An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.
Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.
You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.
For more information, see AWS managed policies in the IAM User Guide.
AmazonOpenSearchDirectQueryGlueCreateAccess
Grants Amazon OpenSearch Service Direct Query Service access to the CreateDatabase,
CreatePartition,CreateTable, and
BatchCreatePartition AWS Glue API.
You can find the AmazonOpenSearchDirectQueryGlueCreateAccess
AmazonOpenSearchServiceFullAccess
Grants full access to the OpenSearch Service configuration API operations and resources for an AWS account.
You can find the AmazonOpenSearchServiceFullAccess
AmazonOpenSearchServiceReadOnlyAccess
Grants read-only access to all OpenSearch Service resources for an AWS account.
You can find the AmazonOpenSearchServiceReadOnlyAccess
AmazonOpenSearchServiceRolePolicy
You can't attach AmazonOpenSearchServiceRolePolicy to your IAM
entities. This policy is attached to a service-linked role that allows OpenSearch Service to
access account resources. For more information, see Permissions.
You can find the AmazonOpenSearchServiceRolePolicy
AmazonOpenSearchServiceCognitoAccess
Provides the minimum Amazon Cognito permissions necessary to enable Cognito authentication.
You can find the AmazonOpenSearchServiceCognitoAccess
AmazonOpenSearchIngestionServiceRolePolicy
You can't attach AmazonOpenSearchIngestionServiceRolePolicy to your
IAM entities. This policy is attached to a service-linked role that allows
OpenSearch Ingestion to enable VPC access for ingestion pipelines, create tags, and
publish ingestion-related CloudWatch metrics to your account. For more information, see
Using service-linked roles for Amazon OpenSearch Service.
You can find the AmazonOpenSearchIngestionServiceRolePolicy
OpenSearchIngestionSelfManagedVpcePolicy
You can't attach OpenSearchIngestionSelfManagedVpcePolicy to your
IAM entities. This policy is attached to a service-linked role that allows
OpenSearch Ingestion to enable self-managed VPC access for ingestion pipelines, create
tags, and publish ingestion-related CloudWatch metrics to your account. For more
information, see Using service-linked roles for Amazon OpenSearch Service.
You can find the OpenSearchIngestionSelfManagedVpcePolicy
AmazonOpenSearchIngestionFullAccess
Grants full access to the OpenSearch Ingestion API operations and resources for an AWS account.
You can find the AmazonOpenSearchIngestionFullAccess
AmazonOpenSearchIngestionReadOnlyAccess
Grants read-only access to all OpenSearch Ingestion resources for an AWS account.
You can find the AmazonOpenSearchIngestionReadOnlyAccess
AmazonOpenSearchServerlessServiceRolePolicy
Provides the minimum Amazon CloudWatch permissions necessary to send OpenSearch Serverless metric data to CloudWatch.
You can find the AmazonOpenSearchServerlessServiceRolePolicy
OpenSearch Service updates to AWS managed policies
View details about updates to AWS managed policies for OpenSearch Service since this service began tracking changes.
| Change | Description | Date |
|---|---|---|
|
Updated |
Added the Sid |
12 July 2024 |
|
Added |
A new policy that allows OpenSearch Ingestion to enable self-managed VPC access for ingestion pipelines, create tags, and publish ingestion-related CloudWatch metrics to your account. For the policy JSON, see the IAM console |
12 June 2024 |
|
Added |
Grants Amazon OpenSearch Service Direct Query Service access to the |
6 May 2024 |
|
Updated |
Added the permissions necessary for the service-linked role to assign and unassign IPv6 addresses. The deprecated Elasticsearch policy has also been updated to ensure backwards compatibility. |
18 October 2023 |
|
Added
|
A new policy that allows OpenSearch Ingestion to enable VPC access for ingestion pipelines, create tags, and publish ingestion-related CloudWatch metrics to your account. For the policy JSON, see the IAM console |
26 April 2023 |
|
Added
|
A new policy that grants full access to the OpenSearch Ingestion API operations and resources for an AWS account. For the policy JSON, see the IAM console |
26 April 2023 |
|
Added
|
A new policy that grants read-only access to all OpenSearch Ingestion resources for an AWS account. For the policy JSON, see the IAM console |
26 April 2023 |
|
Added
|
A new policy that provides the minimum permissions necessary to send OpenSearch Serverless metric data to Amazon CloudWatch. For the policy JSON, see the IAM console |
29 November 2022 |
|
Updated |
Added the permissions necessary for the service-linked role to
create OpenSearch Service-managed VPC
endpoints. Some actions can only be performed when
the request contains the tag
The deprecated Elasticsearch policy has also been updated to ensure backwards compatibility. |
7 November 2022 |
|
Updated |
Added support for the The deprecated Elasticsearch policy has also been updated to ensure backwards compatibility. For the policy JSON, see the IAM console |
12 September 2022 |
|
Updated |
Added support for the The deprecated Elasticsearch policy has also been updated to ensure backwards compatibility. |
28 July 2022 |
|
Updated |
Added support for the Corrected permissions for the
The deprecated Elasticsearch policy has also been updated to ensure backwards compatibility. |
20 December 2021 |
|
Updated |
Added support for the |
9 September 2021 |
|
This new policy is meant to replace the old policy. Both policies provide full access to the OpenSearch Service configuration API and all HTTP methods for the OpenSearch APIs. Fine-grained access control and resource-based policies can still restrict access. |
7 September 2021 |
|
This new policy is meant to replace the old policy. Both
policies provide read-only access to the OpenSearch Service configuration API
( |
7 September 2021 |
|
This new policy is meant to replace the old policy. Both policies provide the minimum Amazon Cognito permissions necessary to enable Cognito authentication. |
7 September 2021 |
|
This new policy is meant to replace the old policy. Both policies provide the minimum Amazon EC2 and Elastic Load Balancing permissions necessary for the service-linked role to enable VPC access. |
7 September 2021 |
|
Started tracking changes |
Amazon OpenSearch Service now tracks changes to AWS-managed policies. |
7 September 2021 |
