I tried to capture all types of AWS managed policies in AWS IAM
This page has been translated by machine translation. View original
Good Evening, I'm Chiba (Yuki).
It's summer vacation. Are you catching them??
This article is the 12th entry in the "Summer Vacation Independent Research Relay" by Classmethod volunteers.
This blog relay project is organized by members who constantly follow cloud and AI, with the goal of outputting not just "tried it" but also "built it" and "investigated/researched it."
We hope this will not only provide new knowledge but also contribute ideas to the development of our company and community, so we appreciate your company.
Now, let's get right into it. This article is about Catching All Types of AWS Managed Policies in AWS IAM.
Prologue
Summer vacation means collecting, doesn't it.
Stag beetles, rhinoceros beetles, cicadas... catching all kinds of things is a familiar pastime. I'm sure many of you have had such experiences.
I thought about going back to my childhood spirit and catching some cicadas, but "I tried catching cicadas" is hard to write a blog post about. Even if I tried writing it, there are predecessors who capture cicada larvae and stream the emergence process[1], so it would inevitably feel like a rehash.
So what should I do instead? Something that comes in many types and is fun to catch. That's right — AWS Managed Policies. "AWS Managed Policy" is a bit long, so I'll call them ManePoli. There are over 1500 types of ManePoli, you know.
With that in mind, "get" has a better ring to it than "catch," so let's go with that.
Alright — ManePoli, gotta get 'em all!
Opening
Since we're at it, let's pump ourselves up before we start.
I'll motivate myself with some original text that just popped into my head.
ManePoli, gotta get 'em allll!
ﾁｬｰﾗﾁｬﾗﾗﾗｰ ﾁｬｰﾁｬﾗｯﾁｬ!
Even inside EC2, inside S3, inside Lambda, inside RDS,
inside DynamoDB, inside CloudFront, inside that girl's SQS (queue!)
Still not easy, still not easy,
Still not easy, still not easy, it's tough but
I will definitely get them all
ManePoli, gotta get 'em all yeah Yeah Yeah Yeah
Saying goodbye Bye-Bye to the Tokyo Region
I'm heading out on a journey with these (one two!)
Deploying like crazy with trained code
Scaling up instances, on to the next zone
Don't think that things will always go smoothly
The SLA is 99.9% after all (that's true)
Always, always monitoring 24/365
CloudWatch is watching (Alarm Alarm Alarm!)
Ah, I want to become
The longed-for Administrator — I must — I absolutely will!!!
(※ When requesting privilege escalation, please obtain approval from your supervisor and submit the prescribed application form. Access will be granted within approximately 5 business days.)
ﾁｬｰﾗﾁｬﾗﾗﾗｰ ﾁｬｰﾁｬﾗｯﾁｬﾁｬ!
Alright, let's do this.
What are AWS Managed Policies in AWS IAM
AWS managed policies are one type of policy in AWS IAM.
Among the various types of policies, it is overwhelmingly common to think of them in the context of identity-based policies. Identity-based policies are, simply put, policies that are attached to IAM identities (IAM users / IAM roles / IAM groups) for use.
The commonly paired counterpart is the resource-based policy, which is associated with resources such as S3 buckets and Lambda functions. Please forget about resource-based policies for now.
Identity-based policies can be broadly classified as follows:
- Managed policies: Can be attached to multiple identities and support version control
- Customer managed policies: Policies managed by the customer
- AWS managed policies: Policies managed by AWS
- Inline policies: Embedded in a single identity and not independent resources
https://speakerdeck.com/yukihirochiba/i-am-iam-lover より
AWS managed policies are managed by AWS, as the name implies. As new services and features are added to AWS as a whole on a daily basis, new policies are created and versions are updated to keep pace with these changes.
In other words, it is no exaggeration to say that understanding AWS managed policies means understanding AWS itself. Well, that's a slight exaggeration, but it is very important.
So let's go get some ManePoli.
Deprecation of AWS IAM Managed Policies
There was one thing to be aware of before getting them.
ManePoli sometimes disappear. (They become deprecated.)
The concept of a deprecated AWS managed policy is as follows:
- If already attached to an IAM identity, it can continue to be used
- Cannot be attached to new IAM identities (
IsAttachableis false) - If not attached to at least one IAM identity, the policy will not appear in the list
Basically, if something is connected to it, it stays around, but the moment that connection is gone, it disappears. I haven't been able to track the details of all previously deprecated AWS managed policies, but my gut feeling is that there have been around 10 to 20.
Please be aware that the methods and information covered in this blog may drift in minor details going forward, and that different results may be returned depending on the environment in which you run it.
So let's go get some ManePoli.
Catching All AWS IAM Managed Policies
The working environment for this task is as follows:
- macOS
- Zsh version:
zsh 5.9 (arm64-apple-darwin25.0) - AWS CLI version:
aws-cli/2.36.19 Python/3.14.6 Darwin/25.5.0 exe/arm64
Copy and run the following command as-is, and the ManePoli information will be copied to your clipboard.
