> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/aws-apis-ingested-by-prisma-cloud.md). # AWS APIs Ingested by Prisma Cloud The following table lists all the AWS APIs that Prisma Cloud supports to retrieve data about the assets in your AWS cloud environment. | Service | API Name in Prisma Cloud | EAI Supported | Permissions | | ------------------------------------------- | ---------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Current as of: | April 10, 2026 | | | | Amazon EC2 | | | | | Amazon EC2 | aws-ec2-describe-instances | Yes | ec2:DescribeInstances ec2:DescribeInstanceStatus ec2:DescribeInstanceAttribute | | Amazon EC2 | aws-ec2-classic-instance | No | ec2:DescribeInstances ec2:DescribeInstanceStatus | | Amazon EC2 | aws-ec2-describe-network-interfaces | Yes | ec2:DescribeNetworkInterfaces | | Amazon EC2 | aws-ec2-describe-images\* | Yes | ec2:DescribeImages | | Amazon EC2 | aws-ec2-describe-snapshots | Yes | ec2:DescribeSnapshots ec2:DescribeSnapshotAttribute | | Amazon EC2 | aws-ec2-describe-volumes | Yes | ec2:DescribeVolumes | | Amazon EC2 | aws-describe-account-attributes | NA | ec2:DescribeAccountAttributes | | Amazon EC2 | aws-ec2-key-pair | Yes | ec2:DescribeKeyPairs | | Amazon EC2 | aws-ec2-elastic-address | Yes | ec2:DescribeAddresses | | Amazon EC2 | aws-ec2-ebs-encryption | NA | ec2:GetEbsEncryptionByDefault | | Amazon EC2 | aws-ec2-launch-template | No |

ec2:DescribeLaunchTemplates
ec2:DescribeLaunchTemplateVersions

| | Amazon EC2 | aws-ec2-launch-template-data | No |

ec2:GetLaunchTemplateData
ec2:DescribeInstances

| | Amazon EC2 | aws-ec2-vpc-endpoint-service | No | ec2:DescribeVpcEndpointServices | | Amazon EC2 | aws-ec2-vpc-endpoint-connection-notification | No | ec2:DescribeVpcEndpointConnectionNotifications | | Amazon EC2 | aws-ec2-vpc-ipam | No | ec2:DescribeIpams | | Amazon EC2 | aws-describe-account-attributes | No | ec2:DescribeAccountAttributes | | Amazon EC2 | aws-ec2-reserved-instance | No | ec2:DescribeReservedInstances | | Amazon EC2 | aws-ec2-egress-only-internet-gateway | No | ec2:DescribeEgressOnlyInternetGateways | | Amazon EC2 | aws-ec2-network-insights-analysis | No | ec2:DescribeNetworkInsightsAnalyses | | Amazon EC2 | aws-ec2-spot-fleet-request | No | ec2:DescribeSpotFleetRequests | | Amazon EC2 | aws-ec2-serial-console-access-status | No | ec2:GetSerialConsoleAccessStatus | | Amazon EC2 | aws-ec2-snapshot-block-public-access-state | No | ec2:GetSnapshotBlockPublicAccessState | | Amazon EC2 | aws-ec2-image-block-public-access-state | No | ec2:GetImageBlockPublicAccessState | | Amazon EC2 | aws-ec2-instance-connect-endpoint | No | ec2:DescribeInstanceConnectEndpoints | | Amazon VPC | | | | | Amazon VPC | aws-ec2-describe-vpcs | Yes | ec2:DescribeVpcs | | Amazon VPC | aws-ec2-vpc-stats | No | ec2:DescribeVpcs | | Amazon VPC | aws-ec2-describe-subnets | Yes | ec2:DescribeSubnets | | Amazon VPC | aws-ec2-describe-security-groups | Yes | ec2:DescribeSecurityGroups | | Amazon VPC | aws-ec2-describe-flow-logs | Yes | ec2:DescribeFlowLogs, ec2: DescribeTags | | Amazon VPC | aws-ec2-describe-internet-gateways | Yes | ec2:DescribeInternetGateways | | Amazon VPC | aws-describe-vpc-endpoints | Yes | ec2:DescribeVpcEndpoints | | Amazon VPC | aws-ec2-describe-network-acls | Yes | ec2:DescribeNetworkAcls | | Amazon VPC | aws-ec2-describe-vpc-peering-connections | Yes | ec2:DescribeVpcPeeringConnections | | Amazon VPC | aws-ec2-describe-vpn-gateways | Yes | ec2:DescribeVpnGateways | | Amazon VPC | aws-ec2-describe-vpn-gateways-summary | NA | ec2:DescribeVpnGateways | | Amazon VPC | aws-ec2-describe-vpn-connections | Yes | ec2:DescribeVpnConnections | | Amazon VPC | aws-ec2-vpn-connections-summary | NA | ec2:DescribeVpnConnections | | Amazon VPC | aws-ec2-describe-route-tables | Yes | ec2:DescribeRouteTables | | Amazon VPC | aws-vpc-dhcp-options | Yes | ec2:DescribeDhcpOptions | | Amazon VPC | aws-vpc-nat-gateway | Yes | ec2:DescribeNatGateways | | Amazon VPC | aws-vpc-transit-gateway | Yes | ec2:DescribeTransitGateways | | Amazon VPC | aws-vpc-managed-prefix-list | No | ec2:DescribeManagedPrefixLists, ec2:GetManagedPrefixListEntries | | Amazon VPC | aws-vpc-transit-gateway-route-table | Yes | ec2:DescribeTransitGatewayRouteTables, ec2:SearchTransitGatewayRoutes | | Amazon VPC | aws-vpc-transit-gateway-attachment | No | ec2:DescribeTransitGatewayAttachments, ec2:DescribeTransitGatewayVpcAttachments | | Amazon VPC | aws-ec2-vpc-endpoint-service-configuration | No | ec2:DescribeVpcEndpointServiceConfigurations | | Amazon VPC | aws-ec2-client-vpn-endpoint | No | ec2:DescribeClientVpnEndpoints | | Amazon VPC | aws-ec2-vpc-endpoint-service-permission | No | ec2:DescribeVpcEndpointServicePermissions | | Amazon VPC | aws-ec2-customer-gateway | No | ec2:DescribeCustomerGateways | | Amazon VPC | aws-ec2-traffic-mirroring | No | ec2:DescribeTrafficMirrorSessions | | Amazon Route53 | | | | | Amazon Route53 | aws-route53-list-hosted-zones | Yes | route53:ListHostedZones route53:ListResourceRecordSets route53:GetDNSSEC | | Amazon Route53 | aws-route53-domain | No |

route53domains:ListDomains
route53domains:ListTagsForDomain
route53domains:GetDomainDetail

| | Amazon Route53 | aws-route53-query-logging-config | No | route53:ListQueryLoggingConfigs | | Amazon Route53 | aws-route53-health-check | No |

route53:ListHealthChecks
route53:GetHealthCheck
route53:ListTagsForResource

| | AWS Lambda | | | | | AWS Lambda | aws-lambda-list-functions | No | lambda:ListFunctions lambda:ListTags lambda:GetPolicy lambda:GetFunctionUrlConfig | | AWS Lambda | aws-lambda-get-region-summary | No | none | | AWS Lambda | aws-lambda-layer-version | No | lambda:ListLayers lambda:ListLayerVersions lambda:GetLayerVersionPolicy | | AWS Lambda | aws-lambda-code-signing-config | No | lambda:ListCodeSigningConfigs | | AWS Lambda | aws-lambda-get-layer-version | No |

lambda:ListLayers
lambda:ListLayerVersions
lambda:GetLayerVersion

| | AWS Lambda | aws-lambda-event-source-mapping | No |

lambda:ListEventSourceMappings
lambda:GetEventSourceMapping

| | AWS Lambda | aws-lambda-runtime-management-config | No |

lambda:ListFunctions
lambda:GetRuntimeManagementConfig

| | AWS Lambda | aws-lambda-function-event-invoke-config | No |

lambda:ListFunctions
lambda:GetFunctionEventInvokeConfig

| | AWS Lambda | aws-lambda-versions-by-function | No |

lambda:ListFunctions
lambda:ListVersionsByFunction

| | AWS Lambda | aws-lambda-function-concurrency | No |

lambda:ListFunctions
lambda:GetFunctionConcurrency

| | Amazon RDS | | | | | Amazon RDS | aws-rds-describe-db-instances\* | Yes | rds:DescribeDBInstances rds:ListTagsForResource | | Amazon RDS | aws-rds-describe-db-snapshots | Yes | rds:DescribeDBSnapshots rds:DescribeDBSnapshotAttributes | | Amazon RDS | aws-rds-describe-event-subscriptions | Yes | rds:DescribeEventSubscriptions | | Amazon RDS | aws-rds-describe-db-parameter-groups\* | No | rds:DescribeDBParameterGroups rds:DescribeDBParameters listTagsForResource | | Amazon RDS | aws-rds-db-cluster-snapshots | Yes | rds:DescribeDBClusterSnapshots rds:DescribeDBClusterSnapshotAttributes | | Amazon RDS | aws-rds-db-cluster | Yes | rds:DescribeDBClusters | | Amazon RDS | aws-rds-option-group | No |

rds:ListTagsForResource
rds:DescribeOptionGroups

| | Amazon RDS | aws-rds-db-cluster-parameter-group | Yes |

rds:DescribeDBClusterParameters
rds:DescribeDBClusterParameterGroups
rds:ListTagsForResource

| | Amazon RDS | aws-rds-db-proxy-target | No |

rds:DescribeDBProxyTargets
rds:DescribeDBProxyTargetGroups
rds:DescribeDBProxies

| | Amazon RDS | aws-rds-db-proxy | No | rds:DescribeDBProxies | | Amazon RDS | aws-rds-db-instance-automated-backup | No | rds:DescribeDBInstanceAutomatedBackups | | Amazon RDS | aws-rds-db-subnet-group | |

