AWS managed policies for AWS Systems Manager

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: AmazonSSMServiceRolePolicy

This policy provides access to a number of AWS resources that are managed by AWS Systems Manager or used in Systems Manager operations.

You can't attach AmazonSSMServiceRolePolicy to your AWS Identity and Access Management (IAM) entities. This policy is attached to a service-linked role that allows AWS Systems Manager to perform actions on your behalf. For more information, see Using roles to collect inventory and view OpsData.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AmazonSSMServiceRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonSSMReadOnlyAccess

You can attach the AmazonSSMReadOnlyAccess policy to your IAM identities. This policy grants read-only access to AWS Systems Manager API operations including Describe*, Get*, and List*.

To view more details about the policy, including the latest version of the JSON policy document, see AmazonSSMReadOnlyAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSSystemsManagerOpsDataSyncServiceRolePolicy

You can't attach AWSSystemsManagerOpsDataSyncServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role that allows Systems Manager to perform actions on your behalf. For more information, see Using roles to create OpsData and OpsItems for Explorer.

AWSSystemsManagerOpsDataSyncServiceRolePolicy allows the AWSServiceRoleForSystemsManagerOpsDataSync service-linked role to create and update OpsItems and OpsData from AWS Security Hub findings.

The policy allows Systems Manager to complete the following actions on all related resources ("Resource": "*"), except where indicated:

[1] The ssm:GetOpsItem and ssm:UpdateOpsItem actions are allowed permissions by the following condition for the Systems Manager service only.

"Condition": {
    "StringEquals": {
        "aws:ResourceTag/ExplorerSecurityHubOpsItem": "true"
    }
}

[2] The ssm:AddTagsToResource action is allowed permissions for the following resource only.

arn:aws:ssm:*:*:opsitem/*

[3] The ssm:UpdateServiceSetting and ssm:GetServiceSetting actions are allowed permissions for the following resources only.

arn:aws:ssm:*:*:servicesetting/ssm/opsitem/*
arn:aws:ssm:*:*:servicesetting/ssm/opsdata/*

[4] The securityhub:BatchUpdateFindings are denied permissions by the following condition for the Systems Manager service only.

{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"securityhub:ASFFSyntaxPath/Workflow.Status": "SUPPRESSED"
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/Confidence": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/Criticality": false
				}
			}
		},		
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/Note.Text": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/Note.UpdatedBy": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/RelatedFindings": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/Types": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/UserDefinedFields.key": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/UserDefinedFields.value": false
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": "securityhub:BatchUpdateFindings",
			"Resource": "*",
			"Condition": {
				"Null": {
					"securityhub:ASFFSyntaxPath/VerificationState": false
				}
			}

To view more details about the policy, including the latest version of the JSON policy document, see AWSSystemsManagerOpsDataSyncServiceRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AmazonSSMManagedEC2InstanceDefaultPolicy

You should only attach AmazonSSMManagedEC2InstanceDefaultPolicy to IAM roles for Amazon EC2 instances that you want to have permission to use Systems Manager functionality. You shouldn't attached this role to other IAM entities, such as IAM users and IAM groups, or to IAM roles that serve other purposes. For more information, see Managing EC2 instances automatically with Default Host Management Configuration.

This policy grants permissions that allow SSM Agent on your Amazon EC2 instance to communicate with the Systems Manager service in the cloud in order to perform a variety of tasks. It also grants permissions for the two services that provide authorization tokens to ensure that operations are performed on the correct instance.

Permissions details

This policy includes the following permissions.

For related information about the ssmmessages and ec2messages endpoints, including the differences between the two, see Agent-related API operations (ssmmessages and ec2messages endpoints).

To view more details about the policy, including the latest version of the JSON policy document, see AmazonSSMManagedEC2InstanceDefaultPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: SSMQuickSetupRolePolicy

You can't attach SSMQuickSetupRolePolicy to your IAM entities. This policy is attached to a service-linked role that allows Systems Manager to perform actions on your behalf. For more information, see Using roles to maintain Quick Setup-provisioned resource health and consistency.