WORKDIR=$(mktemp -d)
aws iam list-policies --scope AWS --output json \
| jq -r '.Policies[].Arn' > "$WORKDIR/arns.txt"
total=$(wc -l < "$WORKDIR/arns.txt" | tr -d ' ')
echo "Target policy count: $total items"
xargs -P 10 -I {} sh -c '
arn="$1"
file="'"$WORKDIR"'/$(printf "%s" "$arn" | md5 -q).json"
aws iam get-policy --policy-arn "$arn" --output json | jq -c ".Policy" > "$file"
echo done
' _ {} < "$WORKDIR/arns.txt" \
| { c=0; while read -r _; do c=$((c+1)); printf "\rProgress: %d/%d" "$c" "$total"; done; echo; }
jq -s -r '
["Policy Name","Path","Default Version","Created At","Updated At","Is Attachable","Description"],
(.[] | [.PolicyName, .Path, .DefaultVersionId, .CreateDate, .UpdateDate, .IsAttachable, (.Description // "")])
| @csv
' "$WORKDIR"/*.json | pbcopy
echo "Retrieved: $(ls "$WORKDIR"/*.json | wc -l | tr -d ' ') items copied to clipboard"
rm -rf "$WORKDIR"
The general flow is as follows:
- Create a temporary working folder with
mktemp -d - Use
list-policiesto retrieve a list of all AWS managed policy ARNs and save them to a text file - Run
get-policyin parallel for each ARN, saving information for each policy to a separate file - Use
jq -sto combine all files into a single CSV - Copy the resulting CSV to the clipboard with
pbcopy - Display the completion count, delete the temporary folder, and exit
The AWS CLI commands being executed are as follows:
aws iam list-policies can retrieve all policies at once, but it cannot retrieve the Description information. aws iam get-policy can retrieve Description in addition to the information available from list, but it targets a single policy.
Therefore, we take the approach of using list to retrieve the targets, then running get against each of them in sequence.
Here is an image of what it looks like when run:
Target policy count: 1564 items
Progress: 1564/1564
Retrieved: 1564 items copied to clipboard
The progress section updates in real time. It takes at least a few minutes, so be patient. As of 2026/08/08, there were a total of 1564 ManePoli.
After running it, paste the copied CSV wherever you like and it will look something like this. From there, enjoy them however you wish.
Getting pumped up~~~~!!
When Were AWS Managed Policies Created
The date and time a ManePoli was created can be confirmed with CreateDate. I summarized the number of newly created ManePoli by year.
AWS managed policies first appeared in February 2015. Since then, proportional to the expansion of new AWS services, we can see that roughly 100 to several hundred new ones are created each year.
Let's break it down to the monthly level while we're at it.
2026 hasn't reached November yet, but November's total count is already head and shoulders above the rest
Setting aside the exception of a large batch created all at once in February 2015 when AWS managed policies first appeared, the distribution shows around 40 at most in any given month.
It can be read clearly that November is the time of year when ManePoli increases the most. This is when AWS re:Invent takes place, so new services and features are announced all at once, leading to a corresponding increase.
By regularly checking newly created ManePoli, you might be able to figure out "Wait, is something like this service going to be announced tomorrow...?!" Maybe. Who knows.
The Origin and the Pinnacle, AdministratorAccess
We know AWS managed policies appeared in February 2015 — but what was the very first ManePoli created? The answer is AdministratorAccess.
% aws iam list-policies \
--scope AWS \
--query "sort_by(Policies[? CreateDate <= '2015-02-12' ].{Arn:Arn,CreateDate:CreateDate},&CreateDate)" \
--output table
---------------------------------------------------------------------------------------------------------
| ListPolicies |
+-------------------------------------------------------------------------+-----------------------------+
| Arn | CreateDate |
+-------------------------------------------------------------------------+-----------------------------+
| arn:aws:iam::aws:policy/AdministratorAccess | 2015-02-06T18:39:46+00:00 |
| arn:aws:iam::aws:policy/PowerUserAccess | 2015-02-06T18:39:47+00:00 |
| arn:aws:iam::aws:policy/ReadOnlyAccess | 2015-02-06T18:39:48+00:00 |
| arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess | 2015-02-06T18:39:49+00:00 |
| arn:aws:iam::aws:policy/CloudFrontFullAccess | 2015-02-06T18:39:50+00:00 |
| arn:aws:iam::aws:policy/AWSCloudHSMFullAccess | 2015-02-06T18:39:51+00:00 |
| arn:aws:iam::aws:policy/AWSCloudHSMReadOnlyAccess | 2015-02-06T18:39:52+00:00 |
……
We can see that many different ManePoli were created all at once. Dozens were created at roughly one-second intervals.
Among them, AdministratorAccess was created first, and its version has not changed even once (it has not been updated) to this day.
Its definition is as follows — it is essentially a state where "anything that can be done with IAM can be done" — which is why it requires no updates.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
Such powerful permissions come with risks, so this is a ManePoli you deal with carefully, depending on the situation.
Obtaining a List of AWS Service Prefixes Using AdministratorAccess
AdministratorAccess can, so to speak, do anything.
It has operational permissions for every "AWS service." So what specific "AWS services" can AdministratorAccess operate? There is a way to check that.
In more detail, you would follow keywords like "AWS service prefix" and "AWS service namespace," but if you're interested in the details, please refer to this link. It's an article I wrote when I contributed to another media outlet.
Using the commands below, let's retrieve a list of "AWS service names" and "AWS service namespaces." Simply put, these are commands that allow you to investigate "which services a specified IAM resource can access" and "when it last accessed them," and by specifying AdministratorAccess, you can find out the list of currently active AWS services.
- generate-service-last-accessed-details — AWS CLI 2.36.19 Command Reference
- get-service-last-accessed-details — AWS CLI 2.36.19 Command Reference
By copying and running the following as-is, the list CSV will be copied to your clipboard.
