AWS APIs Ingested by Prisma Cloud
The following table lists all the AWS APIs that Prisma Cloud supports to retrieve data about the assets in your AWS cloud environment.
Current as of:
April 10, 2026
Amazon EC2
Amazon EC2
aws-ec2-describe-instances
Yes
ec2:DescribeInstances ec2:DescribeInstanceStatus ec2:DescribeInstanceAttribute
Amazon EC2
aws-ec2-classic-instance
No
ec2:DescribeInstances ec2:DescribeInstanceStatus
Amazon EC2
aws-ec2-describe-network-interfaces
Yes
ec2:DescribeNetworkInterfaces
Amazon EC2
aws-ec2-describe-images*
Yes
ec2:DescribeImages
Amazon EC2
aws-ec2-describe-snapshots
Yes
ec2:DescribeSnapshots ec2:DescribeSnapshotAttribute
Amazon EC2
aws-ec2-describe-volumes
Yes
ec2:DescribeVolumes
Amazon EC2
aws-describe-account-attributes
NA
ec2:DescribeAccountAttributes
Amazon EC2
aws-ec2-key-pair
Yes
ec2:DescribeKeyPairs
Amazon EC2
aws-ec2-elastic-address
Yes
ec2:DescribeAddresses
Amazon EC2
aws-ec2-ebs-encryption
NA
ec2:GetEbsEncryptionByDefault
Amazon EC2
aws-ec2-launch-template
No
ec2:DescribeLaunchTemplates ec2:DescribeLaunchTemplateVersions
Amazon EC2
aws-ec2-launch-template-data
No
ec2:GetLaunchTemplateData ec2:DescribeInstances
Amazon EC2
aws-ec2-vpc-endpoint-service
No
ec2:DescribeVpcEndpointServices
Amazon EC2
aws-ec2-vpc-endpoint-connection-notification
No
ec2:DescribeVpcEndpointConnectionNotifications
Amazon EC2
aws-ec2-vpc-ipam
No
ec2:DescribeIpams
Amazon EC2
aws-describe-account-attributes
No
ec2:DescribeAccountAttributes
Amazon EC2
aws-ec2-reserved-instance
No
ec2:DescribeReservedInstances
Amazon EC2
aws-ec2-egress-only-internet-gateway
No
ec2:DescribeEgressOnlyInternetGateways
Amazon EC2
aws-ec2-network-insights-analysis
No
ec2:DescribeNetworkInsightsAnalyses
Amazon EC2
aws-ec2-spot-fleet-request
No
ec2:DescribeSpotFleetRequests
Amazon EC2
aws-ec2-serial-console-access-status
No
ec2:GetSerialConsoleAccessStatus
Amazon EC2
aws-ec2-snapshot-block-public-access-state
No
ec2:GetSnapshotBlockPublicAccessState
Amazon EC2
aws-ec2-image-block-public-access-state
No
ec2:GetImageBlockPublicAccessState
Amazon EC2
aws-ec2-instance-connect-endpoint
No
ec2:DescribeInstanceConnectEndpoints
Amazon VPC
Amazon VPC
aws-ec2-describe-vpcs
Yes
ec2:DescribeVpcs
Amazon VPC
aws-ec2-vpc-stats
No
ec2:DescribeVpcs
Amazon VPC
aws-ec2-describe-subnets
Yes
ec2:DescribeSubnets
Amazon VPC
aws-ec2-describe-security-groups
Yes
ec2:DescribeSecurityGroups
Amazon VPC
aws-ec2-describe-flow-logs
Yes
ec2:DescribeFlowLogs, ec2: DescribeTags
Amazon VPC
aws-ec2-describe-internet-gateways
Yes
ec2:DescribeInternetGateways
Amazon VPC
aws-describe-vpc-endpoints
Yes
ec2:DescribeVpcEndpoints
Amazon VPC
aws-ec2-describe-network-acls
Yes
ec2:DescribeNetworkAcls
Amazon VPC
aws-ec2-describe-vpc-peering-connections
Yes
ec2:DescribeVpcPeeringConnections
Amazon VPC
aws-ec2-describe-vpn-gateways
Yes
ec2:DescribeVpnGateways
Amazon VPC
aws-ec2-describe-vpn-gateways-summary
NA
ec2:DescribeVpnGateways
Amazon VPC
aws-ec2-describe-vpn-connections
Yes
ec2:DescribeVpnConnections
Amazon VPC
aws-ec2-vpn-connections-summary
NA
ec2:DescribeVpnConnections
Amazon VPC
aws-ec2-describe-route-tables
Yes
ec2:DescribeRouteTables
Amazon VPC
aws-vpc-dhcp-options
Yes
ec2:DescribeDhcpOptions
Amazon VPC
aws-vpc-nat-gateway
Yes
ec2:DescribeNatGateways
Amazon VPC
aws-vpc-transit-gateway
Yes
ec2:DescribeTransitGateways
Amazon VPC
aws-vpc-managed-prefix-list
No
ec2:DescribeManagedPrefixLists, ec2:GetManagedPrefixListEntries
Amazon VPC
aws-vpc-transit-gateway-route-table
Yes
ec2:DescribeTransitGatewayRouteTables, ec2:SearchTransitGatewayRoutes
Amazon VPC
aws-vpc-transit-gateway-attachment
No
ec2:DescribeTransitGatewayAttachments, ec2:DescribeTransitGatewayVpcAttachments
Amazon VPC
aws-ec2-vpc-endpoint-service-configuration
No
ec2:DescribeVpcEndpointServiceConfigurations
Amazon VPC
aws-ec2-client-vpn-endpoint
No
ec2:DescribeClientVpnEndpoints
Amazon VPC
aws-ec2-vpc-endpoint-service-permission
No
ec2:DescribeVpcEndpointServicePermissions
Amazon VPC
aws-ec2-customer-gateway
No
ec2:DescribeCustomerGateways
Amazon VPC
aws-ec2-traffic-mirroring
No
ec2:DescribeTrafficMirrorSessions
Amazon Route53
Amazon Route53
aws-route53-list-hosted-zones
Yes
route53:ListHostedZones route53:ListResourceRecordSets route53:GetDNSSEC
Amazon Route53
aws-route53-domain
No
route53domains:ListDomains route53domains:ListTagsForDomain route53domains:GetDomainDetail