This policy grants read-only permissions that allow Systems Manager to check configuration health, ensure consistent use of parameters and provisioned resources, and remediate resources when drift is detected. It also grants administrative permissions for creating a service-linked role.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see SSMQuickSetupRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupDeploymentRolePolicy

The managed policy AWSQuickSetupDeploymentRolePolicy supports multiple Quick Setup configuration types. These configuration types create IAM roles and automations that configure frequently used Amazon Web Services services and features with recommended best practices.

You can attach AWSQuickSetupDeploymentRolePolicy to your IAM entities.

This policy grants administrative permissions needed to create resources associated with the following Quick Setup configurations:

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupDeploymentRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupPatchPolicyDeploymentRolePolicy

The managed policy AWSQuickSetupPatchPolicyDeploymentRolePolicy supports the Configure patching for instances in an organization using Quick Setup Quick Setup type. This configuration type helps automate patching of applications and nodes in a single account or across your organization.

You can attach AWSQuickSetupPatchPolicyDeploymentRolePolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

This policy grants administrative permissions that allow Quick Setup to create resources associated with a patch policy configuration.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupPatchPolicyDeploymentRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupPatchPolicyBaselineAccess

The managed policy AWSQuickSetupPatchPolicyBaselineAccess supports the Configure patching for instances in an organization using Quick Setup Quick Setup type. This configuration type helps automate patching of applications and nodes in a single account or across your organization.

You can attach AWSQuickSetupPatchPolicyBaselineAccess to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

This policy provides read-only permissions to access patch baselines that have been configured by an administrator in the current AWS account or organization using Quick Setup. The patch baselines are stored in an Amazon S3 bucket and can be used for patching instances in a single account or across an entire organization.

Permissions details

This policy includes the following permission.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupPatchPolicyBaselineAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSSystemsManagerEnableExplorerExecutionPolicy

The managed policy AWSSystemsManagerEnableExplorerExecutionPolicy supports enabling Explorer, a tool in AWS Systems Manager.

You can attach AWSSystemsManagerEnableExplorerExecutionPolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

This policy grants administrative permissions for enabling Explorer. This includes permissions to update related Systems Manager service settings, and to create a service-linked role for Systems Manager.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSSystemsManagerEnableExplorerExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSSystemsManagerEnableConfigRecordingExecutionPolicy

The managed policy AWSSystemsManagerEnableConfigRecordingExecutionPolicy supports the Create an AWS Config configuration recorder using Quick Setup Quick Setup configuration type. This configuration type enables Quick Setup to track and record changes to the AWS resource types you choose for AWS Config. It also enables Quick Setup to configure delivery and notifications options for the recorded data.

You can attach AWSSystemsManagerEnableConfigRecordingExecutionPolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

This policy grants administrative permissions that allow Quick Setup to enable and configure AWS Config configuration recording.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSSystemsManagerEnableConfigRecordingExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupDevOpsGuruPermissionsBoundary

The managed policy AWSQuickSetupDevOpsGuruPermissionsBoundary supports the Set up DevOps Guru using Quick Setup type. The configuration type enables the machine learning-powered Amazon DevOps Guru. The DevOps Guru service can help improve an application’s operational performance and availability.

When you create an AWSQuickSetupDevOpsGuruPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to enable and configure Amazon DevOps Guru.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupDevOpsGuruPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupDistributorPermissionsBoundary

The managed policy AWSQuickSetupDistributorPermissionsBoundary supports the Deploy Distributor packages using Quick Setup Quick Setup configuration type. The configuration type helps enable the distribution of software packages, such as agents, to your Amazon Elastic Compute Cloud (Amazon EC2) instances, using Distributor, a tool in AWS Systems Manager.

When you create an AWSQuickSetupDistributorPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to enable the distribution of software packages, such as agents, to your Amazon EC2 instances using Distributor.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupDistributorPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSSMHostMgmtPermissionsBoundary

The managed policy AWSQuickSetupSSMHostMgmtPermissionsBoundary supports the Set up Amazon EC2 host management using Quick Setup Quick Setup configuration type. This configuration type configures IAM roles and enables commonly used Systems Manager tools to securely manage your Amazon EC2 instances.