POLICY_ARN="arn:aws:iam::aws:policy/AdministratorAccess"
job_id=$(aws iam generate-service-last-accessed-details --arn "$POLICY_ARN" --output text)
echo -n "Waiting for analysis job to complete"
while :; do
job_status=$(aws iam get-service-last-accessed-details --job-id "$job_id" --query 'JobStatus' --output text)
[ "$job_status" = "COMPLETED" ] && echo " Done" && break
[ "$job_status" = "FAILED" ] && echo " Failed" && exit 1
echo -n "."
sleep 1
done
{
echo "No.,ServiceName,ServiceNamespace"
marker=""; total=0
while :; do
extra_args=()
[ -n "$marker" ] && extra_args=(--marker "$marker")
resp=$(aws iam get-service-last-accessed-details --job-id "$job_id" "${extra_args[@]}" --output json)
echo "$resp" | jq -r '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace] | join(",")'
total=$((total + $(echo "$resp" | jq -r '.ServicesLastAccessed | length')))
echo "${total} items retrieved" >&2
[ "$(echo "$resp" | jq -r '.IsTruncated')" = "true" ] || break
marker=$(echo "$resp" | jq -r '.Marker')
done | awk '{print NR","$0}'
} | pbcopy
echo "Retrieval complete. Copied to clipboard"
The image when executed is as follows.
Waiting for analysis job to complete... Done
200 items retrieved
400 items retrieved
454 items retrieved
Retrieval complete. Copied to clipboard
Since we have it, let's paste the copied content as of 2026/08/08.
Expand
Sorted alphabetically by AWS service namespace (rightmost column).
No.,ServiceName,ServiceNamespace
1,AWS App2Container,a2c
2,Alexa for Business,a4b
3,AWS IAM Access Analyzer,access-analyzer
4,AWS Account Management,account
5,AWS Certificate Manager,acm
6,AWS Private Certificate Authority,acm-pca
7,AWS Compute Optimizer Automation,aco-automation
8,AWS Action Recommendations,action-recommendations
9,AWS Activate,activate
10,AWS Agent Registry,agent-registry
11,Amazon WorkSpaces AgentAccess MCP Server,agentaccess-mcp
12,AWS DevOps Agent Service,aidevops
13,Amazon AI Operations,aiops
14,Amazon Managed Workflows for Apache Airflow,airflow
15,AWS MWAA Serverless,airflow-serverless
16,AWS Amplify,amplify
17,AWS Amplify Admin,amplifybackend
18,AWS Amplify UI Builder,amplifyuibuilder
19,Amazon OpenSearch Serverless,aoss
20,Manage - Amazon API Gateway,apigateway
21,Amazon AppIntegrations,app-integrations
22,AWS AppConfig,appconfig
23,AWS AppFabric,appfabric
24,Amazon AppFlow,appflow
25,AWS Application Auto Scaling,application-autoscaling
26,Amazon CloudWatch Application Signals,application-signals
27,Amazon CloudWatch Application Signals MCP Server,application-signals-mcp
28,AWS Application Transformation Service,application-transformation
29,Amazon CloudWatch Application Insights,applicationinsights
30,AWS App Mesh,appmesh
31,AWS App Mesh Preview,appmesh-preview
32,AWS App Runner,apprunner
33,Amazon AppStream 2.0,appstream
34,AWS App Studio,appstudio
35,AWS AppSync,appsync
36,AWS Mainframe Modernization Application Testing,apptest
37,Amazon Managed Service for Prometheus,aps
38,Amazon ARC Region switch,arc-region-switch
39,Amazon Application Recovery Controller - Zonal Shift,arc-zonal-shift
40,Application Discovery Arsenal,arsenal
41,AWS Artifact,artifact
42,Amazon Athena,athena
43,AWS Audit Manager,auditmanager
44,Amazon EC2 Auto Scaling,autoscaling
45,AWS Auto Scaling,autoscaling-plans
46,Claude Platform on AWS,aws-external-anthropic
47,AWS Marketplace,aws-marketplace
48,AWS Marketplace Management Portal,aws-marketplace-management
49,AWS Billing Console,aws-portal
50,AWS Connector Service,awsconnector
51,AWS B2B Data Interchange,b2bi
52,AWS Backup,backup
53,AWS Backup Gateway,backup-gateway
54,AWS Backup Search,backup-search
55,AWS Backup storage,backup-storage
56,AWS Batch,batch
57,AWS Billing and Cost Management Dashboards,bcm-dashboards
58,AWS Billing And Cost Management Data Exports,bcm-data-exports
59,AWS Billing And Cost Management Pricing Calculator,bcm-pricing-calculator
60,AWS Billing And Cost Management Recommended Actions,bcm-recommended-actions
61,Amazon Bedrock,bedrock
62,Amazon Bedrock Agentcore,bedrock-agentcore
63,Amazon Bedrock Powered by AWS Mantle,bedrock-mantle
64,Amazon Bedrock Web Search,bedrock-websearch
65,AWS Billing,billing
66,AWS Billing Conductor,billingconductor
67,Amazon Braket,braket
68,AWS Budget Service,budgets
69,AWS BugBust,bugbust
70,Amazon Connect Cases,cases
71,Amazon Keyspaces (for Apache Cassandra),cassandra
72,AWS Cost Explorer Service,ce
73,AWS Chatbot,chatbot
74,Amazon Chime,chime
75,AWS Clean Rooms,cleanrooms
76,AWS Clean Rooms ML,cleanrooms-ml
77,AWS Cloud9,cloud9
78,Amazon Cloud Directory,clouddirectory
79,AWS CloudFormation,cloudformation
80,Amazon CloudFront,cloudfront
81,Amazon CloudFront KeyValueStore,cloudfront-keyvaluestore
82,AWS CloudHSM,cloudhsm
83,Amazon CloudSearch,cloudsearch
84,AWS CloudShell,cloudshell
85,AWS CloudTrail,cloudtrail
86,AWS CloudTrail Data,cloudtrail-data
87,Amazon CloudWatch,cloudwatch
88,AWS CodeArtifact,codeartifact