rds:ListTagsForResource

rds:DescribeDBSubnetGroups

| | AWS IAM | | | | | AWS IAM | aws-iam-list-access-keys | No | iam:ListAccessKeys | | AWS IAM | aws-iam-get-account-summary | No | iam:GetAccountSummary | | AWS IAM | aws-iam-get-credential-report | No | iam:GenerateCredentialReport iam:GetCredentialReport | | AWS IAM | aws-iam-list-mfa-devices | No | iam:ListMFADevices | | AWS IAM | aws-iam-list-virtual-mfa-devices | No | iam:ListVirtualMFADevices | | AWS IAM | aws-iam-get-account-password-policy | No | iam:GetAccountPasswordPolicy | | AWS IAM | aws-iam-get-policy-version | No | iam:ListPolicies, iam:GetPolicyVersion iam:ListEntitiesForPolicy | | AWS IAM | aws-iam-list-users | No | iam:ListUsers, iam:ListGroupsForUser iam:ListUserTags | | AWS IAM | aws-iam-list-user-policies | No | iam:ListUserPolicies | | AWS IAM | aws-iam-list-attached-user-policies | No | iam:ListAttachedUserPolicies | | AWS IAM | aws-iam-list-roles | No | iam:ListRoles, iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:ListInstanceProfilesForRole iam:ListRoleTags | | AWS IAM | aws-iam-list-server-certificates | No | iam:ListServerCertificates | | AWS IAM | aws-iam-list-ssh-public-keys | No | iam:ListSSHPublicKeys | | AWS IAM | aws-iam-list-groups | No | iam:ListGroups, iam:ListAttachedGroupPolicies, iam:ListGroupPolicies, iam:GetGroupPolicy | | AWS IAM | aws-iam-saml-provider | No | iam:ListSAMLProviders, iam:GetSAMLProvider | | AWS IAM | aws-iam-service-last-accessed-details | No | iam:GenerateServiceLastAccessedDetails, iam:GetServiceLastAccessedDetails | | AWS IAM | aws-iam-oidc-provider | No |

iam:ListOpenIDConnectProviders
iam:GetOpenIDConnectProvider

| | AWS IAM | aws-iam-service-specific-credential | No |

iam:ListUsers
iam:ListServiceSpecificCredentials

| | AWS IAM | aws-iam-instance-profile | No |

iam:ListInstanceProfiles
iam:GetInstanceProfile

| | Amazon S3 | | | | | Amazon S3 | aws-s3api-get-bucket-acl | Yes |

s3:ListBuckets, s3:GetS3AccountOwner, s3:GetBucketEncryption, s3:GetBucketLocation, s3:GetBucketAcl, s3:GetBucketPolicy, s3:GetBucketPolicyStatus, s3:GetBucketVersioningConfiguration, s3:GetBucketWebsiteConfiguration, s3:GetBucketLoggingConfiguration, s3:GetBucketTaggingConfiguration, s3:GetPublicAccessBlock, s3:GetBucketLifecycleConfiguration, s3:GetRegionName, s3:GetReplicationConfiguration
s3:GetBucketCORS,s3:GetBucketObjectLockConfiguration,
s3:GetAccelerateConfiguration,s3:GetAnalyticsConfiguration,s3:GetBucketNotification

| | Amazon S3 | aws-s3control-public-access-block | No | s3:GetPublicAccessBlock | | Amazon S3 | aws-s3-access-point | No | s3:ListBuckets, s3:GetRegionName, s3:GetAccessPoint, s3:GetAccessPointPolicyStatus, s3:GetAccessPointPolicy | | Amazon S3 | aws-s3-batch-operation | No |

s3:DescribeJob
s3:ListJobs
s3:GetJobTagging

| | Amazon S3 | aws-s3-multi-region-access-point | No | s3:ListMultiRegionAccessPoints | | Amazon S3 | aws-s3-storage-lens-configuration | No | s3:ListStorageLensConfigurations | | Amazon Redshift | | | | | Amazon Redshift | aws-redshift-describe-clusters | No | redshift:DescribeClusters, redshift:DescribeLoggingStatus, redshift:DescribeClusterParameters | | Amazon Redshift | aws-redshift-serverless-workgroup | No | redshift-serverless:ListWorkgroups | | Amazon Redshift | aws-redshift-cluster-subnet-group | No | redshift:DescribeClusterSubnetGroups | | Amazon Redshift | aws-redshift-serverless-snapshot | No |

redshift-serverless:ListSnapshots

redshift-serverless:ListTagsForResource

| | Amazon Redshift | aws-redshift-serverless-namespace | No |

redshift-serverless:ListNamespaces

redshift-serverless:ListTagsForResource

| | Amazon Redshift | aws-redshift-serverless-endpoint-access | No | redshift-serverless:ListEndpointAccess | | Amazon Redshift | aws-redshift-endpoint-access | | redshift:DescribeEndpointAccess | | Amazon RAM | | | | | Amazon RAM | aws-ram-resource-share | No | ram:GetResourceShares | | Amazon RAM | aws-ram-principal | No | ram:ListPrincipals | | Amazon RAM | aws-ram-resource | No | ram:ListResources | | AWS KMS | | | | | AWS KMS | aws-kms-get-key-rotation-status | Yes | kms:ListAliases, kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus, kms:ListKeyPolicies, kms:GetKeyPolicy, kms:ListResourceTags | | AWS KMS | aws-kms-grant | No |

kms:ListKeys
kms:ListGrants

| | AWS CloudTrail | | | | | AWS CloudTrail | aws-cloudtrail-describe-trails | Yes | cloudtrail:DescribeTrails, cloudtrail:ListTags | | AWS CloudTrail | aws-cloudtrail-get-trail-status | Yes | cloudtrail:GetTrailStatus | | AWS CloudTrail | aws-cloudtrail-get-event-selectors | Yes | cloudtrail:GetEventSelectors | | Amazon CloudWatch | | | | | Amazon CloudWatch | aws-cloudwatch-describe-alarms | Yes | cloudwatch:describeAlarms, cloudwatch:ListTagsForResource | | Amazon CloudWatch | aws-logs-describe-metric-filters | Yes | logs:DescribeMetricFilters | | Amazon CloudWatch | aws-cloudwatch-log-group | Yes | logs:DescribeLogGroups, logs:ListTagsLogGroup, logs:DescribeSubscriptionFilters | | Amazon CloudWatch | aws-cloudwatch-insight-rule | No |

cloudwatch:DescribeInsightRules
cloudwatch:ListTagsForResource

| | Amazon DynamoDB | | | | | Amazon DynamoDB | aws-dynamodb-describe-table | Yes |

dynamodb:ListTables
dynamodb:DescribeTable
dynamodb:ListTagsOfResource
dynamodb:DescribeTimeToLive
dynamodb:DescribeContinuousBackups
dynamodb:GetResourcePolicy

| | Amazon DynamoDB | aws-dynamo-db-backup | No |

sso:ListInstances
sso:ListApplications
sso:ListApplicationAssignments

| | Amazon DynamoDB | aws-dynamo-db-global-table | No |

dynamodb:ListGlobalTables
dynamodb:DescribeGlobalTable

| | AWS Config | | | | | AWS Config | aws-configservice-describe-configuration-recorders | Yes | config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus | | AWS Config | aws-describe-delivery-channels | No | config:DescribeDeliveryChannels | | AWS Config | aws-configservice-config-rules | No | config:DescribeConfigRules | | AWS Config | aws-configservice-resource-compliance-details | No | config:GetComplianceDetailsByConfigRule | | AWS Config | aws-configservice-aggregator | No | config:DescribeConfigurationAggregators | | AWS Config | aws-configservice-aggregator-authorization | Yes | config:DescribeAggregationAuthorizations | | Amazon Elasticsearch Service | | | | | Amazon Elasticsearch Service | aws-es-describe-elasticsearch-domain | Yes | es:ListDomainNames, es:DescribeElasticsearchDomains | | Amazon Elasticsearch Service | aws-es-security-config | Yes | aoss:ListSecurityConfigs | | Amazon Elasticsearch Service | aws-es-batch-get-collection | Yes |

aoss:ListCollections
aoss:BatchGetCollection
aoss:ListTagsForResource

| | Amazon Elasticsearch Service | aws-es-serverless-access-policy | Yes |

aoss:ListAccessPolicies
aoss:GetAccessPolicy

| | Amazon Elasticsearch Service | aws-es-serverless-security-policy | Yes |

aoss:ListSecurityPolicies
aoss:GetSecurityPolicy

| | Amazon WorkSpaces | | | | | Amazon WorkSpaces | aws-describe-workspaces | No | workspace:DescribeWorkspaces, workspace:DescribeTags | | Amazon WorkSpaces | aws-describe-workspace-directories | No | workspace:DescribeWorkspaceDirectories, workspace:DescribeTags | | Amazon WorkSpaces | aws-workspace-bundle | No |

workspaces:DescribeTags
workspaces:DescribeWorkspaceBundles

| | Amazon WorkSpaces | aws-workspace-ip-group | No |

workspaces:DescribeTags
workspaces:DescribeIpGroups

| | Amazon CloudFront | | | | | Amazon CloudFront | aws-cloudfront-list-distributions | No | cloudfront:ListDistributions, cloudfront:GetDistributionConfig, cloudfront:ListTagsForResource | | Amazon CloudFront | aws-cloudfront-origin-access-control | No | cloudfront:ListOriginAccessControls | | Amazon CloudFront | aws-cloudfront-response-headers-policy | No |

cloudfront:ListResponseHeadersPolicies
cloudfront:GetResponseHeadersPolicy

| | Amazon API Gateway | | | | | Amazon API Gateway | aws-apigateway-get-rest-apis | No | apigateway:GET | | Amazon API Gateway | aws-apigateway-get-stages | Yes | apigateway:GET | | Amazon API Gateway | aws-apigateway-domain-name | No | apigateway:GET | | Amazon API Gateway | aws-apigateway-base-path-mapping | No | apigateway:GET | | Amazon API Gateway | aws-apigateway-method | Yes | apigateway:GET | | Amazon API Gateway | aws-apigatewayv2-api | No | apigateway:GET | | Amazon API Gateway | aws-api-gateway-authorizer | No | apigateway:GET | | Amazon API Gateway | aws-apigatewayv2-stage | No | apigateway:GET | | Amazon API Gateway | aws-apigatewayv2-route | No | apigateway:GET | | Amazon API Gateway | aws-apigateway-client-certificate | No | apigateway:GetClientCertificates | | Amazon API Gateway | aws-apigatewayv2-authorizer | No | apigateway:GET | | Amazon API Gateway | aws-apigatewayv2-domain-name | No | apigateway:GET | | Amazon API Gateway | aws-apigatewayv2-integration | No | apigateway:GET | | Amazon API Gateway | aws-apigateway-usage-plan | No | apigateway:GET | | Amazon EFS | | | | | Amazon EFS | aws-describe-mount-targets | Yes | elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeMountTargets, elasticfilesystem:DescribeMountTargetSecurityGroups, elasticfilesystem:DescribeTags, elasticfilesysttem:DescribeFileSystemPolicy, elasticfilesystem:DescribeBackupPolicy | | Amazon EFS | aws-efs-access-point | No | elasticfilesystem:DescribeAccessPoints | | Amazon EMR | | | | | Amazon EMR | aws-emr-describe-cluster | No | elasticmapreduce:ListClusters, elasticmapreduce:DescribeCluster | | Amazon EMR | aws-emr-security-configuration | Yes | elasticmapreduce:ListSecurityConfigurations, elasticmapreduce:DescribeSecurityConfiguration | | Amazon EMR | aws-emr-public-access-block | No | elasticmapreduce:GetBlockPublicAccessConfiguration | | Amazon EMR | aws-emr-instance | No | TODO: add permissions | | Amazon EMR | aws-emr-studio | No |