Amazon Route53
aws-route53-query-logging-config
No
route53:ListQueryLoggingConfigs
Amazon Route53
aws-route53-health-check
No
route53:ListHealthChecks route53:GetHealthCheck route53:ListTagsForResource
AWS Lambda
AWS Lambda
aws-lambda-list-functions
No
lambda:ListFunctions lambda:ListTags lambda:GetPolicy lambda:GetFunctionUrlConfig
AWS Lambda
aws-lambda-get-region-summary
No
none
AWS Lambda
aws-lambda-layer-version
No
lambda:ListLayers lambda:ListLayerVersions lambda:GetLayerVersionPolicy
AWS Lambda
aws-lambda-code-signing-config
No
lambda:ListCodeSigningConfigs
AWS Lambda
aws-lambda-get-layer-version
No
lambda:ListLayers lambda:ListLayerVersions lambda:GetLayerVersion
AWS Lambda
aws-lambda-event-source-mapping
No
lambda:ListEventSourceMappings lambda:GetEventSourceMapping
AWS Lambda
aws-lambda-runtime-management-config
No
lambda:ListFunctions lambda:GetRuntimeManagementConfig
AWS Lambda
aws-lambda-function-event-invoke-config
No
lambda:ListFunctions lambda:GetFunctionEventInvokeConfig
AWS Lambda
aws-lambda-versions-by-function
No
lambda:ListFunctions lambda:ListVersionsByFunction
AWS Lambda
aws-lambda-function-concurrency
No
lambda:ListFunctions lambda:GetFunctionConcurrency
Amazon RDS
Amazon RDS
aws-rds-describe-db-instances*
Yes
rds:DescribeDBInstances rds:ListTagsForResource
Amazon RDS
aws-rds-describe-db-snapshots
Yes
rds:DescribeDBSnapshots rds:DescribeDBSnapshotAttributes
Amazon RDS
aws-rds-describe-event-subscriptions
Yes
rds:DescribeEventSubscriptions
Amazon RDS
aws-rds-describe-db-parameter-groups*
No
rds:DescribeDBParameterGroups rds:DescribeDBParameters listTagsForResource
Amazon RDS
aws-rds-db-cluster-snapshots
Yes
rds:DescribeDBClusterSnapshots rds:DescribeDBClusterSnapshotAttributes
Amazon RDS
aws-rds-db-cluster
Yes
rds:DescribeDBClusters
Amazon RDS
aws-rds-option-group
No
rds:ListTagsForResource rds:DescribeOptionGroups
Amazon RDS
aws-rds-db-cluster-parameter-group
Yes
rds:DescribeDBClusterParameters rds:DescribeDBClusterParameterGroups rds:ListTagsForResource
Amazon RDS
aws-rds-db-proxy-target
No
rds:DescribeDBProxyTargets rds:DescribeDBProxyTargetGroups rds:DescribeDBProxies
Amazon RDS
aws-rds-db-proxy
No
rds:DescribeDBProxies
Amazon RDS
aws-rds-db-instance-automated-backup
No
rds:DescribeDBInstanceAutomatedBackups
Amazon RDS
aws-rds-db-subnet-group
rds:ListTagsForResource rds:DescribeDBSubnetGroups
AWS IAM
AWS IAM
aws-iam-list-access-keys
No
iam:ListAccessKeys
AWS IAM
aws-iam-get-account-summary
No
iam:GetAccountSummary
AWS IAM
aws-iam-get-credential-report
No
iam:GenerateCredentialReport iam:GetCredentialReport
AWS IAM
aws-iam-list-mfa-devices
No
iam:ListMFADevices
AWS IAM
aws-iam-list-virtual-mfa-devices
No
iam:ListVirtualMFADevices
AWS IAM
aws-iam-get-account-password-policy
No
iam:GetAccountPasswordPolicy
AWS IAM
aws-iam-get-policy-version
No
iam:ListPolicies, iam:GetPolicyVersion iam:ListEntitiesForPolicy
AWS IAM
aws-iam-list-users
No
iam:ListUsers, iam:ListGroupsForUser iam:ListUserTags
AWS IAM
aws-iam-list-user-policies
No
iam:ListUserPolicies
AWS IAM
aws-iam-list-attached-user-policies
No
iam:ListAttachedUserPolicies
AWS IAM
aws-iam-list-roles
No
iam:ListRoles, iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:ListInstanceProfilesForRole iam:ListRoleTags
AWS IAM
aws-iam-list-server-certificates
No
iam:ListServerCertificates
AWS IAM
aws-iam-list-ssh-public-keys
No
iam:ListSSHPublicKeys
AWS IAM
aws-iam-list-groups
No
iam:ListGroups, iam:ListAttachedGroupPolicies, iam:ListGroupPolicies, iam:GetGroupPolicy
AWS IAM
aws-iam-saml-provider
No
iam:ListSAMLProviders, iam:GetSAMLProvider
AWS IAM
aws-iam-service-last-accessed-details
No
iam:GenerateServiceLastAccessedDetails, iam:GetServiceLastAccessedDetails
AWS IAM
aws-iam-oidc-provider
No
iam:ListOpenIDConnectProviders iam:GetOpenIDConnectProvider
AWS IAM
aws-iam-service-specific-credential
No
iam:ListUsers iam:ListServiceSpecificCredentials
AWS IAM
aws-iam-instance-profile
No
iam:ListInstanceProfiles iam:GetInstanceProfile
Amazon S3
Amazon S3
aws-s3api-get-bucket-acl
Yes