89,AWS CodeBuild,codebuild
90,Amazon CodeCatalyst,codecatalyst
91,AWS CodeCommit,codecommit
92,AWS CodeConnections,codeconnections
93,AWS CodeDeploy,codedeploy
94,AWS CodeDeploy secure host commands service,codedeploy-commands-secure
95,Amazon CodeGuru,codeguru
96,Amazon CodeGuru Profiler,codeguru-profiler
97,Amazon CodeGuru Reviewer,codeguru-reviewer
98,Amazon CodeGuru Security,codeguru-security
99,AWS CodePipeline,codepipeline
100,AWS CodeStar,codestar
101,AWS CodeStar Connections,codestar-connections
102,AWS CodeStar Notifications,codestar-notifications
103,Amazon CodeWhisperer,codewhisperer
104,Amazon Cognito Identity,cognito-identity
105,Amazon Cognito User Pools,cognito-idp
106,Amazon Cognito Sync,cognito-sync
107,Amazon Comprehend,comprehend
108,Amazon Comprehend Medical,comprehendmedical
109,AWS Compute Optimizer,compute-optimizer
110,AWS Config,config
111,Amazon Connect,connect
112,Amazon Connect Outbound Campaigns,connect-campaigns
113,AWS Console Mobile App,consoleapp
114,AWS Consolidated Billing,consolidatedbilling
115,AWS Control Catalog,controlcatalog
116,AWS Control Tower,controltower
117,AWS Cost Optimization Hub,cost-optimization-hub
118,AWS Cost and Usage Report,cur
119,AWS Customer Verification Service,customer-verification
120,AWS Glue DataBrew,databrew
121,AWS Data Exchange,dataexchange
122,AWS Data Pipeline,datapipeline
123,AWS DataSync,datasync
124,Amazon DataZone,datazone
125,Amazon DynamoDB Accelerator (DAX),dax
126,Database Query Metadata Service,dbqms
127,AWS Deadline Cloud,deadline
128,Amazon Detective,detective
129,AWS Device Farm,devicefarm
130,Amazon DevOps Guru,devops-guru
131,AWS Direct Connect,directconnect
132,AWS Application Discovery Service,discovery
133,Amazon Data Lifecycle Manager,dlm
134,AWS Database Migration Service,dms
135,Amazon DocumentDB Elastic Clusters,docdb-elastic
136,AWS Elastic Disaster Recovery,drs
137,AWS Directory Service,ds
138,AWS Directory Service Data,ds-data
139,Amazon Aurora DSQL,dsql
140,Amazon DynamoDB,dynamodb
141,Amazon Elastic Block Store,ebs
142,Amazon EC2,ec2
143,Amazon EC2 Instance Connect,ec2-instance-connect
144,Amazon Message Delivery Service,ec2messages
145,Amazon Elastic Container Registry,ecr
146,Amazon Elastic Container Registry Public,ecr-public
147,Amazon Elastic Container Service,ecs
148,Amazon ECS MCP Service,ecs-mcp
149,Amazon Elastic Kubernetes Service,eks
150,Amazon EKS Auth,eks-auth
151,Amazon EKS MCP Server,eks-mcp
152,Amazon ElastiCache,elasticache
153,AWS Elastic Beanstalk,elasticbeanstalk
154,Amazon Elastic File System,elasticfilesystem
155,Elastic Load Balancing,elasticloadbalancing
156,Amazon Elastic MapReduce,elasticmapreduce
157,Amazon Elastic Transcoder,elastictranscoder
158,AWS Elemental Appliances and Software Activation Service,elemental-activations
159,AWS Elemental Appliances and Software,elemental-appliances-software
160,AWS Elemental Inference,elemental-inference
161,AWS Elemental Support Cases,elemental-support-cases
162,AWS Elemental Support Content,elemental-support-content
163,Amazon EMR on EKS (EMR Containers),emr-containers
164,Amazon EMR Serverless,emr-serverless
165,AWS Entity Resolution,entityresolution
166,Amazon OpenSearch Service,es
167,Amazon EventBridge,events
168,AWS reInvent event pass amount charge to customer AWS account,eventsbilltoaws
169,Amazon CloudWatch Evidently,evidently
170,Amazon Elastic VMware Service,evs
171,Amazon API Gateway,execute-api
172,AWS FinOps Agent,finops-agent
173,Amazon FinSpace,finspace
174,Amazon FinSpace API,finspace-api
175,Amazon Kinesis Firehose,firehose
176,AWS Fault Injection Service,fis
177,AWS Firewall Manager,fms
178,Amazon Forecast,forecast
179,Amazon Fraud Detector,frauddetector
180,Amazon FreeRTOS,freertos
181,AWS Free Tier,freetier
182,Amazon FSx,fsx
183,Amazon GameLift Servers,gamelift
184,Amazon GameLift Streams,gameliftstreams
185,Amazon Location,geo
186,Amazon Location Service Maps,geo-maps
187,Amazon Location Service Places,geo-places
188,Amazon Location Service Routes,geo-routes
189,Amazon S3 Glacier,glacier
190,AWS Global Accelerator,globalaccelerator
191,AWS Glue,glue
192,Amazon Managed Grafana,grafana
193,AWS IoT Greengrass,greengrass
194,AWS Ground Station,groundstation
195,Amazon GroundTruth Labeling,groundtruthlabeling
196,Amazon GuardDuty,guardduty
197,AWS Health APIs and Notifications,health
198,Amazon Connect Health,health-agent
199,AWS HealthLake,healthlake
200,Amazon Honeycode,honeycode
201,AWS Identity and Access Management,iam
202,AWS Identity Sync,identity-sync
203,AWS Identity Store,identitystore
204,AWS Identity Store Auth,identitystore-auth
205,Amazon EC2 Image Builder,imagebuilder
206,AWS Import Export,importexport
207,Amazon Inspector,inspector
208,Amazon InspectorScan,inspector-scan
209,Amazon Inspector2,inspector2
210,Amazon Inspector2 Telemetry Channel,inspector2-telemetry
211,AWS Interconnect,interconnect
212,Amazon CloudWatch Internet Monitor,internetmonitor