elasticmapreduce:ListStudios
elasticmapreduce:DescribeStudio

| | Amazon EMR | aws-emr-serverless-application | No |

emr-serverless:ListApplications
emr-serverless:GetApplication

| | AWS Certificate Manager | | | | | AWS Certificate Manager | aws-acm-describe-certificate | Yes | acm:ListCertificates, acm:DescribeCertificate, acm:ListTagsForCertificate | | AWS Secrets Manager | | | | | AWS Secrets Manager | aws-secretsmanager-describe-secret | Yes |

secretsmanager:ListSecrets secretsmanager:GetResourcePolicy
secretsmanager:DescribeSecret

| | AWS Systems Manager | | | | | AWS Systems Manager | aws-ssm-parameter | Yes |

ssm:DescribeParameters,
ssm:ListTagsForResource

| | AWS Systems Manager | aws-ssm-document | No |

ssm:GetDocument,
ssm:ListDocuments,
ssm:DescribeDocument,
ssm:DescribeDocumentPermission

| | AWS Systems Manager | aws-ssm-inventory-instance-information | No |

ssm:DescribeInstanceInformation,
ssm:GetInventory

| | AWS Systems Manager | aws-ssm-association | No |

ssm:ListAssociations
ssm:DescribeAssociation

| | AWS Systems Manager | aws-ssm-resource-compliance-summary | No | ssm:ListResourceComplianceSummaries | | AWS Systems Manager | aws-ssm-custom-inventory-entry | No |

ssm:GetInventory
ssm:GetInventorySchema
ssm:ListInventoryEntries

| | AWS Systems Manager | aws-ssm-activation | No | ssm:DescribeActivations | | AWS Systems Manager | aws-ssm-service-setting | No | ssm:GetServiceSetting | | AWS Systems Manager | aws-ssm-session | No | ssm:DescribeSessions | | AWS Systems Manager | aws-ssm-patch-baseline | No |

ssm:DescribePatchBaselines
ssm:GetPatchBaseline

| | AWS Systems Manager | aws-ssm-resource-data-sync | No | ssm:ListResourceDataSync | | Amazon ECS | | | | | Amazon ECS | aws-ecs-describe-task-definition | No | ecs:DescribeTaskDefinition, ecs:ListClusters, ecs:ListTasks, ecs:DescribeTasks, ecs:ListTagsForResource | | Amazon ECS | aws-ecs-service | Yes | ecs:DescribeServices | | Amazon ECS | aws-ecs-cluster | Yes | ecs:DescribeClusters, ecs:ListTagsForResource | | Amazon ECS | aws-ecs-container-instance | Yes | ecs:ListContainerInstances ecs:DescribeContainerInstances | | Amazon ECS | aws-ecs-capacity-provider | Yes | ecs:DescribeCapacityProviders | | Amazon ECR | | | | | Amazon ECR | aws-ecr-get-repository-policy | Yes | ecr:DescribeRepositories ecr:GetRepositoryPolicy ecr:GetLifecyclePolicy | | Amazon ECR | aws-ecr-image | No | ecr:DescribeImages | | Amazon ECR | aws-ecr-registry-scanning-configuration | No | ecr:GetRegistryScanningConfiguration | | Amazon ECR | aws-ecr-registry | No |

ecr:GetRegistryPolicy
ecr:DescribeRegistry
ecr:DescribePullThroughCacheRules

| | Amazon ECR | aws-ecr-public-registry | No |

ecr-public:DescribeRegistries
ecr-public:GetRegistryCatalogData

| | Amazon ECR Public | | | | | Amazon ECR Public | aws-ecr-public-repositories\* | No |

ecr-public:DescribeRepositories,
ecr-public:GetRepositoryCatalogData,
ecr-public:GetRepositoryPolicy,
ecr-public:ListTagsForResource

| | Amazon EKS | | | | | Amazon EKS | aws-eks-describe-cluster | No | eks:ListClusters, eks:DescribeCluster, eks:ListTagsForResource | | Amazon EKS | aws-eks-fargate-profile | No | eks:ListFargateProfiles, eks:DescribeFargateProfile | | Amazon EKS | aws-eks-node-group | No | eks:ListClusters, eks:ListNodegroups, eks:DescribeNodegroup | | Amazon SQS | | | | | Amazon SQS | aws-sqs-get-queue-attributes | Yes | sqs:ListQueues, sqs:GetQueueAttributes | | Amazon SQS | aws-sqs-message-move-task | No |

sqs:ListQueues
sqs:ListMessageMoveTasks

| | Amazon SNS | | | | | Amazon SNS | aws-sns-get-topic-attributes | Yes | sns:ListTopics, sns:GetTopicAttributes | | Amazon SNS | aws-sns-get-subscription-attributes | No | sns:ListSubscriptions \ | | Amazon SNS | aws-sns-platform-application | No | sns:ListPlatformApplications | | Amazon SNS | aws-sns-data-protection-policy | No |

sns:ListTopics
sns:GetDataProtectionPolicy

| | Amazon SNS | aws-sns-subscriptions-by-topic | No |

sns:ListTopics
sns:ListSubscriptionsByTopic

| | Amazon S3 Glacier | | | | | Amazon S3 Glacier | aws-glacier-get-vault-access-policy | No | glacier:ListVaults, glacier:GetVaultAccessPolicy, glacier:ListTagsForVault, | | Amazon S3 Glacier | aws-glacier-get-vault-lock | No | glacier:GetVaultLock | | Amazon S3 Glacier | aws-glacier-vault | No | glacier:ListVaults, glacier:ListTagsForVault, | | AWS Auto Scaling | | | | | AWS Auto Scaling | aws-describe-auto-scaling-groups | Yes | autoscaling:DescribeAutoScalingGroups | | AWS Auto Scaling | aws-ec2-autoscaling-launch-configuration | Yes | autoscaling:DescribeLaunchConfigurations | | AWS CloudFormation | | | | | AWS CloudFormation | aws-cloudformation-describe-stacks | No | cloudformation:DescribeStacks, cloudformation:DescribeStackResources, cloudformation:GetStackPolicy, cloudformation:GetTemplate, cloudformation:ListStacks | | Amazon ElastiCache | | | | | Amazon ElastiCache | aws-elasticache-describe-replication-groups | Yes | elasticache:DescribeReplicationGroups | | Amazon ElastiCache | aws-elasticache-reserved-cache-nodes | No | elasticache:DescribeReservedCacheNodes | | Amazon ElastiCache | aws-cache-engine-versions | No | elasticache:DescribeCacheEngineVersions | | Amazon ElastiCache | aws-elasticache-subnet-groups | No | elasticache:DescribeCacheSubnetGroups | | Amazon ElastiCache | aws-elasticache-cache-clusters | Yes | elasticache:DescribeCacheClusters | | Amazon ElastiCache | aws-elasticache-snapshots | No | elasticache:DescribeSnapshots | | Amazon ElastiCache | aws-elasticache-user | No | elasticache:DescribeUsers | | Amazon ElastiCache | aws-elasticache-serverless-cache | No |

elasticache:DescribeServerlessCaches
elasticache:ListTagsForResource

| | Amazon Kinesis | | | | | Amazon Kinesis | aws-kinesis-list-streams | Yes | kinesis:ListStreams, kinesis:DescribeStream, kinesis:ListTagsForStream | | Amazon Elastic Load Balancing | | | | | Amazon Elastic Load Balancing | aws-elb-describe-load-balancers\* | Yes | elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeTags | | Amazon Elastic Load Balancing | aws-elbv2-describe-load-balancers\* | Yes | elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth, elasticloadbalancing:DescribeTags, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeListeners | | Amazon Elastic Load Balancing | aws-describe-ssl-policies | No | elasticloadbalancing:DescribeSSLPolicies | | Amazon Elastic Load Balancing | aws-elbv2-target-group\* | Yes | elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTags | | Amazon Elastic Load Balancing | aws-elbv2-target-health | No | elasticloadbalancing:DescribeTargetHealth | | Amazon Cognito | | | | | Amazon Cognito | aws-cognito-identity-pool | No | cognito:ListIdentityPools, cognito:ListTagsForResource, cognito:DescribeIdentityPool | | Amazon Cognito | aws-cognito-user-pool | No | cognito:ListUserPools, cognito:ListTagsForResource, cognito-idp:DescribeUserPool | | Amazon Cognito | aws-cognito-sync-pool-usage | No | cognito-sync:ListIdentityPoolUsage | | Amazon Cognito | aws-cognito-user-pool-client | No |

cognito-idp:ListUserPools
cognito-idp:ListUserPoolClients
cognito-idp:DescribeUserPoolClient

| | Amazon Cognito | aws-cognito-user | No |

cognito-idp:ListUserPools
cognito-idp:ListUsers

| | Amazon Cognito | aws-cognito-user-pool-group | No |

cognito-idp:ListUserPools
cognito-idp:ListGroups
cognito-idp:GetGroup

| | Amazon Cognito | aws-cognito-identity-pool-role | No |

cognito-identity:ListIdentityPools
cognito-identity:GetIdentityPoolRoles

| | Amazon Cognito | aws-cognito-identity-provider | No |

cognito-idp:ListUserPools
cognito-idp:ListIdentityProviders
cognito-idp:DescribeIdentityProvider

| | Amazon GuardDuty | | | | | Amazon GuardDuty | aws-guardduty-detector | No | guardduty:ListDetectors, guardduty:GetDetector | | Amazon GuardDuty | aws-guardduty-organization-configuration | No |

guardduty:ListDetectors
guardduty:DescribeOrganizationConfiguration

| | Amazon GuardDuty | aws-guardduty-threat-ip-list | No |

guardduty:ListDetectors
guardduty:ListThreatIntelSets
guardduty:GetThreatIntelSet

| | Amazon GuardDuty | aws-guardduty-trusted-ip-list | No |

guardduty:ListDetectors
guardduty:ListIPSets
guardduty:GetIPSet

| | Amazon GuardDuty | aws-guardduty-member-account-admin-info | No |

guardduty:ListDetectors
guardduty:GetAdministratorAccount

| | Amazon GuardDuty | aws-guardduty-publishing-destination | |

guardduty:ListDetectors
guardduty:ListPublishingDestinations
guardduty:DescribePublishingDestination

| | AWS Elastic Beanstalk | | | | | AWS Elastic Beanstalk | aws-elasticbeanstalk-environment | No | elasticbeanstalk:DescribeEnvironments, elasticbeanstalk:DescribeEnvironmentResources, elasticbeanstalk:ListTagsForResource | | AWS Elastic Beanstalk | aws-elasticbeanstalk-configuration-settings | No | elasticbeanstalk:DescribeConfigurationSettings, s3:GetObject (only for "Resource": "arn:aws:s3:::elasticbeanstalk-\*/\*") | | Amazon MQ | | | | | Amazon MQ | aws-mq-broker | Yes | mq:ListBrokers, mq:DescribeBroker | | Amazon MQ | aws-mq-configuration | Yes | mq:ListConfigurations | | AWS Glue | | | | | AWS Glue | aws-glue-security-configuration | No | glue:GetSecurityConfigurations | | AWS Glue | aws-glue-connection | Yes | glue:GetConnections | | AWS Glue | aws-glue-datacatalog | No | glue:GetDataCatalogEncryptionSettings | | AWS Glue | aws-glue-crawler | No |