s3:ListBuckets, s3:GetS3AccountOwner, s3:GetBucketEncryption, s3:GetBucketLocation, s3:GetBucketAcl, s3:GetBucketPolicy, s3:GetBucketPolicyStatus, s3:GetBucketVersioningConfiguration, s3:GetBucketWebsiteConfiguration, s3:GetBucketLoggingConfiguration, s3:GetBucketTaggingConfiguration, s3:GetPublicAccessBlock, s3:GetBucketLifecycleConfiguration, s3:GetRegionName, s3:GetReplicationConfiguration s3:GetBucketCORS,s3:GetBucketObjectLockConfiguration, s3:GetAccelerateConfiguration,s3:GetAnalyticsConfiguration,s3:GetBucketNotification
Amazon S3
aws-s3control-public-access-block
No
s3:GetPublicAccessBlock
Amazon S3
aws-s3-access-point
No
s3:ListBuckets, s3:GetRegionName, s3:GetAccessPoint, s3:GetAccessPointPolicyStatus, s3:GetAccessPointPolicy
Amazon S3
aws-s3-batch-operation
No
s3:DescribeJob s3:ListJobs s3:GetJobTagging
Amazon S3
aws-s3-multi-region-access-point
No
s3:ListMultiRegionAccessPoints
Amazon S3
aws-s3-storage-lens-configuration
No
s3:ListStorageLensConfigurations
Amazon Redshift
Amazon Redshift
aws-redshift-describe-clusters
No
redshift:DescribeClusters, redshift:DescribeLoggingStatus, redshift:DescribeClusterParameters
Amazon Redshift
aws-redshift-serverless-workgroup
No
redshift-serverless:ListWorkgroups
Amazon Redshift
aws-redshift-cluster-subnet-group
No
redshift:DescribeClusterSubnetGroups
Amazon Redshift
aws-redshift-serverless-snapshot
No
redshift-serverless:ListSnapshots redshift-serverless:ListTagsForResource
Amazon Redshift
aws-redshift-serverless-namespace
No
redshift-serverless:ListNamespaces redshift-serverless:ListTagsForResource
Amazon Redshift
aws-redshift-serverless-endpoint-access
No
redshift-serverless:ListEndpointAccess
Amazon Redshift
aws-redshift-endpoint-access
redshift:DescribeEndpointAccess
Amazon RAM
Amazon RAM
aws-ram-resource-share
No
ram:GetResourceShares
Amazon RAM
aws-ram-principal
No
ram:ListPrincipals
Amazon RAM
aws-ram-resource
No
ram:ListResources
AWS KMS
AWS KMS
aws-kms-get-key-rotation-status
Yes
kms:ListAliases, kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus, kms:ListKeyPolicies, kms:GetKeyPolicy, kms:ListResourceTags
AWS KMS
aws-kms-grant
No
kms:ListKeys kms:ListGrants
AWS CloudTrail
AWS CloudTrail
aws-cloudtrail-describe-trails
Yes
cloudtrail:DescribeTrails, cloudtrail:ListTags
AWS CloudTrail
aws-cloudtrail-get-trail-status
Yes
cloudtrail:GetTrailStatus
AWS CloudTrail
aws-cloudtrail-get-event-selectors
Yes
cloudtrail:GetEventSelectors
Amazon CloudWatch
Amazon CloudWatch
aws-cloudwatch-describe-alarms
Yes
cloudwatch:describeAlarms, cloudwatch:ListTagsForResource
Amazon CloudWatch
aws-logs-describe-metric-filters
Yes
logs:DescribeMetricFilters
Amazon CloudWatch
aws-cloudwatch-log-group
Yes
logs:DescribeLogGroups, logs:ListTagsLogGroup, logs:DescribeSubscriptionFilters
Amazon CloudWatch
aws-cloudwatch-insight-rule
No
cloudwatch:DescribeInsightRules cloudwatch:ListTagsForResource
Amazon DynamoDB
Amazon DynamoDB
aws-dynamodb-describe-table
Yes
dynamodb:ListTables dynamodb:DescribeTable dynamodb:ListTagsOfResource dynamodb:DescribeTimeToLive dynamodb:DescribeContinuousBackups dynamodb:GetResourcePolicy
Amazon DynamoDB
aws-dynamo-db-backup
No
sso:ListInstances sso:ListApplications sso:ListApplicationAssignments
Amazon DynamoDB
aws-dynamo-db-global-table
No
dynamodb:ListGlobalTables dynamodb:DescribeGlobalTable
AWS Config
AWS Config
aws-configservice-describe-configuration-recorders
Yes
config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus
AWS Config
aws-describe-delivery-channels
No
config:DescribeDeliveryChannels
AWS Config
aws-configservice-config-rules
No
config:DescribeConfigRules
AWS Config
aws-configservice-resource-compliance-details
No
config:GetComplianceDetailsByConfigRule
AWS Config
aws-configservice-aggregator
No
config:DescribeConfigurationAggregators
AWS Config
aws-configservice-aggregator-authorization
Yes
config:DescribeAggregationAuthorizations
Amazon Elasticsearch Service
Amazon Elasticsearch Service
aws-es-describe-elasticsearch-domain
Yes
es:ListDomainNames, es:DescribeElasticsearchDomains
Amazon Elasticsearch Service
aws-es-security-config
Yes
aoss:ListSecurityConfigs
Amazon Elasticsearch Service
aws-es-batch-get-collection
Yes
aoss:ListCollections aoss:BatchGetCollection aoss:ListTagsForResource
Amazon Elasticsearch Service
aws-es-serverless-access-policy
Yes
aoss:ListAccessPolicies aoss:GetAccessPolicy
Amazon Elasticsearch Service
aws-es-serverless-security-policy
Yes
aoss:ListSecurityPolicies aoss:GetSecurityPolicy
Amazon WorkSpaces
Amazon WorkSpaces
aws-describe-workspaces
No
workspace:DescribeWorkspaces, workspace:DescribeTags