213,AWS Invoicing Service,invoicing
214,AWS IoT,iot
215,AWS IoT Device Tester,iot-device-tester
216,AWS IoT Analytics,iotanalytics
217,AWS IoT Core Device Advisor,iotdeviceadvisor
218,AWS IoT Events,iotevents
219,AWS IoT Fleet Hub for Device Management,iotfleethub
220,AWS IoT FleetWise,iotfleetwise
221,AWS IoT Jobs DataPlane,iotjobsdata
222,AWS IoT Managed Integrations,iotmanagedintegrations
223,AWS IoT SiteWise,iotsitewise
224,AWS IoT TwinMaker,iottwinmaker
225,AWS IoT Wireless,iotwireless
226,AWS IQ,iq
227,AWS IQ Permissions,iq-permission
228,Amazon Interactive Video Service,ivs
229,Amazon Interactive Video Service Chat,ivschat
230,Amazon Managed Streaming for Apache Kafka,kafka
231,Apache Kafka APIs for Amazon MSK clusters,kafka-cluster
232,Amazon Managed Streaming for Kafka Connect,kafkaconnect
233,Amazon Kendra,kendra
234,Amazon Kendra Intelligent Ranking,kendra-ranking
235,Amazon Kinesis Data Streams,kinesis
236,Amazon Kinesis Analytics,kinesisanalytics
237,Amazon Kinesis Video Streams,kinesisvideo
238,AWS Key Management Service,kms
239,AWS Lake Formation,lakeformation
240,AWS Lambda,lambda
241,AWS Launch Wizard,launchwizard
242,Amazon Lex,lex
243,AWS License Manager,license-manager
244,AWS License Manager Linux Subscriptions Manager,license-manager-linux-subscriptions
245,AWS License Manager User Subscriptions,license-manager-user-subscriptions
246,Amazon Lightsail,lightsail
247,Amazon CloudWatch Logs,logs
248,Amazon Lookout for Equipment,lookoutequipment
249,Amazon Lookout for Metrics,lookoutmetrics
250,Amazon Lookout for Vision,lookoutvision
251,AWS Mainframe Modernization Service,m2
252,Amazon Machine Learning,machinelearning
253,Amazon Macie,macie2
254,Amazon Managed Blockchain,managedblockchain
255,Amazon Managed Blockchain Query,managedblockchain-query
256,AWS Migration Acceleration Program Credits,mapcredits
257,AWS Marketplace Commerce Analytics Service,marketplacecommerceanalytics
258,Amazon Mechanical Turk,mechanicalturk
259,AWS Elemental MediaConnect,mediaconnect
260,AWS Elemental MediaConvert,mediaconvert
261,AmazonMediaImport,mediaimport
262,AWS Elemental MediaLive,medialive
263,AWS Elemental MediaPackage,mediapackage
264,AWS Elemental MediaPackage VOD,mediapackage-vod
265,AWS Elemental MediaPackage V2,mediapackagev2
266,AWS Elemental MediaStore,mediastore
267,AWS Elemental MediaTailor,mediatailor
268,AWS HealthImaging,medical-imaging
269,Amazon MemoryDB,memorydb
270,AWS Migration Hub,mgh
271,AWS Application Migration Service,mgn
272,AWS Migration Hub Orchestrator,migrationhub-orchestrator
273,AWS Migration Hub Strategy Recommendations,migrationhub-strategy
274,Amazon Mobile Analytics,mobileanalytics
275,Amazon Pinpoint,mobiletargeting
276,Amazon Monitron,monitron
277,Multi-party approval,mpa
278,Amazon MQ,mq
279,Amazon Neptune,neptune-db
280,Amazon Neptune Analytics,neptune-graph
281,AWS Network Firewall,network-firewall
282,AWS Shield network security director,network-security-director
283,Network Flow Monitor,networkflowmonitor
284,AWS Network Manager,networkmanager
285,AWS Network Manager Chat,networkmanager-chat
286,Amazon CloudWatch Network Synthetic Monitor,networkmonitor
287,Amazon Nimble Studio,nimble
288,AWS User Notifications,notifications
289,AWS User Notifications Contacts,notifications-contacts
290,Amazon Nova Act,nova-act
291,Amazon CloudWatch Observability Access Manager,oam
292,Amazon CloudWatch Observability Admin Service,observabilityadmin
293,AWS Service - Oracle Database@AWS,odb
294,AWS HealthOmics,omics
295,Amazon One Enterprise,one
296,Amazon OpenSearch,opensearch
297,AWS OpsWorks,opsworks
298,AWS OpsWorks Configuration Management,opsworks-cm
299,AWS Organizations,organizations
300,Amazon OpenSearch Ingestion,osis
301,AWS Outposts,outposts
302,AWS Panorama,panorama
303,AWS Partner Central,partnercentral
304,AWS Partner central account management,partnercentral-account-management
305,AWS Payment Cryptography,payment-cryptography
306,AWS Payments,payments
307,AWS Private CA Connector for Active Directory,pca-connector-ad
308,AWS Private CA Connector for SCEP,pca-connector-scep
309,AWS Parallel Computing Service,pcs
310,Amazon Personalize,personalize
311,AWS Performance Insights,pi
312,Amazon EventBridge Pipes,pipes
313,Amazon Polly,polly
314,AWS Price List,pricing
315,AWS PricingPlanManager Service,pricingplanmanager
316,AWS service providing managed private networks,private-networks
317,Amazon Connect Customer Profiles,profile
318,AWS Proton,proton
319,AWS Purchase Orders Console,purchase-orders
320,Amazon Q,q
321,Amazon Q Business Q Apps,qapps
322,Amazon Q Business,qbusiness
323,Amazon Q Developer,qdeveloper
324,Amazon QLDB,qldb
325,Amazon QuickSight,quicksight
326,AWS Resource Access Manager (RAM),ram
327,AWS Recycle Bin,rbin
328,Amazon RDS,rds
329,Amazon RDS Data API,rds-data
330,Amazon RDS IAM Authentication,rds-db
331,Amazon Redshift,redshift