glue:GetCrawlers
glue:ListCrawlers

| | AWS Glue | aws-glue-job | No | glue:GetJobs | | AWS Glue | aws-glue-schema | No |

glue:ListSchemas
glue:GetSchema

| | AWS Glue | aws-glue-resource-policy | No | glue:GetResourcePolicies | | AWS Glue | aws-glue-database | No | glue:GetDatabases | | AWS Glue | aws-glue-trigger | No | glue:GetTriggers | | AWS Glue | aws-glue-dev-endpoint | No | glue:GetDevEndpoints | | AWS Glue | aws-glue-blueprint | No |

glue:ListBlueprints
glue:GetBlueprint
glue:GetTags

| | AWS Glue | aws-glue-blueprint-run | No |

glue:GetBlueprintRuns
glue:GetBlueprintRun

| | AWS Glue | aws-glue-ml-transform | No | glue:GetMLTransforms | | AWS WAF | | | | | AWS WAF | aws-waf-v2-web-acl-resource | Yes | wafv2:ListWebACLs, wafv2:ListResourcesForWebACL,wafv2:GetLoggingConfiguration | | AWS WAF | aws-waf-classic-web-acl-resource | Yes | waf-regional:ListWebACLs, waf-regional:ListResourcesForWebACL,waf-regional:GetLoggingConfiguration | | AWS WAF | aws-waf-classic-global-web-acl-resource | Yes | waf:ListWebACLs,waf:GetWebACL, waf:ListTagsForResource, waf:GetLoggingConfiguration | | AWS WAF | aws-waf-v2-global-web-acl-resource | No |

wafv2:ListWebACLs,
wafv2:GetWebACL,
wafv2:GetLoggingConfiguration,
wafv2:ListTagsForResource

| | AWS WAF | aws-waf-v2-rule-group | No | wafv2:ListRuleGroups | | AWS WAF | aws-waf-classic-global-ip-set | No |

waf:ListIPSets
waf:GetIPSet

| | AWS WAF | aws-waf-classic-regional-ip-set | No |

waf-regional:ListIPSets
waf-regional:GetIPSet

| | AWS WAF | aws-waf-v2-global-ip-set | No |

wafv2:ListIPSets
wafv2:GetIPSet

| | AWS WAF | aws-waf-v2-regional-ip-set | No |

wafv2:ListIPSets
wafv2:GetIPSet

| | AWS WAF | aws-waf-v2-global-rule-group | No |

wafv2:ListRuleGroups
wafv2:GetRuleGroup

| | AWS Direct Connect Gateway | | | | | AWS Direct Connect Gateway | aws-direct-connect-gateway | No | directconnect:DescribeDirectConnectGateways | | AWS Direct Connect Gateway | aws-direct-connect-connection | No | directconnect:DescribeConnections | | AWS Direct Connect Gateway | aws-direct-connect-interface | No | directconnect:DescribeVirtualInterfaces | | AWS Organizations | | | | | AWS Organizations | aws-organization | No | organization:DescribeRoot, organization:ListPoliciesforTarget, organization:ListRoots, organization:ListChildren | | AWS Organizations | aws-organizations-root | No | organization:ListRoots,organization:ListPolicy | | AWS Organizations | aws-organizations-ou | No | organization:DescribeChild, organization:ListPoliciesforTarget, organization:ListChildren | | AWS Organizations | aws-organizations-account | No | organization:DescribeChild, organization:ListPoliciesforTarget, organization:ListTagsForResource | | AWS Organizations | aws-organizations-scp | No | organization:DescribePolicy | | AWS Organizations | aws-organizations-tag-policy | No |

organizations:DescribeOrganization
organizations:ListRoots
organizations:ListChildren
organizations:DescribePolicy

| | AWS Organizations | aws-organizations-delegated-services-for-account | No | organizations:ListDelegatedServicesForAccount | | AWS Organizations | aws-organizations-aws-service-access-for-organization | No | organizations:ListAWSServiceAccessForOrganization | | Amazon SageMaker | | | | | Amazon SageMaker | aws-sagemaker-notebook-instance | Yes | sagemaker:ListNotebookInstances, sagemaker:DescribeNotebookInstance, sagemaker:ListTags | | Amazon SageMaker | aws-sagemaker-endpoint | No | sagemaker:DescribeEndpoint, sagemaker:ListEndpoints, sagemaker:ListTags | | Amazon SageMaker | aws-sagemaker-model | No | sagemaker:DescribeModel, sagemaker:ListModels, sagemaker: ListTags | | Amazon SageMaker | aws-sagemaker-endpoint-config | No |

sagemaker:ListEndpointConfigs,
sagemaker:DescribeEndpointConfig,
sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-domain | No | sagemaker:ListDomains, sagemaker:DescribeDomain, sagemaker:ListTags | | Amazon SageMaker | aws-sagemaker-training-job | No |

sagemaker:DescribeTrainingJob
sagemaker:ListTrainingJobs
sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-user-profile | No |

sagemaker:ListUserProfiles
sagemaker:DescribeUserProfile
sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-processing-job | No |

sagemaker:ListProcessingJobs
sagemaker:DescribeProcessingJob

| | Amazon SageMaker | aws-sagemaker-code-repository | No |

sagemaker:ListCodeRepositories
sagemaker:DescribeCodeRepository

| | Amazon SageMaker | aws-sagemaker-labeling-job | No |

sagemaker:ListLabelingJobs
sagemaker:DescribeLabelingJob

| | Amazon SageMaker | aws-sagemaker-notebook-instance-lifecycle-config | No |

sagemaker:ListNotebookInstanceLifecycleConfigs
sagemaker:DescribeNotebookInstanceLifecycleConfig

| | Amazon SageMaker | aws-sagemaker-studio-lifecycle-config | No |

sagemaker:ListStudioLifecycleConfigs
sagemaker:DescribeStudioLifecycleConfig

| | Amazon SageMaker | aws-sagemaker-model-package-group | |

sagemaker:ListModelPackageGroups

sagemaker:DescribeModelPackageGroup

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-image | |

sagemaker:ListImages

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-feature-group | |

sagemaker:ListFeatureGroups

sagemaker:DescribeFeatureGroup

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-app | |

sagemaker:ListApps

sagemaker:DescribeApp

| | Amazon SageMaker | aws-batch-scheduling-policy | |

batch:ListSchedulingPolicies

batch:DescribeSchedulingPolicies

| | Amazon SageMaker | aws-sagemaker-project | |

sagemaker:ListProjects

sagemaker:DescribeProject

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-pipeline | |

sagemaker:ListPipelines

sagemaker:DescribePipeline

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-data-quality-job-definition | |

sagemaker:ListDataQualityJobDefinitions

sagemaker:DescribeDataQualityJobDefinition

sagemaker:ListTags

| | Amazon SageMaker | aws-sagemaker-flow-definition | |

sagemaker:ListFlowDefinitions
sagemaker:DescribeFlowDefinition
sagemaker:ListTags

| | AWS Database Migration Service | | | | | AWS Database Migration Service | aws-dms-replication-instance | No | dms:DescribeReplicationInstances, dms:ListTagsForResource | | AWS Database Migration Service | aws-dms-certificate | Yes | dms:DescribeCertificates, dms:ListTagsForResource | | AWS Database Migration Service | aws-dms-endpoint | Yes | dms:DescribeEndpoints, dms:ListTagsForResource | | AWS Database Migration Service | aws-dms-replication-task | No |

dms:DescribeReplicationTasks
dms:ListTagsForResource

| | AWS Database Migration Service | aws-dms-data-provider | |

dms:DescribeDataProviders
dms:ListTagsForResource

| | AWS Database Migration Service | aws-dms-replication-config | |

dms:DescribeReplicationConfigs
dms:ListTagsForResource

| | AWS Database Migration Service | aws-dms-replication-subnet-group | |

dms:DescribeReplicationSubnetGroups
dms:ListTagsForResource

| | AWS Database Migration Service | aws-dms-instance-profile | |

dms:ListInstanceProfiles
dms:ListTagsForResource

| | Amazon Kinesis Firehose | | | | | Amazon Kinesis Firehose | aws-kinesis-firehose-delivery-stream | Yes | firehose:DescribeDeliveryStream, firehose:ListDeliveryStreams, firehose:ListTagsForDeliveryStream | | AWS CloudSearch | | | | | AWS CloudSearch | aws-cloudsearch-domain | No | cloudsearch:DescribeDomains | | AWS Directory Service | | | | | AWS Directory Service | aws-ds-directory | No | ds:DescribeDirectories, ds:ListTagsForResource | | AWS Directory Service | aws-ds-directory-trust | No | ds:DescribeTrusts | | AWS Directory Service | aws-ds-log-subscription | No | ds:ListLogSubscriptions | | AWS Access Analyzer | | | | | AWS Access Analyzer | aws-access-analyzer | Yes | access-analyzer:ListAnalyzers | | AWS Regions | | | | | AWS Regions | aws-region | No | ec2:DescribeRegions | | AWS Backup | | | | | AWS Backup | aws-backup-vault-access-policy | No | backup:GetBackupVaultAccessPolicy, backup:ListBackupVaults,backup:ListTags | | AWS Backup | aws-backup-backup-plan | No |

backup:ListBackupPlans
backup:GetBackupPlan
backup:ListTags

| | AWS Backup | aws-backup-protected-resources | No | backup:ListProtectedResources | | AWS Backup | aws-backup-backup-selection | No |

backup:GetBackupSelection

backup:ListBackupSelections

| | AWS Backup | aws-backup-report-plan | No |

backup:DescribeReportPlan

backup:ListTags

backup:ListReportPlans

| | AWS Backup | aws-backup-framework | No |

backup:DescribeFramework

backup:ListTags

backup:ListFrameworks

| | AWS Code Build | | | | | AWS Code Build | aws-code-build-project | No |

codebuild:BatchGetProjects
codebuild:ListProjects

| | AWS Code Build | aws-code-build-source-credential | No | codebuild:ListSourceCredentials | | AWS Code Build | aws-code-build-report-group | |

codebuild:BatchGetReportGroups

codebuild:ListReportGroups

| | AWS Transfer Family | | | | | AWS Transfer Family | aws-transfer-family-server | No |