Amazon WorkSpaces
aws-describe-workspace-directories
No
workspace:DescribeWorkspaceDirectories, workspace:DescribeTags
Amazon WorkSpaces
aws-workspace-bundle
No
workspaces:DescribeTags workspaces:DescribeWorkspaceBundles
Amazon WorkSpaces
aws-workspace-ip-group
No
workspaces:DescribeTags workspaces:DescribeIpGroups
Amazon CloudFront
Amazon CloudFront
aws-cloudfront-list-distributions
No
cloudfront:ListDistributions, cloudfront:GetDistributionConfig, cloudfront:ListTagsForResource
Amazon CloudFront
aws-cloudfront-origin-access-control
No
cloudfront:ListOriginAccessControls
Amazon CloudFront
aws-cloudfront-response-headers-policy
No
cloudfront:ListResponseHeadersPolicies cloudfront:GetResponseHeadersPolicy
Amazon API Gateway
Amazon API Gateway
aws-apigateway-get-rest-apis
No
apigateway:GET
Amazon API Gateway
aws-apigateway-get-stages
Yes
apigateway:GET
Amazon API Gateway
aws-apigateway-domain-name
No
apigateway:GET
Amazon API Gateway
aws-apigateway-base-path-mapping
No
apigateway:GET
Amazon API Gateway
aws-apigateway-method
Yes
apigateway:GET
Amazon API Gateway
aws-apigatewayv2-api
No
apigateway:GET
Amazon API Gateway
aws-api-gateway-authorizer
No
apigateway:GET
Amazon API Gateway
aws-apigatewayv2-stage
No
apigateway:GET
Amazon API Gateway
aws-apigatewayv2-route
No
apigateway:GET
Amazon API Gateway
aws-apigateway-client-certificate
No
apigateway:GetClientCertificates
Amazon API Gateway
aws-apigatewayv2-authorizer
No
apigateway:GET
Amazon API Gateway
aws-apigatewayv2-domain-name
No
apigateway:GET
Amazon API Gateway
aws-apigatewayv2-integration
No
apigateway:GET
Amazon API Gateway
aws-apigateway-usage-plan
No
apigateway:GET
Amazon EFS
Amazon EFS
aws-describe-mount-targets
Yes
elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeMountTargets, elasticfilesystem:DescribeMountTargetSecurityGroups, elasticfilesystem:DescribeTags, elasticfilesysttem:DescribeFileSystemPolicy, elasticfilesystem:DescribeBackupPolicy
Amazon EFS
aws-efs-access-point
No
elasticfilesystem:DescribeAccessPoints
Amazon EMR
Amazon EMR
aws-emr-describe-cluster
No
elasticmapreduce:ListClusters, elasticmapreduce:DescribeCluster
Amazon EMR
aws-emr-security-configuration
Yes
elasticmapreduce:ListSecurityConfigurations, elasticmapreduce:DescribeSecurityConfiguration
Amazon EMR
aws-emr-public-access-block
No
elasticmapreduce:GetBlockPublicAccessConfiguration
Amazon EMR
aws-emr-instance
No
TODO: add permissions
Amazon EMR
aws-emr-studio
No
elasticmapreduce:ListStudios elasticmapreduce:DescribeStudio
Amazon EMR
aws-emr-serverless-application
No
emr-serverless:ListApplications emr-serverless:GetApplication
AWS Certificate Manager
AWS Certificate Manager
aws-acm-describe-certificate
Yes
acm:ListCertificates, acm:DescribeCertificate, acm:ListTagsForCertificate
AWS Secrets Manager
AWS Secrets Manager
aws-secretsmanager-describe-secret
Yes
secretsmanager:ListSecrets secretsmanager:GetResourcePolicy secretsmanager:DescribeSecret
AWS Systems Manager
AWS Systems Manager
aws-ssm-parameter
Yes
ssm:DescribeParameters, ssm:ListTagsForResource
AWS Systems Manager
aws-ssm-document
No
ssm:GetDocument, ssm:ListDocuments, ssm:DescribeDocument, ssm:DescribeDocumentPermission
AWS Systems Manager
aws-ssm-inventory-instance-information
No
ssm:DescribeInstanceInformation, ssm:GetInventory
AWS Systems Manager
aws-ssm-association
No
ssm:ListAssociations ssm:DescribeAssociation
AWS Systems Manager
aws-ssm-resource-compliance-summary
No
ssm:ListResourceComplianceSummaries
AWS Systems Manager
aws-ssm-custom-inventory-entry
No
ssm:GetInventory ssm:GetInventorySchema ssm:ListInventoryEntries
AWS Systems Manager
aws-ssm-activation
No
ssm:DescribeActivations
AWS Systems Manager
aws-ssm-service-setting
No
ssm:GetServiceSetting
AWS Systems Manager
aws-ssm-session
No
ssm:DescribeSessions
AWS Systems Manager
aws-ssm-patch-baseline
No
ssm:DescribePatchBaselines ssm:GetPatchBaseline
AWS Systems Manager
aws-ssm-resource-data-sync
No
ssm:ListResourceDataSync
Amazon ECS
Amazon ECS
aws-ecs-describe-task-definition
No
ecs:DescribeTaskDefinition, ecs:ListClusters, ecs:ListTasks, ecs:DescribeTasks, ecs:ListTagsForResource
Amazon ECS
aws-ecs-service
Yes
ecs:DescribeServices
Amazon ECS
aws-ecs-cluster
Yes
ecs:DescribeClusters, ecs:ListTagsForResource
Amazon ECS
aws-ecs-container-instance
Yes