332,Amazon Redshift Data API,redshift-data
333,Amazon Redshift Serverless,redshift-serverless
334,AWS Migration Hub Refactor Spaces,refactor-spaces
335,Amazon Rekognition,rekognition
336,AWS rePost Private,repostspace
337,Amazon Bio Discovery,researchstudio
338,AWS Resilience Hub,resiliencehub
339,Tag Editor,resource-explorer
340,AWS Resource Explorer,resource-explorer-2
341,AWS Resource Groups,resource-groups
342,Amazon RHEL Knowledgebase Portal,rhelkb
343,AWS RoboMaker,robomaker
344,AWS Identity and Access Management Roles Anywhere,rolesanywhere
345,Amazon Route 53,route53
346,Amazon Route 53 Recovery Cluster,route53-recovery-cluster
347,Amazon Route 53 Recovery Controls,route53-recovery-control-config
348,Amazon Route 53 Recovery Readiness,route53-recovery-readiness
349,Amazon Route 53 Domains,route53domains
350,AWS Route53 Global Resolver,route53globalresolver
351,Amazon Route 53 Profiles,route53profiles
352,Amazon Route 53 Resolver,route53resolver
353,AWS RTB Fabric,rtbfabric
354,AWS CloudWatch RUM,rum
355,Amazon S3,s3
356,Amazon S3 Object Lambda,s3-object-lambda
357,Amazon S3 on Outposts,s3-outposts
358,Amazon S3 Express,s3express
359,Amazon S3 Files,s3files
360,Amazon S3 Tables,s3tables
361,Amazon S3 Vectors,s3vectors
362,Amazon SageMaker,sagemaker
363,Amazon SageMaker data science assistant,sagemaker-data-science-assistant
364,Amazon SageMaker geospatial capabilities,sagemaker-geospatial
365,Amazon SageMaker with MLflow,sagemaker-mlflow
366,Amazon SageMaker Unified Studio MCP,sagemaker-unified-studio-mcp
367,AWS Savings Plans,savingsplans
368,Amazon EventBridge Scheduler,scheduler
369,Amazon EventBridge Schemas,schemas
370,AWS Supply Chain,scn
371,Amazon SimpleDB,sdb
372,AWS Secrets Manager,secretsmanager
373,AWS Security Incident Response,security-ir
374,AWS Security Agent,securityagent
375,AWS Security Hub,securityhub
376,Amazon Security Lake,securitylake
377,AWS Serverless Application Repository,serverlessrepo
378,AWS Service Catalog,servicecatalog
379,AWS Cloud Map,servicediscovery
380,AWS Microservice Extractor for .NET,serviceextract
381,Service Quotas,servicequotas
382,Amazon SES,ses
383,AWS Shield,shield
384,AWS Signer,signer
385,AWS Signin,signin
386,AWS SimSpace Weaver,simspaceweaver
387,AWS Server Migration Service,sms
388,Amazon Pinpoint SMS and Voice Service,sms-voice
389,AWS Snow Device Management,snow-device-management
390,AWS Snowball,snowball
391,Amazon SNS,sns
392,AWS End User Messaging Social,social-messaging
393,AWS SQL Workbench,sqlworkbench
394,Amazon SQS,sqs
395,AWS Systems Manager,ssm
396,AWS Systems Manager Incident Manager Contacts,ssm-contacts
397,AWS Systems Manager GUI Connect,ssm-guiconnect
398,AWS Systems Manager Incident Manager,ssm-incidents
399,AWS Systems Manager Quick Setup,ssm-quicksetup
400,AWS Systems Manager for SAP,ssm-sap
401,Amazon Message Gateway Service,ssmmessages
402,AWS IAM Identity Center,sso
403,AWS IAM Identity Center directory,sso-directory
404,AWS IAM Identity Center OIDC service,sso-oauth
405,AWS Step Functions,states
406,AWS Storage Gateway,storagegateway
407,AWS Security Token Service,sts
408,AWS Support,support
409,AWS Support Console,support-console
410,AWS Support App in Slack,supportapp
411,AWS Support Authorization,supportauthz
412,AWS Support Plans,supportplans
413,AWS Sustainability,sustainability
414,Amazon Simple Workflow Service,swf
415,Amazon CloudWatch Synthetics,synthetics
416,Amazon Resource Group Tagging API,tag
417,AWS Tax Settings,tax
418,Amazon Textract,textract
419,Amazon WorkSpaces Thin Client,thinclient
420,Amazon Timestream,timestream
421,Amazon Timestream InfluxDB,timestream-influxdb
422,AWS Tiros,tiros
423,AWS Telco Network Builder,tnb
424,Amazon Transcribe,transcribe
425,AWS Transfer Family,transfer
426,AWS Transform,transform
427,AWS Transform custom,transform-custom
428,Amazon Translate,translate
429,AWS Trusted Advisor,trustedadvisor
430,AWS Diagnostic tools,ts
431,AWS User Subscriptions,user-subscriptions
432,AWS User Experience Customization,uxc
433,AWS Marketplace Vendor Insights,vendor-insights
434,AWS Verified Access,verified-access
435,Amazon Verified Permissions,verifiedpermissions
436,Amazon Connect Voice ID,voiceid
437,Amazon VPC Lattice,vpc-lattice
438,Amazon VPC Lattice Services,vpc-lattice-svcs
439,AWS PrivateLink,vpce
440,AWS WAF,waf
441,AWS WAF Regional,waf-regional
442,AWS WAF V2,wafv2
443,Amazon WorkSpaces Application Manager,wam
444,AWS Well-Architected Tool,wellarchitected
445,AWS Wickr,wickr
446,Amazon Q in Connect,wisdom
447,Amazon WorkDocs,workdocs
448,Amazon WorkLink,worklink
449,Amazon WorkMail,workmail
450,Amazon WorkMail Message Flow,workmailmessageflow
451,Amazon WorkSpaces,workspaces
452,AWS WorkSpaces Managed Instances,workspaces-instances
453,Amazon WorkSpaces Secure Browser,workspaces-web
454,AWS X-Ray,xray
Try to find your favorite "AWS service." I think most people seeing this area for the first time.
