシーの一覧や各種情報を AWS CLI で一括取得してニッコリする | DevelopersIO
- デビュー当時から変わらない AWS 管理ポリシーの初期メンバーを確認してみた | DevelopersIO