ecs:ListContainerInstances ecs:DescribeContainerInstances
Amazon ECS
aws-ecs-capacity-provider
Yes
ecs:DescribeCapacityProviders
Amazon ECR
Amazon ECR
aws-ecr-get-repository-policy
Yes
ecr:DescribeRepositories ecr:GetRepositoryPolicy ecr:GetLifecyclePolicy
Amazon ECR
aws-ecr-image
No
ecr:DescribeImages
Amazon ECR
aws-ecr-registry-scanning-configuration
No
ecr:GetRegistryScanningConfiguration
Amazon ECR
aws-ecr-registry
No
ecr:GetRegistryPolicy ecr:DescribeRegistry ecr:DescribePullThroughCacheRules
Amazon ECR
aws-ecr-public-registry
No
ecr-public:DescribeRegistries ecr-public:GetRegistryCatalogData
Amazon ECR Public
Amazon ECR Public
aws-ecr-public-repositories*
No
ecr-public:DescribeRepositories, ecr-public:GetRepositoryCatalogData, ecr-public:GetRepositoryPolicy, ecr-public:ListTagsForResource
Amazon EKS
Amazon EKS
aws-eks-describe-cluster
No
eks:ListClusters, eks:DescribeCluster, eks:ListTagsForResource
Amazon EKS
aws-eks-fargate-profile
No
eks:ListFargateProfiles, eks:DescribeFargateProfile
Amazon EKS
aws-eks-node-group
No
eks:ListClusters, eks:ListNodegroups, eks:DescribeNodegroup
Amazon SQS
Amazon SQS
aws-sqs-get-queue-attributes
Yes
sqs:ListQueues, sqs:GetQueueAttributes
Amazon SQS
aws-sqs-message-move-task
No
sqs:ListQueues sqs:ListMessageMoveTasks
Amazon SNS
Amazon SNS
aws-sns-get-topic-attributes
Yes
sns:ListTopics, sns:GetTopicAttributes
Amazon SNS
aws-sns-get-subscription-attributes
No
sns:ListSubscriptions <Deprectated>
Amazon SNS
aws-sns-platform-application
No
sns:ListPlatformApplications
Amazon SNS
aws-sns-data-protection-policy
No
sns:ListTopics sns:GetDataProtectionPolicy
Amazon SNS
aws-sns-subscriptions-by-topic
No
sns:ListTopics sns:ListSubscriptionsByTopic
Amazon S3 Glacier
Amazon S3 Glacier
aws-glacier-get-vault-access-policy
No
glacier:ListVaults, glacier:GetVaultAccessPolicy, glacier:ListTagsForVault,
Amazon S3 Glacier
aws-glacier-get-vault-lock
No
glacier:GetVaultLock
Amazon S3 Glacier
aws-glacier-vault
No
glacier:ListVaults, glacier:ListTagsForVault,
AWS Auto Scaling
AWS Auto Scaling
aws-describe-auto-scaling-groups
Yes
autoscaling:DescribeAutoScalingGroups
AWS Auto Scaling
aws-ec2-autoscaling-launch-configuration
Yes
autoscaling:DescribeLaunchConfigurations
AWS CloudFormation
AWS CloudFormation
aws-cloudformation-describe-stacks
No
cloudformation:DescribeStacks, cloudformation:DescribeStackResources, cloudformation:GetStackPolicy, cloudformation:GetTemplate, cloudformation:ListStacks
Amazon ElastiCache
Amazon ElastiCache
aws-elasticache-describe-replication-groups
Yes
elasticache:DescribeReplicationGroups
Amazon ElastiCache
aws-elasticache-reserved-cache-nodes
No
elasticache:DescribeReservedCacheNodes
Amazon ElastiCache
aws-cache-engine-versions
No
elasticache:DescribeCacheEngineVersions
Amazon ElastiCache
aws-elasticache-subnet-groups
No
elasticache:DescribeCacheSubnetGroups
Amazon ElastiCache
aws-elasticache-cache-clusters
Yes
elasticache:DescribeCacheClusters
Amazon ElastiCache
aws-elasticache-snapshots
No
elasticache:DescribeSnapshots
Amazon ElastiCache
aws-elasticache-user
No
elasticache:DescribeUsers
Amazon ElastiCache
aws-elasticache-serverless-cache
No
elasticache:DescribeServerlessCaches elasticache:ListTagsForResource
Amazon Kinesis
Amazon Kinesis
aws-kinesis-list-streams
Yes
kinesis:ListStreams, kinesis:DescribeStream, kinesis:ListTagsForStream
Amazon Elastic Load Balancing
Amazon Elastic Load Balancing
aws-elb-describe-load-balancers*
Yes
elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeTags
Amazon Elastic Load Balancing
aws-elbv2-describe-load-balancers*
Yes
elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth, elasticloadbalancing:DescribeTags, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeListeners
Amazon Elastic Load Balancing
aws-describe-ssl-policies
No
elasticloadbalancing:DescribeSSLPolicies
Amazon Elastic Load Balancing
aws-elbv2-target-group*
Yes
elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTags
Amazon Elastic Load Balancing
aws-elbv2-target-health
No
elasticloadbalancing:DescribeTargetHealth
Amazon Cognito
Amazon Cognito
aws-cognito-identity-pool
No
cognito:ListIdentityPools, cognito:ListTagsForResource, cognito:DescribeIdentityPool
Amazon Cognito
aws-cognito-user-pool
No
cognito:ListUserPools, cognito:ListTagsForResource, cognito-idp:DescribeUserPool
Amazon Cognito