422,AWS Tiros,tiros
423,AWS Telco Network Builder,tnb
What are the paths for AWS managed policies and how many are there?
Managed policies have paths. When creating customer managed policies, most people probably don't consciously set the path and just leave it as the default /.
The paths for AWS managed policies were as follows.
| Path | Count | Notes |
|---|---|---|
| / | 968 | Default |
| /aws-service-role/ | 355 | For AWS Service-Linked Roles (SLR) |
| /service-role/ | 225 | For AWS service roles |
| /job-function/ | 11 | For job function AWS managed policies |
| /root-task/ | 5 | For executing privileged tasks in Organizations member accounts |
The default is overwhelmingly the most common.
Both AWS Service-Linked Roles (SLR) and AWS service roles are roles used by AWS services, but SLRs are more specialized. There is never more than one SLR for a single AWS service, and the management of SLRs belongs to the AWS service itself. Customers cannot edit them.
Job function AWS managed policies are predefined with permissions that would be required for each job function. AdministratorAccess is one of them. Depending on when they were introduced, you may encounter some historical cases where a policy is a job function AWS managed policy but its path is not /job-function/.
/root-task/ was unfamiliar to me, but it enables privileged tasks on member accounts in an AWS Organizations environment. Some tasks that previously required the root user can now be executed by temporarily granting privileges.
The following managed policies were all created together on November 6, 2024 (UTC).
- SQSUnlockQueuePolicy
- S3UnlockBucketPolicy
- IAMAuditRootUserCredentials
- IAMCreateRootUserPassword
- IAMDeleteRootUserCredentials
The longest and shortest named AWS managed policies
What are the longest and shortest policy names among managed policies? Here are the TOP 5 for each.
Longest Policy Name TOP 5
| Policy Name | Characters | Path | Version | Created |
|---|---|---|---|---|
| AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy | 75 | /service-role/ | v1 | 2023-08-01T15:06:46+00:00 |
| AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity | 72 | /service-role/ | v4 | 2024-01-19T20:08:36+00:00 |
| AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy | 72 | / | v1 | 2024-11-16T00:25:12+00:00 |
| AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy | 71 | /service-role/ | v1 | 2023-08-01T15:06:24+00:00 |
| AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy | 70 | / | v1 | 2024-11-16T00:11:14+00:00 |
Shortest Policy Name TOP 5
| Policy Name | Characters | Path | Version | Created |
|---|---|---|---|---|
| Billing | 7 | /job-function/ | v30 | 2016-11-10T17:33:18+00:00 |
| AWSDenyAll | 10 | / | v2 | 2019-05-01T22:36:14+00:00 |
| SupportUser | 11 | /job-function/ | v11 | 2016-11-10T17:21:53+00:00 |
| AWSConnector | 12 | / | v3 | 2015-02-11T17:14:31+00:00 |
| LexBotPolicy | 12 | /aws-service-role/ | v2 | 2017-02-17T22:18:13+00:00 |
It does seem like names tend to get longer over time. The average came out to just over 30 characters.
| Item | Value |
|---|---|
| Mean | 33.20 |
| Median | 32 |
| Min | 7 |
| Max | 75 |
| Mode | 33 |
A nice clean distribution shape
By the way, the upper limit appears to be 125 characters.
What about descriptions?
Let's try the same thing with descriptions.