transfer:DescribeServer
transfer:ListServers

| | AWS Transfer Family | aws-transfer-family-access | No |

transfer:ListAccesses
transfer:DescribeAccess

| | AWS Transfer Family | aws-transfer-family-user | No |

transfer:ListUsers
transfer:DescribeUser

| | AWS Transfer Family | aws-transfer-family-security-policy | No |

transfer:DescribeSecurityPolicy
transfer:DescribeServer
transfer:ListServers

| | AWS Service Quotas | | | | | AWS Service Quotas | aws-servicequotas-service-quota | |

servicequotas:ListServiceQuotas
servicequotas:ListTagsForResource

| | AWS Shield | | | | | AWS Shield | aws-shield-advanced-status | No | shield:GetSubscriptionState | | AWS Shield | aws-shield-protections | No | shield:GetSubscriptionState, shield:ListProtections, shield:ListTagsForResource | | AWS Shield | aws-shield-protection-groups | No | shield:GetSubscriptionState, shield:ListProtectionGroups, shield:ListResourcesInProtectionGroup, shield:ListTagsForResource | | AWS Shield | aws-shield-drt-access | No | shield:DescribeDRTAccess | | Amazon MSK | | | | | Amazon MSK | aws-msk-cluster | No | kafka:ListClusters | | Amazon MSK | aws-msk-vpc-connection | No |

kafka:ListVpcConnections
kafka:DescribeVpcConnection

| | Amazon MSK | aws-msk-configuration | No |

kafka:ListConfigurations
kafka:DescribeConfiguration

| | Amazon MSK | aws-msk-clusterV2 | No | kafka:ListClustersV2 | | Amazon Athena | | | | | Amazon Athena | aws-athena-workgroup | No |

athena:ListWorkGroups
athena:GetWorkGroup

| | Amazon Athena | aws-athena-table-metadata | No |

athena:ListDataCatalogs
athena:ListDatabases
athena:ListTableMetadata
glue:GetTables

| | Amazon Athena | aws-athena-capacity-reservation | No |

athena:ListCapacityReservations

athena:GetCapacityReservation

| | Amazon Athena | aws-athena-namedquery | No |

athena:ListWorkGroups

athena:ListNamedQueries

athena:GetNamedQuery

| | Amazon Athena | aws-athena-workgroup | No |

athena:ListWorkGroups

athena:GetWorkGroup

| | Amazon Athena | aws-athena-database | No |

athena:ListDataCatalogs

athena:ListDatabases

athena:GetDatabase

glue:GetDatabase

| | Amazon QuickSight | | | | | Amazon QuickSight | aws-quicksight-datasource | No | quicksight:ListDataSources,quicksight:ListTagsForResource | | Amazon QuickSight | aws-quicksight-dataset | No | quicksight:ListDataSets,quicksight:ListTagsForResource | | Amazon QuickSight | aws-quicksight-account-setting | No | quicksight:DescribeAccountSettings | | Amazon QuickSight | aws-quicksight-ip-restriction | No | quicksight:DescribeIpRestriction | | Amazon QuickSight | aws-quicksight-iam-policy-assignment | No |

quicksight:DescribeIAMPolicyAssignment
quicksight:ListNamespaces
quicksight:ListIAMPolicyAssignments

| | Amazon QuickSight | aws-quicksight-user | No |

quicksight:ListUsers

quicksight:DescribeUser

| | Amazon SES | | | | | Amazon SES | aws-ses-identities | No |

ses:GetIdentityDkimAttributes
ses:GetIdentityPolicies
ses:ListIdentityPolicies
ses:ListIdentities

| | Amazon SES | aws-ses-configuration-set | No |

ses:ListConfigurationSets
ses:DescribeConfigurationSet

| | Amazon SES | aws-ses-receipt-rule-set | No |

ses:ListReceiptRuleSets
ses:DescribeReceiptRuleSet

| | Amazon SES | aws-ses-template | No |

ses:ListTemplates
ses:GetTemplate

| | Amazon FSx | | | | | Amazon FSx | aws-fsx-file-system | No | fsx:DescribeFileSystems | | Amazon FSx | aws-fsx-backup | No | fsx:DescribeBackups | | Amazon DAX | | | | | Amazon DAX | aws-dax-cluster | No |

dax:DescribeClusters,
dax:ListTags

| | Amazon DAX | aws-dax-parameter-group | No | dax:DescribeParameterGroups dax:DescribeParameters | | AWS AppSync | | | | | AWS AppSync | aws-appsync-graphql-api | Yes |

appsync:ListGraphqlApis
appsync:GetGraphqlApi

| | Amazon DocumentDB | | | | | Amazon DocumentDB | aws-docdb-db-cluster-parameter-group | Yes |

rds:DescribeDBClusterParameters
rds:DescribeDBClusterParameterGroups
rds:ListTagsForResource

| | Amazon DocumentDB | aws-docdb-db-cluster | No |

rds:DescribeDBClusters
rds:ListTagsForResource

| | Amazon DocumentDB | aws-docdb-db-instance | No |

rds:DescribeDBInstances
rds:ListTagsForResource

| | Amazon DocumentDB | aws-docdb-db-cluster-snapshot | |

rds:DescribeDBClusterSnapshots
rds:ListTagsForResource

| | Amazon DocumentDB | aws-docdb-subnet-group | |

rds:DescribeDBSubnetGroups
rds:ListTagsForResource

| | Amazon DocumentDB | aws-docdb-db-global-cluster | |

rds:DescribeGlobalClusters
rds:ListTagsForResource

| | AWS Data Pipeline | | | | | AWS Data Pipeline | aws-datapipeline-pipeline | No |

datapipeline:DescribePipelines
datapipeline:GetPipelineDefinition
datapipeline:ListPipelines

| | AWS CodeArtifact | | | | | AWS CodeArtifact | aws-code-artifact-repository | No |

codeartifact:ListRepositories,
codeartifact:DescribeRepository,
codeartifact:GetRepositoryPermissionsPolicy,
codeartifact:ListTagsForResource

| | AWS CodeArtifact | aws-code-artifact-domain | No |

codeartifact:ListDomains,codeartifact:DescribeDomain,codeartifact:GetDomainPermissionsPolicy,
codeartifact:ListTagsForResource

| | AWS Storage Gateway | | | | | AWS Storage Gateway | aws-storage-gateway-fileshare | No |

storagegateway:ListFileShares
storagegateway:DescribeNFSFileShares
storagegateway:DescribeSMBFileShares

| | AWS Storage Gateway | aws-storage-gateway-information | No |

storagegateway:ListGateways
storagegateway:DescribeGatewayInformation storagegateway:DescribeSMBSettings

| | AWS Storage Gateway | aws-storage-gateway-cached-volume | No |

storagegateway:ListVolumes,
storagegateway:DescribeCachediSCSIVolumes

| | AWS Storage Gateway | aws-storage-gateway-tape | No |

storagegateway:ListTapes,
storagegateway:DescribeTapes

| | Amazon Lightsail | | | | | Amazon Lightsail | aws-lightsail-instance | No | lightsail:GetInstances | | Amazon Lightsail | aws-lightsail-storage-bucket | No | lightsail:GetBuckets | | Amazon Lightsail | aws-lightsail-disk | No | lightsail:GetDisks | | Amazon Lightsail | aws-lightsail-container-service | No | lightsail:GetContainerServices | | Amazon Lightsail | aws-lightsail-key-pair | No | lightsail:GetKeyPairs | | Amazon Neptune | | | | | Amazon Neptune | aws-neptune-db-cluster-parameter-group | No |

rds:DescribeDBClusterParameters
rds:DescribeDBClusterParameterGroups
rds:ListTagsForResource

| | Amazon Neptune | aws-neptune-db-cluster | Yes |

rds:DescribeDBClusters
rds:ListTagsForResource

| | Amazon Neptune | aws-neptune-db-instance | No |

rds:DescribeDBInstances
rds:ListTagsForResource

| | Amazon Neptune | aws-neptune-analytics-graph | No |

neptune-graph:ListGraphs
neptune-graph:GetGraph
neptune-graph:ListTagsForResource

| | AWS Q Business | | | | | Amazon Q Business | aws-qbusiness-index | |

qbusiness:ListIndices
qbusiness:GetIndex
qbusiness:ListApplications
qbusiness:GetApplication
qbusiness:ListDataSources
qbusiness:GetDataSource

| | Amazon Q Business | aws-qbusiness-application | |

qbusiness:ListApplications
qbusiness:GetApplication
qbusiness:GetPolicy
qbusiness:GetChatControlsConfiguration
qbusiness:ListTagsForResource

| | AWS XRAY | | | | | AWS XRAY | aws-xray-encryption-config | No | xray:GetEncryptionConfig | | AWS MediaStore | | | | | AWS MediaStore | aws-mediastore-container | No |

mediastore:ListTagsForResource,
mediastore:ListContainers,
mediastore:GetCorsPolicy,
mediastore:GetContainerPolicy

| | Amazon Lex | | | | | Amazon Lex | aws-lex-bot | No |

lex:GetBot
lex:GetBots
lex:GetBotVersions
lex:ListTagsForResource

| | Amazon Lex | aws-lexv2-bot | No |

lex:ListTagsForResource
lex:ListBotVersions
lex:ListBots
lex:DescribeBotVersion
lex:DescribeBot

| | AWS ACM Private Certificate Authority | | | | | AWS ACM Private Certificate Authority | aws-acm-pca-certificate-authority | No |

acm-pca:ListTags
acm-pca:GetPolicy
acm-pca:ListCertificateAuthorities

| | AWS Lake Formation | | | | | AWS Lake Formation | aws-lake-formation-setting | No | lakeformation:GetDataLakeSettings | | AWS Lake Formation | aws-lake-formation-lf-tags | No |

lakeformation:ListLFTags
lakeformation:GetLFTag

| | AWS Lake Formation | aws-lake-formation-resource | No |

lakeformation:DescribeResource
lakeformation:ListResources

| | AWS Lake Formation | aws-lake-formation-permission | No | lakeformation:ListPermissions | | AWS Lake Formation | aws-lake-formation-identity-center-configuration | No |

lakeformation:DescribeLakeFormationIdentityCenterConfiguration
sso:DescribeApplication

| | Amazon Batch | | | | | Amazon Batch | aws-batch-compute-environment | No | batch:DescribeComputeEnvironments | | Amazon Batch | aws-batch-job-definition | No | batch:DescribeJobDefinitions | | Amazon Batch | aws-batch-job-queue | No | batch:DescribeJobQueues | | Amazon Route53 | | | | | Amazon Route53 | aws-route53-profile | No |

route53profiles:ListProfiles
route53profiles:GetProfile
route53profiles:ListTagsForResource

| | Amazon Route53 | aws-route53-domains-operation | No | route53domains:ListOperations | | Amazon Route53 Resolver | | | | | Amazon Route53 Resolver | aws-route53resolver-query-logging-config | No |

route53resolver:ListResolverQueryLogConfigs
route53resolver:ListTagsForResource

| | Amazon Route53 Resolver | aws-route53resolver-query-logging-config-association | No | route53resolver:ListResolverQueryLogConfigAssociations | | Amazon Route53 Resolver | aws-route53resolver-resolver-endpoint | No |