aws-cognito-sync-pool-usage
No
cognito-sync:ListIdentityPoolUsage
Amazon Cognito
aws-cognito-user-pool-client
No
cognito-idp:ListUserPools cognito-idp:ListUserPoolClients cognito-idp:DescribeUserPoolClient
Amazon Cognito
aws-cognito-user
No
cognito-idp:ListUserPools cognito-idp:ListUsers
Amazon Cognito
aws-cognito-user-pool-group
No
cognito-idp:ListUserPools cognito-idp:ListGroups cognito-idp:GetGroup
Amazon Cognito
aws-cognito-identity-pool-role
No
cognito-identity:ListIdentityPools cognito-identity:GetIdentityPoolRoles
Amazon Cognito
aws-cognito-identity-provider
No
cognito-idp:ListUserPools cognito-idp:ListIdentityProviders cognito-idp:DescribeIdentityProvider
Amazon GuardDuty
Amazon GuardDuty
aws-guardduty-detector
No
guardduty:ListDetectors, guardduty:GetDetector
Amazon GuardDuty
aws-guardduty-organization-configuration
No
guardduty:ListDetectors guardduty:DescribeOrganizationConfiguration
Amazon GuardDuty
aws-guardduty-threat-ip-list
No
guardduty:ListDetectors guardduty:ListThreatIntelSets guardduty:GetThreatIntelSet
Amazon GuardDuty
aws-guardduty-trusted-ip-list
No
guardduty:ListDetectors guardduty:ListIPSets guardduty:GetIPSet
Amazon GuardDuty
aws-guardduty-member-account-admin-info
No
guardduty:ListDetectors guardduty:GetAdministratorAccount
Amazon GuardDuty
aws-guardduty-publishing-destination
guardduty:ListDetectors guardduty:ListPublishingDestinations guardduty:DescribePublishingDestination
AWS Elastic Beanstalk
AWS Elastic Beanstalk
aws-elasticbeanstalk-environment
No
elasticbeanstalk:DescribeEnvironments, elasticbeanstalk:DescribeEnvironmentResources, elasticbeanstalk:ListTagsForResource
AWS Elastic Beanstalk
aws-elasticbeanstalk-configuration-settings
No
elasticbeanstalk:DescribeConfigurationSettings, s3:GetObject (only for "Resource": "arn:aws:s3:::elasticbeanstalk-*/*")
Amazon MQ
Amazon MQ
aws-mq-broker
Yes
mq:ListBrokers, mq:DescribeBroker
Amazon MQ
aws-mq-configuration
Yes
mq:ListConfigurations
AWS Glue
AWS Glue
aws-glue-security-configuration
No
glue:GetSecurityConfigurations
AWS Glue
aws-glue-connection
Yes
glue:GetConnections
AWS Glue
aws-glue-datacatalog
No
glue:GetDataCatalogEncryptionSettings
AWS Glue
aws-glue-crawler
No
glue:GetCrawlers glue:ListCrawlers
AWS Glue
aws-glue-job
No
glue:GetJobs
AWS Glue
aws-glue-schema
No
glue:ListSchemas glue:GetSchema
AWS Glue
aws-glue-resource-policy
No
glue:GetResourcePolicies
AWS Glue
aws-glue-database
No
glue:GetDatabases
AWS Glue
aws-glue-trigger
No
glue:GetTriggers
AWS Glue
aws-glue-dev-endpoint
No
glue:GetDevEndpoints
AWS Glue
aws-glue-blueprint
No
glue:ListBlueprints glue:GetBlueprint glue:GetTags
AWS Glue
aws-glue-blueprint-run
No
glue:GetBlueprintRuns glue:GetBlueprintRun
AWS Glue
aws-glue-ml-transform
No
glue:GetMLTransforms
AWS WAF
AWS WAF
aws-waf-v2-web-acl-resource
Yes
wafv2:ListWebACLs, wafv2:ListResourcesForWebACL,wafv2:GetLoggingConfiguration
AWS WAF
aws-waf-classic-web-acl-resource
Yes
waf-regional:ListWebACLs, waf-regional:ListResourcesForWebACL,waf-regional:GetLoggingConfiguration
AWS WAF
aws-waf-classic-global-web-acl-resource
Yes
waf:ListWebACLs,waf:GetWebACL, waf:ListTagsForResource, waf:GetLoggingConfiguration
AWS WAF
aws-waf-v2-global-web-acl-resource
No
wafv2:ListWebACLs, wafv2:GetWebACL, wafv2:GetLoggingConfiguration, wafv2:ListTagsForResource
AWS WAF
aws-waf-v2-rule-group
No
wafv2:ListRuleGroups
AWS WAF
aws-waf-classic-global-ip-set
No
waf:ListIPSets waf:GetIPSet
AWS WAF
aws-waf-classic-regional-ip-set
No
waf-regional:ListIPSets waf-regional:GetIPSet
AWS WAF
aws-waf-v2-global-ip-set
No
wafv2:ListIPSets wafv2:GetIPSet
AWS WAF
aws-waf-v2-regional-ip-set
No
wafv2:ListIPSets wafv2:GetIPSet
AWS WAF
aws-waf-v2-global-rule-group
No
wafv2:ListRuleGroups wafv2:GetRuleGroup
AWS Direct Connect Gateway
AWS Direct Connect Gateway
aws-direct-connect-gateway
No
directconnect:DescribeDirectConnectGateways
AWS Direct Connect Gateway
aws-direct-connect-connection
No
directconnect:DescribeConnections
AWS Direct Connect Gateway
aws-direct-connect-interface
No
directconnect:DescribeVirtualInterfaces
AWS Organizations
AWS Organizations
aws-organization
No
organization:DescribeRoot, organization:ListPoliciesforTarget, organization:ListRoots, organization:ListChildren
AWS Organizations
aws-organizations-root
No
organization:ListRoots,organization:ListPolicy
AWS Organizations