When you create an AWSQuickSetupSSMHostMgmtPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to enable and configure Systems Manager tools needed for securely managing EC2 instances.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSSMHostMgmtPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupPatchPolicyPermissionsBoundary

The managed policy AWSQuickSetupPatchPolicyPermissionsBoundary supports the Configure patching for instances in an organization using Quick Setup Quick Setup type. This configuration type helps automate patching of applications and nodes in a single account or across your organization.

When you create an AWSQuickSetupPatchPolicyPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to enable and configure patch policies in Patch Manager, a tool in AWS Systems Manager.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupPatchPolicyPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSchedulerPermissionsBoundary

The managed policy AWSQuickSetupSchedulerPermissionsBoundary supports the Stop and start EC2 instances automatically on a schedule using Quick Setup Quick Setup configuration type. This configuration type lets you stop and start your EC2 instances and other resources at the times you specify.

When you create an AWSQuickSetupSchedulerPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to enable and configure scheduled operations on EC2 instances and other resources.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSchedulerPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupCFGCPacksPermissionsBoundary

The managed policy AWSQuickSetupCFGCPacksPermissionsBoundarysupports the Deploy AWS Config conformance pack using Quick Setup Quick Setup configuration type. This configuration type deploys AWS Config conformance packs. Conformance packs are collections of AWS Config rules and remediation actions that can be deployed as a single entity.

When you create an AWSQuickSetupCFGCPacksPermissionsBoundary configuration using Quick Setup, the system applies this permissions boundary to the IAM roles that are created when the configuration is deployed. The permissions boundary limits the scope of the roles that Quick Setup creates.

This policy grants administrative permissions that allow Quick Setup to deploy AWS Config conformance packs.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupCFGCPacksPermissionsBoundary in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy

The policy AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy provides permissions for diagnosing issues with nodes that interact with Systems Manager services by starting Automation workflows in accounts and Regions where nodes are managed.

You can attach AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform diagnosis actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy

The managed policy AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy provides administrative permission for running Automation runbooks in a targeted AWS account and Region to diagnose issues with managed nodes that interact with Systems Manager services.

You can attach AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-RemediationAutomation-AdministrationRolePolicy

The managed policy AWS-SSM-RemediationAutomation-AdministrationRolePolicy provides permission for remediating issues in managed nodes that interact with Systems Manager services by starting Automation workflows in accounts and Regions where nodes are managed.

You can attach this policy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform remediation actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-RemediationAutomation-AdministrationRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-RemediationAutomation-ExecutionRolePolicy

The managed policy AWS-SSM-RemediationAutomation-ExecutionRolePolicy provides permission for running Automation runbooks in a specific target account and Region to remediate issues with managed nodes that interact with Systems Managerservices.

You can attach the policy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform remediation actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-RemediationAutomation-ExecutionRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSSMManageResourcesExecutionPolicy

This policy grants permissions that allow Quick Setup to run the AWSQuickSetupType-SSM-SetupResources Automation runbook. This runbook creates IAM roles for Quick Setup associations, which in turn are created by a AWSQuickSetupType-SSM deployment. It also grants permissions to clean up an associated Amazon S3 bucket on during a Quick Setup delete operation.

You can attach the policy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSSMManageResourcesExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSSMLifecycleManagementExecutionPolicy

The AWSQuickSetupSSMLifecycleManagementExecutionPolicy policy grants administrative permissions that allow Quick Setup to run the a AWS CloudFormation custom resource on lifecycle events during Quick Setup deployment in Systems Manager.

You can attach this policy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSSMLifecycleManagementExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSSMDeploymentRolePolicy

The managed policy AWSQuickSetupSSMDeploymentRolePolicy grants administrative permissions that allow Quick Setup to create resources that are used during the Systems Manager onboarding process.

Though you can manually attach this policy to your IAM entities, this is not recommended. Quick Setup creates entities that attach this policy to a service role that allows Systems Manager to perform actions on your behalf.

This policy is not related to the SSMQuickSetupRolePolicy policy, which is used to provide permissions for the AWSServiceRoleForSSMQuickSetup service-linked role.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSSMDeploymentRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupSSMDeploymentS3BucketRolePolicy

The AWSQuickSetupSSMDeploymentS3BucketRolePolicy policy grants permissions for listing all S3 buckets in an account; and for managing and retrieving information about specific buckets in the principal account that are managed through AWS CloudFormation templates.