route53resolver:ListResolverEndpoints
route53resolver:ListTagsForResource
route53resolver:ListResolverEndpointIpAddresses

| | Amazon Managed Workflows for Apache Airflow | | | | | Amazon Managed Workflows for Apache Airflow | aws-mwaa-environment | No |

airflow:GetEnvironment
airflow:ListEnvironments

| | Amazon Connect | | | | | Amazon Connect | aws-connect-instance | No |

connect:ListInstances
connect:ListInstanceStorageConfigs
connect:ListInstanceAttributes

| | Amazon Connect | aws-connect-instance-user | No |

connect:ListUsers
connect:DescribeUser
connect:ListInstances

| | Amazon Connect | aws-connect-instance-security-profile | No |

connect:ListSecurityProfiles
connect:DescribeSecurityProfile
connect:ListInstances

| | Amazon Connect | aws-connect-outbound-campaign | No |

connect-campaigns:ListCampaigns
connect-campaigns:DescribeCampaign

| | Amazon Pinpoint | | | | | Amazon Pinpoint | aws-pinpoint-sms-channel | No |

mobiletargeting:GetSmsChannel
mobiletargeting:GetApps

| | Amazon Pinpoint | aws-pinpoint-email-channel | No |

mobiletargeting:GetEmailChannel
mobiletargeting:GetApps

| | Amazon Pinpoint | aws-pinpoint-apns-sandbox-channel | |

mobiletargeting:GetApnsSandboxChannel
mobiletargeting:GetApps

| | Amazon Pinpoint | aws-pinpoint-gcm-channel | |

mobiletargeting:GetGcmChannel
mobiletargeting:GetApps

| | Amazon Pinpoint | aws-pinpoint-app | | mobiletargeting:GetApps | | Amazon Pinpoint | aws-pinpoint-apns-channel | |

mobiletargeting:GetApnsChannel
mobiletargeting:GetApps

| | Amazon EventBridge | | | | | Amazon EventBridge | aws-events-rule | No |

events:ListRules
events:ListTargetsByRule
events:ListTagsForResource

| | Amazon EventBridge | aws-events-eventbus | No |

events:ListTagsForResource
events:ListEventBuses
events:DescribeEventBus

| | Amazon EventBridge | aws-events-api-destination | No | events:ListApiDestinations | | Amazon EventBridge | aws-events-connection | No |

events:ListConnections
events:DescribeConnection

| | Amazon EventBridge | aws-events-archive | No |

events:ListArchives
events:DescribeArchive

| | Amazon EventBridge | aws-event-bridge-global-endpoint | No | events:ListEndpoints | | Amazon AppStream 2.0 | | | | | Amazon AppStream 2.0 | aws-app-stream-fleet | No |

appstream:DescribeImages
appstream:DescribeFleets
appstream:ListTagsForResource

| | Amazon AppStream 2.0 | aws-app-stream-stack | No |

appstream:DescribeStacks
appstream:ListTagsForResource

| | Amazon AppStream 2.0 | aws-app-stream-usage-report-subscription | No | appstream:DescribeUsageReportSubscriptions | | Amazon AppStream 2.0 | aws-app-stream-image-builder | No | appstream:DescribeImageBuilders | | Amazon AppStream 2.0 | aws-app-stream-image | No | appstream:DescribeImages | | Amazon AppStream 2.0 | aws-app-stream-app-block-builder | No |

appstream:DescribeAppBlockBuilders
appstream:ListTagsForResource

| | Amazon AppRunner | | | | | Amazon AppRunner | aws-apprunner-service | No |

apprunner:ListServices
apprunner:DescribeCustomDomains
apprunner:DescribeService
apprunner:ListTagsForResource

| | Amazon AppRunner | aws-apprunner-auto-scaling-configuration | No |

apprunner:DescribeAutoScalingConfiguration
apprunner:ListAutoScalingConfigurations
apprunner:ListTagsForResource

| | Amazon IoT | | | | | Amazon IoT | aws-iot-domain-configuration | No |

iot:DescribeDomainConfiguration
iot:ListDomainConfigurations
iot:ListTagsForResource

| | Amazon IoT | aws-iot-account-audit-configuration | No | iot:DescribeAccountAuditConfiguration | | Amazon Grafana | | | | | Amazon Grafana | aws-grafana-workspace | No |

grafana:DescribeWorkspace
grafana:DescribeWorkspaceAuthentication
grafana:ListWorkspaces

| | Amazon Transcribe | | | | | Amazon Transcribe | aws-transcribe-language-model | No |

transcribe:ListLanguageModels
transcribe:ListTagsForResource

| | Amazon Transcribe | aws-transcribe-transcription-job | No |

transcribe:ListTranscriptionJobs
transcribe:GetTranscriptionJob

| | Amazon AppFlow | | | | | Amazon AppFlow | aws-appflow-flow | No |

appflow:DescribeFlow
appflow:ListFlows

| | Amazon App Mesh | | | | | Amazon App Mesh | aws-appmesh-mesh | No |

appmesh:ListMeshes
appmesh:DescribeMesh
appmesh:ListTagsForResource

| | Amazon App Mesh | aws-appmesh-virtual-gateway | No |

appmesh:ListVirtualGateways
appmesh:DescribeVirtualGateway
appmesh:ListMeshes
appmesh:ListTagsForResource

| | AWS Step Functions | | | | | AWS Step Functions | aws-step-functions-statemachine | No |

states:ListStateMachines
states:DescribeStateMachine
states:ListTagsForResource

| | AWS Step Functions | aws-step-functions-activity | No | states:ListActivities | | AWS Global Accelerator | | | | | AWS Global Accelerator | aws-global-accelerator-accelerator | No |

globalaccelerator:ListTagsForResource
globalaccelerator:ListAccelerators
globalaccelerator:DescribeAcceleratorAttributes

| | AWS Global Accelerator | aws-global-accelerator-endpoint-group | No |

globalaccelerator:ListAccelerators
globalaccelerator:ListListeners
globalaccelerator:DescribeListener
globalaccelerator:ListEndpointGroups
globalaccelerator:DescribeEndpointGroup

| | AWS Global Accelerator | aws-global-accelerator-listener | No |

globalaccelerator:ListAccelerators
globalaccelerator:ListListeners
globalaccelerator:DescribeListener

| | AWS Amplify | | | | | AWS Amplify | aws-amplify-app | No | amplify:ListApps | | Amazon Translate | | | | | Amazon Translate | aws-translate-terminology | No |

translate:ListTerminologies
translate:GetTerminology

| | Amazon Translate | aws-translate-text-translation-job | No |

translate:ListTextTranslationJobs
translate:DescribeTextTranslationJob

| | Amazon QLDB | | | | | Amazon QLDB | aws-qldb-ledger | No |

qldb:ListLedgers
qldb:DescribeLedger
qldb:ListTagsForResource

| | AWS DataSync | | | | | AWS DataSync | aws-datasync-location | No |

datasync:DescribeLocationEfs
datasync:ListLocations
datasync:DescribeLocationSmb
datasync:DescribeLocationFsxOpenZfs
datasync:DescribeLocationFsxWindows
datasync:DescribeLocationS3
datasync:DescribeLocationObjectStorage
datasync:DescribeLocationFsxOntap
datasync:ListTagsForResource
datasync:ListTasks
datasync:DescribeLocationHdfs
datasync:DescribeLocationFsxLustre
datasync:DescribeLocationNfs

| | AWS DataSync | aws-datasync-task | No |

datasync:ListTasks
datasync:DescribeTask
datasync:ListTagsForResource

| | AWS DataSync | aws-datasync-task-execution | No |

datasync:ListTaskExecutions
datasync:DescribeTaskExecution
datasync:ListTagsForResource

| | AWS DataSync | aws-datasync-agent | No |

datasync:ListAgents
datasync:DescribeAgent

| | Amazon Macie | | | | | Amazon Macie | aws-macie2-session | No |

macie2:GetClassificationExportConfiguration
macie2:GetMacieSession
macie2:GetRevealConfiguration
macie2:GetFindingsPublicationConfiguration

| | Amazon Macie | aws-macie2-administrator-account | No | macie2:ListOrganizationAdminAccounts | | Amazon Macie | aws-macie2-classification-job | No | macie2:ListClassificationJobs | | Amazon MemoryDB | | | | | Amazon MemoryDB | aws-memorydb-cluster | No |

memorydb:DescribeClusters
memorydb:ListTags

| | Amazon MemoryDB | aws-memorydb-parameter-group | No |

memorydb:DescribeParameters
memorydb:DescribeParameterGroups
memorydb:ListTags

| | Amazon MemoryDB | aws-memorydb-snapshot | No |

memorydb:DescribeSnapshots
memorydb:ListTags

| | Amazon MemoryDB | aws-memorydb-subnet-group | No |

memorydb:DescribeSubnetGroups
memorydb:ListTags

| | Amazon Kinesis Data Analytics | | | | | Amazon Kinesis Data Analytics | aws-kinesisanalyticsv2-application | No |

kinesisanalytics:ListTagsForResource
kinesisanalytics:ListApplications
kinesisanalytics:DescribeApplication

| | AWS Account Management | | | | | AWS Account Management | aws-account-management-alternate-contact | No | account:GetAlternateContact | | AWS Account Management | aws-account-contact-information | No | account:GetContactInformation | | Amazon DevOps Guru | | | | | Amazon DevOps Guru | aws-devops-guru-service-integration | No | devops-guru:DescribeServiceIntegration | | AWS Cloud9 | | | | | AWS Cloud9 | aws-cloud9-environment | No |

cloud9:ListEnvironments
cloud9:ListTagsForResource
cloud9:DescribeEnvironments
cloud9:DescribeEnvironmentMemberships

| | AWS Glue DataBrew | | | | | AWS Glue DataBrew | aws-glue-data-brew-job | No |

databrew:DescribeJob
databrew:ListJobs

| | AWS Glue DataBrew | aws-glue-data-brew-project | No |

databrew:ListProjects
databrew:DescribeProject

| | Amazon Forecast | | | | | Amazon Forecast | aws-forecast-dataset | No |

forecast:ListDatasets
forecast:DescribeDataset
forecast:ListTagsForResourc

| | Amazon Forecast | aws-forecast-predictor | No |

forecast:DescribePredictor
forecast:DescribeAutoPredictor
forecast:ListTagsForResource
forecast:ListPredictors

| | Amazon CodePipeline | | | | | Amazon CodePipeline | aws-code-pipeline-pipeline | No |

codepipeline:ListPipelines
codepipeline:GetPipeline
codepipeline:ListTagsForResource

| | Amazon Kendra | | | | | Amazon Kendra | aws-kendra-index | No |

kendra:DescribeIndex
kendra:ListIndices
kendra:ListTagsForResource

| | AWS Identity Store | | | | | AWS Identity Store | aws-identity-store-user | Elad C |