aws-organizations-ou
No
organization:DescribeChild, organization:ListPoliciesforTarget, organization:ListChildren
AWS Organizations
aws-organizations-account
No
organization:DescribeChild, organization:ListPoliciesforTarget, organization:ListTagsForResource
AWS Organizations
aws-organizations-scp
No
organization:DescribePolicy
AWS Organizations
aws-organizations-tag-policy
No
organizations:DescribeOrganization organizations:ListRoots organizations:ListChildren organizations:DescribePolicy
AWS Organizations
aws-organizations-delegated-services-for-account
No
organizations:ListDelegatedServicesForAccount
AWS Organizations
aws-organizations-aws-service-access-for-organization
No
organizations:ListAWSServiceAccessForOrganization
Amazon SageMaker
Amazon SageMaker
aws-sagemaker-notebook-instance
Yes
sagemaker:ListNotebookInstances, sagemaker:DescribeNotebookInstance, sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-endpoint
No
sagemaker:DescribeEndpoint, sagemaker:ListEndpoints, sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-model
No
sagemaker:DescribeModel, sagemaker:ListModels, sagemaker: ListTags
Amazon SageMaker
aws-sagemaker-endpoint-config
No
sagemaker:ListEndpointConfigs, sagemaker:DescribeEndpointConfig, sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-domain
No
sagemaker:ListDomains, sagemaker:DescribeDomain, sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-training-job
No
sagemaker:DescribeTrainingJob sagemaker:ListTrainingJobs sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-user-profile
No
sagemaker:ListUserProfiles sagemaker:DescribeUserProfile sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-processing-job
No
sagemaker:ListProcessingJobs sagemaker:DescribeProcessingJob
Amazon SageMaker
aws-sagemaker-code-repository
No
sagemaker:ListCodeRepositories sagemaker:DescribeCodeRepository
Amazon SageMaker
aws-sagemaker-labeling-job
No
sagemaker:ListLabelingJobs sagemaker:DescribeLabelingJob
Amazon SageMaker
aws-sagemaker-notebook-instance-lifecycle-config
No
sagemaker:ListNotebookInstanceLifecycleConfigs sagemaker:DescribeNotebookInstanceLifecycleConfig
Amazon SageMaker
aws-sagemaker-studio-lifecycle-config
No
sagemaker:ListStudioLifecycleConfigs sagemaker:DescribeStudioLifecycleConfig
Amazon SageMaker
aws-sagemaker-model-package-group
sagemaker:ListModelPackageGroups sagemaker:DescribeModelPackageGroup sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-image
sagemaker:ListImages sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-feature-group
sagemaker:ListFeatureGroups sagemaker:DescribeFeatureGroup sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-app
sagemaker:ListApps sagemaker:DescribeApp
Amazon SageMaker
aws-batch-scheduling-policy
batch:ListSchedulingPolicies batch:DescribeSchedulingPolicies
Amazon SageMaker
aws-sagemaker-project
sagemaker:ListProjects sagemaker:DescribeProject sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-pipeline
sagemaker:ListPipelines sagemaker:DescribePipeline sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-data-quality-job-definition
sagemaker:ListDataQualityJobDefinitions sagemaker:DescribeDataQualityJobDefinition sagemaker:ListTags
Amazon SageMaker
aws-sagemaker-flow-definition
sagemaker:ListFlowDefinitions sagemaker:DescribeFlowDefinition sagemaker:ListTags
AWS Database Migration Service
AWS Database Migration Service
aws-dms-replication-instance
No
dms:DescribeReplicationInstances, dms:ListTagsForResource
AWS Database Migration Service
aws-dms-certificate
Yes
dms:DescribeCertificates, dms:ListTagsForResource
AWS Database Migration Service
aws-dms-endpoint
Yes
dms:DescribeEndpoints, dms:ListTagsForResource
AWS Database Migration Service
aws-dms-replication-task
No
dms:DescribeReplicationTasks dms:ListTagsForResource
AWS Database Migration Service
aws-dms-data-provider
dms:DescribeDataProviders dms:ListTagsForResource
AWS Database Migration Service
aws-dms-replication-config
dms:DescribeReplicationConfigs dms:ListTagsForResource
AWS Database Migration Service
aws-dms-replication-subnet-group
dms:DescribeReplicationSubnetGroups dms:ListTagsForResource
AWS Database Migration Service
aws-dms-instance-profile
dms:ListInstanceProfiles dms:ListTagsForResource
Amazon Kinesis Firehose
Amazon Kinesis Firehose
aws-kinesis-firehose-delivery-stream
Yes