You can attach AWSQuickSetupSSMDeploymentS3BucketRolePolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupSSMDeploymentS3BucketRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupEnableDHMCExecutionPolicy

This policy grants administrative permissions that allow principals to run the AWSQuickSetupType-EnableDHMC Automation runbook, which enables Default Host Management Configuration. The Default Host Management Configuration setting allows Systems Manager to automatically manage Amazon EC2 instances as managed instances. A managed instance is an EC2 instance that is configured for use with Systems Manager. This policy also grants permissions for creating IAM roles that are specified in Systems Manager service settings as the default roles for SSM Agent.

You can attach AWSQuickSetupEnableDHMCExecutionPolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupEnableDHMCExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupEnableAREXExecutionPolicy

This policy grants administrative permissions that allow Systems Manager to run the AWSQuickSetupType-EnableAREX Automation runbook, which enables AWS Resource Explorer for use with Systems Manager. Resource Explorer makes it possible to view resources in your account with a search experience similar to an Internet search engine. The policy also grants permissions for managing Resource Explorer indexes and views.

You can attach AWSQuickSetupEnableAREXExecutionPolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupEnableAREXExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupManagedInstanceProfileExecutionPolicy

THhis policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup tool, and to attach it to Amazon EC2 instances that don't already have an instance profile attached. The policy also grants Systems Manager the ability to attach permissions to existing instance profiles. This is done to ensure that the permissions required for Systems Manager to communicate with .SSM Agent on EC2 instances are in place.

You can attach AWSQuickSetupManagedInstanceProfileExecutionPolicy to your IAM entities. Systems Manager also attaches this policy to a service role that allows Systems Manager to perform actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupManagedInstanceProfileExecutionPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupFullAccess

This policy grants administrative permissions that allow full access to AWS Systems Manager Quick Setup API actions and data in the AWS Management Console and AWS SDKs, as well as limited access to other AWS service resources that are required for Quick Setup operations.

You can attach the AWSQuickSetupFullAccess policy to your IAM identities.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupFullAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWSQuickSetupReadOnlyAccess

This policy grants read-only permissions that allow principals to view AWS Systems Manager Quick Setup data and reports, including information from other AWS service resources that are required for Quick Setup operations.

You can attach the AWSQuickSetupReadOnlyAccess policy to your IAM identities.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWSQuickSetupReadOnlyAccess in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-Automation-DiagnosisBucketPolicy

The managed policy AWS-SSM-Automation-DiagnosisBucketPolicy provides permissions for diagnosing issues with nodes that interact with AWS Systems Manager services, by allowing access to S3 buckets that are used for diagnosis and remediation of issues.

You can attach the AWS-SSM-Automation-DiagnosisBucketPolicy policy to your IAM identities. Systems Manager also attaches this policy to an IAM role that allows Systems Manager to perform diagnosis actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-Automation-DiagnosisBucketPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy

The managed policy AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy provides permissions for an operational account to diagnose issues with nodes by providing organization-specific permissions.

You can attach AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy to your IAM identities. Systems Manager also attaches this policy to an IAM role that allows Systems Manager to perform diagnosis actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy

The managed policy AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy provides permissions for an operational account to diagnose issues with nodes by providing organization-specific permissions.

You can attach the AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy policy to your IAM identities. Systems Manager also attaches this policy to an IAM role that allows Systems Manager to perform diagnosis actions on your behalf.

Permissions details

This policy includes the following permissions.

To view more details about the policy, including the latest version of the JSON policy document, see AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy in the AWS Managed Policy Reference Guide.

Systems Manager updates to AWS managed policies

In the following table, view details about updates to AWS managed policies for Systems Manager since this service began tracking these changes on March 12, 2021. For information about other managed policies for the Systems Manager service, see Additional managed policies for Systems Manager later in this topic. For automatic alerts about changes to this page, subscribe to the RSS feed on the Systems Manager Document history page.

Additional managed policies for Systems Manager

In addition to the managed policies described earlier in this topic, the following policies are also supported by Systems Manager.