sso:ListInstances
identitystore:ListUsers

| | AWS Identity Store | aws-identity-store-group-members | Elad C |

sso:ListInstances
identitystore:ListGroups
identitystore:ListGroupMemberships

| | AWS IAM Identity Center | | | | | AWS IAM Identity Center | aws-iam-identity-center-account-assignments | Elad C |

sso:ListInstances
sso:ListPermissionSets
sso:ListAccountForProvisionedPermissionSet
sso:ListAccountAssignments
sso:DescribePermissionSet

| | AWS IAM Identity Center | aws-iam-identity-center-instance | No | sso:ListInstances | | AWS IAM Identity Center | aws-iam-identity-center-permission-set | No |

sso:ListInstances
sso:ListPermissionSets
sso:DescribePermissionSet

| | AWS IAM Identity Center | aws-iam-identity-center-application | No |

sso:ListInstances
sso:ListApplications
sso:ListApplicationAssignments

| | AWS IAM Identity Center | aws-iam-identity-center-permission-set-provisioning-status | No |

sso:ListInstances
sso:ListPermissionSetProvisioningStatus
sso:DescribePermissionSetProvisioningStatus

| | Amazon Prometheus | | | | | Amazon Prometheus | aws-prometheus-workspace | No |

aps:DescribeLoggingConfiguration
aps:ListWorkspaces

| | Amazon Kinesis Video | | | | | Amazon Kinesis Video | aws-kinesis-video-stream | No |

kinesisvideo:ListTagsForStream
kinesisvideo:ListStreams
kinesisvideo:DescribeNotificationConfiguration

| | Amazon Chime | | | | | Amazon Chime | aws-chime-voice-connector | No |

chime:ListVoiceConnectors
chime:GetVoiceConnectorLoggingConfiguration

| | AWS Network Firewall | | | | | AWS Network Firewall | aws-networkfirewall-firewall | No |

network-firewall:ListFirewalls
network-firewall:DescribeFirewall

| | AWS Network Firewall | aws-networkfirewall-firewall-policy | No |

network-firewall:ListFirewallPolicies
network-firewall:DescribeFirewallPolicy
network-firewall:DescribeResourcePolicy

| | AWS Network Firewall | aws-network-firewall-logging-configuration | No |

network-firewall:DescribeLoggingConfiguration
network-firewall:ListFirewalls

| | AWS Network Firewall | aws-network-firewall-rule-group | No |

network-firewall:ListRuleGroups
network-firewall:DescribeRuleGroup

| | Amazon Firewall Manager | | | | | Amazon Firewall Manager | aws-fms-admin-account | No | fms:GetAdminAccount | | Amazon Firewall Manager | aws-fms-policy | No |

fms:GetAdminAccount
fms:ListPolicies
fms:GetPolicy

| | Amazon Firewall Manager | aws-fms-compliance-status | No |

fms:ListPolicies
fms:ListComplianceStatus

| | AWS Polly Voices | | | | | AWS Polly Voices | aws-polly-voices | No | polly:DescribeVoices | | AWS Polly Voices | aws-polly-speech-synthesis-task | No | polly:ListSpeechSynthesisTasks | | AWS IoT Analytics | | | | | AWS IoT Analytics | aws-iot-analytics-channel | No |

iotanalytics:ListChannels
iotanalytics:ListTagsForResource

| | AWS IoT Analytics | aws-iot-analytics-datastores | No | iotanalytics:ListDatastores | | AWS Security Hub | | | | | AWS Security Hub | aws-securityhub-enabled-standards | No | securityhub:GetEnabledStandards | | AWS Security Hub | aws-securityhub-hub | No | securityhub:DescribeHub | | AWS Security Hub | aws-securityhub-enabled-products-for-import | No | securityhub:ListEnabledProductsForImport | | AWS Security Hub | aws-securityhub-finding-aggregator | No |

securityhub:ListFindingAggregators

securityhub:GetFindingAggregator

| | AWS Serverless Application Repository | | | | | AWS Serverless Application Repository | aws-serverlessrepo-application | No |

serverlessrepo:GetApplicationPolicy
serverlessrepo:ListApplications

| | AWS CloudHSM | | | | | AWS CloudHSM | aws-cloudhsm-cluster | No | cloudhsm:DescribeClusters | | Amazon Inspector | | | | | Amazon Inspector | aws-inspector-v2-filter | No | inspector2:ListFilters | | Amazon Inspector | aws-inspector-v2-permission | No | inspector2:ListAccountPermissions | | Amazon Inspector | aws-inspector-v2-coverage | No | inspector2:ListCoverage | | Amazon Inspector | aws-inspector-v2-account-status | No | inspector2:BatchGetAccountStatus | | AWS Cost Explorer | | | | | AWS Cost Explorer | aws-costexplorer-cost-and-usage | No | ce:GetCostAndUsage | | AWS Support | | | | | AWS Support | aws-support-case | No | support:DescribeCases | | AWS Application Auto Scaling | | | | | AWS Application Auto Scaling | aws-application-autoscaling-scaling-policy | No | application-autoscaling:DescribeScalingPolicies | | AWS Trusted Advisor | | | | | AWS Trusted Advisor | aws-trusted-advisor-check-result | No |

support:DescribeTrustedAdvisorChecks
support:DescribeTrustedAdvisorCheckResult

| | AWS Well-Architected Tool | | | | | AWS Well-Architected Tool | aws-well-architected-tool-workload | No |

wellarchitected:GetWorkload
wellarchitected:ListWorkloads

| | AWS Budgets | | | | | AWS Budgets | aws-budgets-budget | No | budgets:ViewBudget | | AWS Audit Manager | | | | | AWS Audit Manager | aws-audit-manager-assessment | No |

auditmanager:ListAssessments
auditmanager:GetAssessment

| | AWS Audit Manager | aws-audit-manager-control | No |

auditmanager:ListControls
auditmanager:GetControl

| | AWS Application Migration Service | | | | | AWS Application Migration Service | aws-mgn-launch-configuration-template | No | mgn:DescribeLaunchConfigurationTemplates | | AWS Application Migration Service | aws-mgn-replication-configuration-template | No | mgn:DescribeReplicationConfigurationTemplates | | AWS Application Migration Service | aws-mgn-source-server | No | mgn:DescribeSourceServers | | AWS Elastic Disaster Recovery | | | | | AWS Elastic Disaster Recovery | aws-drs-source-server | No | drs:DescribeSourceServers | | AWS Elastic Disaster Recovery | aws-drs-replication-configuration | No |

drs:DescribeSourceServers
drs:GetReplicationConfiguration

| | AWS Elastic Disaster Recovery | aws-drs-job | No | drs:DescribeJobs | | AWS Elastic Disaster Recovery | aws-drs-source-network | No | drs:DescribeSourceNetworks | | AWS CodeCommit | | | | | AWS CodeCommit | aws-code-commit-repository | No |

codecommit:ListRepositories
codecommit:GetRepository

| | AWS CodeCommit | aws-code-commit-approval-rule-template | No |

codecommit:ListApprovalRuleTemplates
codecommit:GetApprovalRuleTemplate

| | Amazon CodePipeline | | | | | Amazon CodePipeline | aws-code-pipeline-webhook | No | codepipeline:ListWebhooks | | Amazon EC2 Image Builder | | | | | Amazon EC2 Image Builder | aws-imagebuilder-component | No |

imagebuilder:ListComponents
imagebuilder:GetComponent

| | Amazon EC2 Image Builder | aws-imagebuilder-image-pipeline | No |

imagebuilder:ListImagePipelines
imagebuilder:GetImagePipeline

| | Amazon EC2 Image Builder | aws-imagebuilder-image-recipe | No |

imagebuilder:ListImageRecipes
imagebuilder:GetImageRecipe

| | Amazon EC2 Image Builder | aws-imagebuilder-infrastructure-configuration | No |

imagebuilder:ListInfrastructureConfigurations
imagebuilder:GetInfrastructureConfiguration

| | Amazon EC2 Image Builder | aws-imagebuilder-image | No |

imagebuilder:ListImages

imagebuilder:GetImage

imagebuilder:ListImageBuildVersions

| | Amazon EC2 Image Builder | aws-imagebuilder-distribution-configuration | No |

imagebuilder:ListDistributionConfigurations

imagebuilder:GetDistributionConfiguration

| | AWS Resilience Hub | | | | | AWS Resilience Hub | aws-resiliencehub-apps | No | resiliencehub:ListApps | | Amazon LookoutEquipment Datasets | | | | | Amazon LookoutEquipment Datasets | aws-lookoutequipment-datasets | No | lookoutequipment:ListDatasets | | AWS Service Catalog App Registry | | | | | AWS Service Catalog App Registry | aws-servicecatalog-appregistry-attribute-groups | No | servicecatalog-appregistry:ListAttributeGroups | | AWS Service Catalog App Registry | aws-servicecatalog-appregistry-applications | No | servicecatalog-appregistry:ListApplications | | Amazon Comprehend | | | | | Amazon Comprehend | aws-comprehend-entities-detection-jobs | No | comprehend:ListEntitiesDetectionJobs | | Amazon Comprehend | aws-comprehend-document-classifier-summary | No | comprehend:ListDocumentClassifierSummaries | | Amazon Comprehend | aws-comprehend-document-classifier | No | comprehend:ListDocumentClassifiers | | Amazon Comprehend | aws-comprehend-pii-entities-detection-jobs | No |

comprehend:ListPiiEntitiesDetectionJobs
comprehend:ListTagsForResource

| | Amazon Comprehend | aws-comprehend-sentiment-detection-jobs | No |

comprehend:ListSentimentDetectionJobs
comprehend:ListTagsForResource

| | Amazon Comprehend | aws-comprehend-key-phrases-detection-jobs | No |

comprehend:ListKeyPhrasesDetectionJobs
comprehend:ListTagsForResource

| | Amazon Comprehend | aws-comprehend-targeted-sentiment-detection-jobs | No |

comprehend:ListTargetedSentimentDetectionJobs
comprehend:ListTagsForResource

| | Amazon Comprehend | aws-comprehend-flywheel | No |

comprehend:ListFlywheels
comprehend:DescribeFlywheel
comprehend:ListTagsForResource