firehose:DescribeDeliveryStream, firehose:ListDeliveryStreams, firehose:ListTagsForDeliveryStream
AWS CloudSearch
AWS CloudSearch
aws-cloudsearch-domain
No
cloudsearch:DescribeDomains
AWS Directory Service
AWS Directory Service
aws-ds-directory
No
ds:DescribeDirectories, ds:ListTagsForResource
AWS Directory Service
aws-ds-directory-trust
No
ds:DescribeTrusts
AWS Directory Service
aws-ds-log-subscription
No
ds:ListLogSubscriptions
AWS Access Analyzer
AWS Access Analyzer
aws-access-analyzer
Yes
access-analyzer:ListAnalyzers
AWS Regions
AWS Regions
aws-region
No
ec2:DescribeRegions
AWS Backup
AWS Backup
aws-backup-vault-access-policy
No
backup:GetBackupVaultAccessPolicy, backup:ListBackupVaults,backup:ListTags
AWS Backup
aws-backup-backup-plan
No
backup:ListBackupPlans backup:GetBackupPlan backup:ListTags
AWS Backup
aws-backup-protected-resources
No
backup:ListProtectedResources
AWS Backup
aws-backup-backup-selection
No
backup:GetBackupSelection backup:ListBackupSelections
AWS Backup
aws-backup-report-plan
No
backup:DescribeReportPlan backup:ListTags backup:ListReportPlans
AWS Backup
aws-backup-framework
No
backup:DescribeFramework backup:ListTags backup:ListFrameworks
AWS Code Build
AWS Code Build
aws-code-build-project
No
codebuild:BatchGetProjects codebuild:ListProjects
AWS Code Build
aws-code-build-source-credential
No
codebuild:ListSourceCredentials
AWS Code Build
aws-code-build-report-group
codebuild:BatchGetReportGroups codebuild:ListReportGroups
AWS Transfer Family
AWS Transfer Family
aws-transfer-family-server
No
transfer:DescribeServer transfer:ListServers
AWS Transfer Family
aws-transfer-family-access
No
transfer:ListAccesses transfer:DescribeAccess
AWS Transfer Family
aws-transfer-family-user
No
transfer:ListUsers transfer:DescribeUser
AWS Transfer Family
aws-transfer-family-security-policy
No
transfer:DescribeSecurityPolicy transfer:DescribeServer transfer:ListServers
AWS Service Quotas
AWS Service Quotas
aws-servicequotas-service-quota
servicequotas:ListServiceQuotas servicequotas:ListTagsForResource
AWS Shield
AWS Shield
aws-shield-advanced-status
No
shield:GetSubscriptionState
AWS Shield
aws-shield-protections
No
shield:GetSubscriptionState, shield:ListProtections, shield:ListTagsForResource
AWS Shield
aws-shield-protection-groups
No
shield:GetSubscriptionState, shield:ListProtectionGroups, shield:ListResourcesInProtectionGroup, shield:ListTagsForResource
AWS Shield
aws-shield-drt-access
No
shield:DescribeDRTAccess
Amazon MSK
Amazon MSK
aws-msk-cluster
No
kafka:ListClusters
Amazon MSK
aws-msk-vpc-connection
No
kafka:ListVpcConnections kafka:DescribeVpcConnection
Amazon MSK
aws-msk-configuration
No
kafka:ListConfigurations kafka:DescribeConfiguration
Amazon MSK
aws-msk-clusterV2
No
kafka:ListClustersV2
Amazon Athena
Amazon Athena
aws-athena-workgroup
No
athena:ListWorkGroups athena:GetWorkGroup
Amazon Athena
aws-athena-table-metadata
No
athena:ListDataCatalogs athena:ListDatabases athena:ListTableMetadata glue:GetTables
Amazon Athena
aws-athena-capacity-reservation
No
athena:ListCapacityReservations athena:GetCapacityReservation
Amazon Athena
aws-athena-namedquery
No
athena:ListWorkGroups athena:ListNamedQueries athena:GetNamedQuery
Amazon Athena
aws-athena-workgroup
No
athena:ListWorkGroups athena:GetWorkGroup
Amazon Athena
aws-athena-database
No
athena:ListDataCatalogs athena:ListDatabases athena:GetDatabase glue:GetDatabase
Amazon QuickSight
Amazon QuickSight
aws-quicksight-datasource
No
quicksight:ListDataSources,quicksight:ListTagsForResource
Amazon QuickSight
aws-quicksight-dataset
No
quicksight:ListDataSets,quicksight:ListTagsForResource
Amazon QuickSight
aws-quicksight-account-setting
No
quicksight:DescribeAccountSettings
Amazon QuickSight
aws-quicksight-ip-restriction
No
quicksight:DescribeIpRestriction
Amazon QuickSight
aws-quicksight-iam-policy-assignment
No
quicksight:DescribeIAMPolicyAssignment quicksight:ListNamespaces quicksight:ListIAMPolicyAssignments
Amazon QuickSight
aws-quicksight-user
No
quicksight:ListUsers quicksight:DescribeUser
Amazon SES
Amazon SES
aws-ses-identities
No
ses:GetIdentityDkimAttributes ses:GetIdentityPolicies ses:ListIdentityPolicies ses:ListIdentities
Amazon SES
aws-ses-configuration-set
No
ses:ListConfigurationSets ses:DescribeConfigurationSet
Amazon SES
aws-ses-receipt-rule-set
No