Longest Description TOP 5
| Policy Name | Path | Version | Created | Description Characters |
|---|---|---|---|---|
| AWSElasticDisasterRecoveryReplicationServerPolicy | /service-role/ | v3 | 2021-11-17T13:34:00+00:00 | 738 |
| AWSRefactoringToolkitFullAccess | / | v8 | 2022-10-25T16:41:15+00:00 | 726 |
| AmazonCognitoUnAuthedIdentitiesSessionPolicy | / | v4 | 2023-07-19T23:04:05+00:00 | 723 |
| AmazonEBSCSIDriverEKSClusterScopedPolicy | / | v2 | 2026-04-16T17:27:16+00:00 | 679 |
| AWSApplicationMigrationReplicationServerPolicy | /service-role/ | v2 | 2021-04-07T07:21:57+00:00 | 661 |
Shortest Description TOP 5
| Policy Name | Version | Created | Description Characters |
|---|---|---|---|
| AWSDenyAll | v2 | 2019-05-01T22:36:14+00:00 | 16 |
| AWSRoboMakerServiceRolePolicy | v1 | 2018-11-26T05:33:19+00:00 | 24 |
| AWSRoboMakerServicePolicy | v6 | 2018-11-26T06:30:08+00:00 | 24 |
| AWSIQFullAccess | v2 | 2019-04-04T23:13:42+00:00 | 30 |
| LexBotPolicy | v2 | 2017-02-17T22:18:13+00:00 | 31 |
It also seems that descriptions tend to get longer over time.
The longest at 738 characters looks like this.
This policy is attached to the Elastic Disaster Recovery Replication server's instance role. This policy allows the Elastic Disaster Recovery (DRS) Replication Servers, which are EC2 instances launched by Elastic Disaster Recovery - to communicate with the DRS service, and to create EBS snapshots in your AWS account. An IAM role with this policy is attached (as an EC2 Instance Profile) by Elastic Disaster Recovery to the DRS Replication Servers which are automatically launched and terminated by DRS, as needed. DRS Replication Servers are used to facilitate data replication from your external servers to AWS, as part of the recovery process managed by DRS. We do not recommend that you attach this policy to your IAM users or roles.
The shortest at 16 characters looks like this. Beautiful.
Deny all access.
The average is around 120 characters. It's a tough call whether longer and more detailed is better, or shorter and more readable.
| Item | Value |
|---|---|
| Mean | 117.57 |
| Median | 89 |
| Min | 16 |
| Max | 738 |
| Mode | 72 |
Read it as: range 0~24 characters, range 25~49 characters, and so on.
The upper limit for descriptions appears to be 1000 characters.
Since we've come this far, let's also look at the most frequently updated AWS managed policy
Let's also look at version counts. To be precise, this refers to the "default version."
Most Versions TOP 5
| Policy Name | Version | Path | Created |
|---|---|---|---|
| ReadOnlyAccess | v188 | / | 2015-02-06T18:39:48+00:00 |
| AWSConfigServiceRolePolicy | v94 | /aws-service-role/ | 2018-05-30T23:31:46+00:00 |
| SecurityAudit | v91 | / | 2015-02-06T18:41:01+00:00 |
| SageMakerStudioProjectProvisioningRolePolicy | v81 | /service-role/ | 2024-11-20T21:58:39+00:00 |
| SageMakerStudioProjectUserRolePolicy | v73 | / | 2024-11-20T21:59:23+00:00 |
ReadOnlyAccess, which we always rely on, is overwhelmingly at the top. It's surprising that SageMaker-related policies have such a high update frequency.
Policies with only v1, meaning they have never been updated, account for 623 — overwhelmingly the most common. It seems the tendency is for most policies to stay in the single digits for updates.
| Item | Value |
|---|---|
| Mean | 4.41 |
| Median | 2 |
| Min | 1 |
| Max | 188 |
| Mode | 1 |
Notable AWS managed policies you might not know
Having collected so many managed policies, here are a few rare ones that caught my attention. If you already knew all of them, you have earned the right to call yourself a Managed Policy Master.
AWSCompromisedKeyQuarantineV3
This is an emergency quarantine policy that AWS applies when an IAM user's credentials are leaked or exposed. It limits the impact on existing resources while suppressing unauthorized charges and damage. It must not be deleted without instructions from AWS Support.
- Version:
3 - Path:
/ - Created: August 21, 2024 17:36:49 UTC
- Last updated: March 16, 2026 16:27:14 UTC
- Policy details: AWS Managed Policy Reference
AWSBugBustPlayerAccess
This is a policy for players participating in AWS BugBust events. It provides the access rights needed for participants to perform bug fixing and code quality improvement activities within the event.
- Version:
1 - Path:
/ - Created: June 24, 2021 07:15:00 UTC
- Policy details: AWS Managed Policy Reference
ReInventTicketApprovalAccess
This is a policy for reviewing and approving billing when charging AWS re:Invent attendance pass fees to an AWS account. Quite interesting, isn't it.
- Version:
1 - Path:
/ - Created: June 10, 2026 18:57:15 UTC
- Reference: Bill to AWS for re:Invent
- Policy details: AWS Managed Policy Reference
Ending
The phrase one hundred and fifty-one suddenly came to mind. As image colors, red and green come to mind, followed by blue and yellow.
Various other numbers came to mind as well, so I made a graph comparing them with the number of managed policies.
When it comes to managed policies, more is obviously, absolutely, solidly better. I can't take my eyes off what's coming next.
Closing
So I went ahead and collected a whole lot of managed policies. Since I can't keep that many, I released them all for now.
I hope to encounter them again somewhere.
That was entry #12 in the "Summer Vacation Independent Research Relay," titled "I Tried to Catch Every AWS Managed Policy in AWS IAM."
Next up is Yoshida Tatsuya's "Turning a Gaming PC into a Server ~ On-Premise Game Server Deployment I've Been Running Away From ~." Stay tuned!!
This was brought to you by Chiba Yuki (@batchicchi).
References
- 7 年間溜めた AWS IAM AWS 管理ポリシーへの愛を語りました #devio2022 | DevelopersIO
- AWS 管理ポリシーの一覧や各種情報を AWS CLI で一括取得してニッコリする | DevelopersIO
- デビュー当時から変わらない AWS 管理ポリシーの初期メンバーを確認してみた | DevelopersIO