| | Amazon Comprehend | aws-comprehend-entity-recognizer | No |

comprehend:ListEntityRecognizers

comprehend:ListTagsForResource

| | AWS Comprehend Medical | | | | | AWS Comprehend Medical | aws-comprehendmedical-entities-detection-v2-jobs | No | comprehendmedical:ListEntitiesDetectionV2Jobs | | Amazon Managed Blockchain | | | | | Amazon Managed Blockchain | aws-managed-blockchain-networks | No | managedblockchain:ListNetworks | | AWS Lookout Metrics | | | | | AWS Lookout Metrics | aws-lookoutmetrics-anomaly-detectors | No | lookoutmetrics:ListAnomalyDetectors | | AWS IoT FleetWise | | | | | AWS IoT FleetWise | aws-iotfleetwise-signal-catalogs | No | iotfleetwise:ListSignalCatalogs | | AWS Device Farm | | | | | AWS Device Farm | aws-device-farm-projects | No | devicefarm:ListProjects | | Amazon Elastic Transcoder | | | | | Amazon Elastic Transcoder | aws-elastic-transcoder-pipelines | No | elastictranscoder:ListPipelines | | AWS Elastic Beanstalk | | | | | AWS Elastic Beanstalk | aws-elasticbeanstalk-applications | No | elasticbeanstalk:DescribeApplications | | AWS Greengrass | | | | | AWS Greengrass | aws-greengrass-core-definitions | No | greengrass:ListCoreDefinitions | | AWS Greengrass | aws-greengrass-groups | No | greengrass:ListGroups | | AWS IoT Events | | | | | AWS IoT Events | aws-iot-events-inputs | No | iotevents:ListInputs | | Amazon Lookout for Vision | | | | | Amazon Lookout for Vision | aws-lookoutvision-projects | No | lookoutvision:ListProjects | | AWS OpsWorks | | | | | AWS OpsWorks | aws-opsworks-user-profiles | No | opsworks:DescribeUserProfiles | | AWS SecurityHub | | | | | AWS SecurityHub | aws-securityhub-standards | No | securityhub:DescribeStandards | | AWS Service Catalog | | | | | AWS Service Catalog | aws-servicecatalog-portfolios | No | servicecatalog:ListPortfolios | | AWS Service Catalog | aws-servicecatalog-principals-for-portfolio | No |

servicecatalog:ListPortfolios
servicecatalog:ListPrincipalsForPortfolio

| | AWS Service Catalog | aws-servicecatalog-product-as-admin | No | servicecatalog:SearchProductsAsAdmin | | AWS Service Catalog | aws-servicecatalog-product | No | servicecatalog:SearchProducts | | AWS Service Catalog | aws-servicecatalog-portfolio-share | No |

servicecatalog:ListPortfolios
servicecatalog:DescribePortfolioShares

| | AWS Service Catalog | aws-servicecatalog-provisioned-product | | servicecatalog:SearchProvisionedProducts | | AWS ServiceDiscovery (AWS Cloud Map) | | | | | AWS ServiceDiscovery (AWS Cloud Map) | aws-servicediscovery-namespaces | No | servicediscovery:ListNamespaces | | Amazon SWF | | | | | Amazon SWF | aws-swf-domains | No | swf:ListDomains | | Amazon Detective | | | | | Amazon Detective | aws-detective-datasource-package | No |

detective:ListGraphs
detective:ListDatasourcePackages

| | AWS Network Manager | | | | | AWS Network Manager | aws-network-manager-core-network | No |

networkmanager:GetCoreNetwork
networkmanager:ListCoreNetworks

| | AWS Network Manager | aws-network-manager-global-network | No | networkmanager:DescribeGlobalNetworks | | AWS Network Manager | aws-network-manager-global-network-device | No |

networkmanager:DescribeGlobalNetworks
networkmanager:GetDevices

| | AWS Network Manager | aws-network-manager-global-network-site | No |

networkmanager:DescribeGlobalNetworks
networkmanager:GetSites

| | AWS Migration Hub | | | | | AWS Migration Hub | aws-migration-hub-home-region-control | No | mgh:DescribeHomeRegionControls | | AWS AppConfig | | | | | AWS AppConfig | aws-appconfig-application | No |

appconfig:ListApplications
appconfig:ListEnvironments
appconfig:ListConfigurationProfiles

| | Amazon Bedrock | | | | | Amazon Bedrock | aws-bedrock-foundation-model | No |

bedrock:ListFoundationModels
bedrock:GetFoundationModel

| | Amazon Bedrock | aws-bedrock-custom-model | No |

bedrock:ListCustomModels
bedrock:GetCustomModel
bedrock:ListTagsForResource

| | Amazon Bedrock | aws-bedrock-agent | No |

bedrock:ListAgents
bedrock:GetAgent
bedrock:ListTagsForResource

| | Amazon Bedrock | aws-bedrock-model-invocation-logging-configuration | No | bedrock:GetModelInvocationLoggingConfiguration | | Amazon Bedrock | aws-bedrock-provisioned-model-throughput | No |

bedrock:ListProvisionedModelThroughputs
bedrock:GetProvisionedModelThroughput
bedrock:ListTagsForResource

| | Amazon Bedrock | aws-bedrock-model-customization-job | No |

bedrock:ListModelCustomizationJobs
bedrock:GetModelCustomizationJob
bedrock:ListTagsForResource

| | Amazon Bedrock | aws-bedrock-knowledgebase | No |

bedrock:ListKnowledgeBases
bedrock:GetKnowledgeBase
bedrock:ListTagsForResource

| | AWS Resource Groups and Tagging | | | | | AWS Resource Groups and Tagging | aws-resourcegroupstaggingapi-report-creation | No | tag:DescribeReportCreation | | AWS Resource Groups and Tagging | aws-resourcegroupstaggingapi-compliance-summary | No | tag:GetComplianceSummary | | AWS Signer | | | | | AWS Signer | aws-signer-signing-job | No |

signer:ListSigningJobs
signer:DescribeSigningJob

| | AWS CodeDeploy | | | | | AWS CodeDeploy | aws-code-deploy-deployment-instance | No |

codedeploy:ListDeployments
codedeploy:ListDeploymentTargets
codedeploy:BatchGetDeploymentTargets

| | AWS CodeDeploy | aws-code-deploy-deployment-config | No |

codedeploy:ListDeploymentConfigs

codedeploy:GetDeploymentConfig

| | AWS CodeDeploy | aws-code-deploy-application | No |

codedeploy:ListApplications
codedeploy:BatchGetApplications
codedeploy:ListTagsForResource

| | AWS CodeDeploy | aws-code-deploy-application-deployment-group | |

codedeploy:ListApplications
codedeploy:ListDeploymentGroups
codedeploy:GetDeploymentGroup
codedeploy:ListTagsForResource

| | AWS Fault Injection Service | | | | | AWS Fault Injection Service | aws-fis-experiment | No |

fis:ListExperiments
fis:GetExperiment

| | AWS Fault Injection Service | aws-fis-experiment-template | No |

fis:ListExperimentTemplates
fis:GetExperimentTemplate

| | Amazon DataZone | | | | | Amazon DataZone | aws-datazone-data-source | No |

datazone:ListDomains
datazone:ListProjects
datazone:ListDataSources
datazone:GetDataSource

| | Amazon DataZone | aws-datazone-domain | No |

datazone:ListDomains
datazone:GetDomain

| | Amazon Recycle Bin | | | | | Amazon Recycle Bin | aws-recycle-bin-ebs-snapshot-rule | No |

rbin:ListRules
rbin:GetRule
rbin:ListTagsForResource

| | Amazon Recycle Bin | aws-recycle-bin-ami-rule | No |

rbin:ListRules
rbin:GetRule
rbin:ListTagsForResource

| | Amazon IVS | | | | | Amazon IVS | aws-ivs-channel | No |

ivs:ListChannels
ivs:GetChannel

| | AWS Control Tower | | | | | AWS Control Tower | aws-controltower-landing-zone | No |

controltower:ListLandingZones
controltower:GetLandingZone
controltower:ListTagsForResource

| | Amazon Data Lifecycle Manager | | | | | Amazon Data Lifecycle Manager | aws-dlm-lifecycle-policy | No |

dlm:GetLifecyclePolicies
dlm:GetLifecyclePolicy

| | Amazon VPC Lattice | | | | | Amazon VPC Lattice | aws-vpc-lattice-service-network | No |

vpc-lattice:ListServiceNetworks
vpc-lattice:GetServiceNetwork
vpc-lattice:ListTagsForResource

| | Amazon VPC Lattice | aws-vpc-lattice-target-group | No |

vpc-lattice:ListTargetGroups
vpc-lattice:GetTargetGroup
vpc-lattice:ListTagsForResource

| | Amazon VPC Lattice | aws-vpc-lattice-service | No |

vpc-lattice:ListServices
vpc-lattice:GetService
vpc-lattice:ListTagsForResource

| | Amazon VPC Lattice | aws-vpc-lattice-service-network-service-association | No |

vpc-lattice:ListServices
vpc-lattice:ListServiceNetworkServiceAssociations
vpc-lattice:ListTagsForResource

| | Amazon VPC Lattice | aws-vpc-lattice-service-network-vpc-association | No |

vpc-lattice:ListServiceNetworks
vpc-lattice:ListServiceNetworkVpcAssociations
vpc-lattice:ListTagsForResource

| | Amazon VPC Lattice | aws-vpc-lattice-service-listener | No |

vpc-lattice:ListServices
vpc-lattice:ListListeners
vpc-lattice:GetListener
vpc-lattice:ListTagsForResource

| | Amazon EventBridge Scheduler | | | | | Amazon EventBridge Scheduler | aws-event-bridge-scheduler-schedule | No |

scheduler:ListSchedules
scheduler:GetSchedule

| | Amazon Fraud Detector | | | | | Amazon Fraud Detector | aws-fraud-detector-entity-type | No |

frauddetector:GetEntityTypes
frauddetector:ListTagsForResource

| | Amazon Fraud Detector | aws-fraud-detector-label | No |

frauddetector:GetLabels
frauddetector:ListTagsForResource

| | Amazon Fraud Detector | aws-fraud-detector-variable | No | frauddetector:GetVariables | | Amazon Personalize | | | | | Amazon Personalize | aws-personalize-dataset-import-job | No | personalize:ListDatasetImportJobs | | Amazon CloudWatch Synthetics | | | | | Amazon CloudWatch Synthetics | aws-cloudwatch-synthetics-canary | No | synthetics:DescribeCanaries | | Amazon EventBridge Pipes | | | | | Amazon EventBridge Pipes | aws-event-bridge-pipe | No |

pipes:ListPipes
pipes:DescribePipe

| | AWS AppFabric | | | | | AWS AppFabric | aws-appfabric-app-bundle | No |

appfabric:ListAppBundles
appfabric:GetAppBundle
appfabric:ListTagsForResource

| | AWS AppFabric | aws-appfabric-app-authorization | No |

appfabric:ListAppBundles
appfabric:ListAppAuthorizations
appfabric:GetAppAuthorization
appfabric:ListTagsForResource

| | Amazon Keyspaces | | | | | Amazon Keyspaces | aws-keyspaces-table | No | cassandra:Select | | AWS X-Ray | | | | | AWS X-Ray | aws-xray-group | | xray:GetGroups | * The APIs marked with \[\*] will not support event attribution when you move to Near Real Time Visibility. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/aws-apis-ingested-by-prisma-cloud.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.