Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
# DevOps Izin Agen IAM
AWS DevOps Agen menggunakan tindakan AWS Identity and Access Management (IAM) khusus layanan untuk mengontrol akses ke fitur dan kemampuannya. Tindakan ini menentukan apa yang dapat dilakukan pengguna dalam konsol AWS DevOps Agen dan Aplikasi Web Operator. Ini terpisah dari izin API AWS layanan yang digunakan agen itu sendiri untuk menyelidiki sumber daya Anda.
Untuk informasi selengkapnya tentang membatasi akses agen, lihat [Membatasi Akses Agen di AWS Akun.](https://docs.aws.amazon.com/devopsagent/latest/userguide/aws-devops-agent-security-limiting-agent-access-in-an-aws-account.html)
## Tindakan manajemen Ruang Agen
Tindakan ini mengontrol akses ke konfigurasi dan manajemen Ruang Agen:
+ **aidevops: GetAgentSpace** — Memungkinkan pengguna untuk melihat detail tentang Ruang Agen, termasuk konfigurasi, status, dan akun terkaitnya. Pengguna memerlukan izin ini untuk mengakses Ruang Agen di Konsol AWS Manajemen.
+ **aidevops: GetAssociation** — Memungkinkan pengguna untuk melihat detail tentang asosiasi akun tertentu, termasuk konfigurasi peran IAM dan status koneksi.
+ **aidevops: ListAssociations** — Memungkinkan pengguna untuk mencantumkan semua asosiasi AWS akun yang dikonfigurasi untuk Ruang Agen, termasuk akun primer dan sekunder.
## Investigasi dan tindakan eksekusi
Tindakan ini mengontrol akses ke fitur investigasi insiden:
+ **aidevops: ListExecutions** — Memungkinkan pengguna untuk melihat metadata eksekusi—termasuk ID, status, dan lainnya—untuk investigasi, mitigasi, evaluasi, dan percakapan obrolan yang terkait dengan tugas.
+ **aidevops: ListJournalRecords** — Memungkinkan pengguna untuk mengakses log terperinci yang menunjukkan langkah-langkah penalaran agen, tindakan yang diambil, dan sumber data yang dikonsultasikan selama penyelidikan, mitigasi, evaluasi, dan percakapan obrolan. Ini berguna untuk memahami bagaimana agen mencapai kesimpulannya.
## Tindakan manajemen obrolan
Obrolan memerlukan izin IAM berikut agar berfungsi:
+ **aidevops: ListChats** — Memungkinkan pengguna untuk membuat daftar dan mengakses riwayat percakapan obrolan.
+ **aidevops: CreateChat** — Memungkinkan pengguna untuk membuat percakapan obrolan baru.
+ **aidevops: SendMessage** — Memungkinkan pengguna untuk mengirimkan pertanyaan dan menerima tanggapan streaming.
## Topologi dan tindakan penemuan
Tindakan ini mengontrol akses ke fitur pemetaan sumber daya aplikasi:
+ **aidevops: DiscoverTopology** — Memungkinkan pengguna untuk memicu penemuan topologi dan pemetaan untuk Ruang Agen. Tindakan ini memulai proses pemindaian AWS akun dan membangun topologi sumber daya aplikasi.
## Tindakan pencegahan dan rekomendasi
Tindakan ini mengontrol akses ke fitur Pencegahan:
+ **aidevops: ListGoals** - Memungkinkan pengguna untuk melihat tujuan dan sasaran pencegahan yang sedang dikerjakan agen berdasarkan pola insiden baru-baru ini.
+ **aidevops: ListRecommendations** — Memungkinkan pengguna untuk melihat semua rekomendasi yang dihasilkan oleh fitur Pencegahan, termasuk prioritas dan kategori mereka.
+ **aidevops: GetRecommendation** — Memungkinkan pengguna untuk melihat informasi terperinci tentang rekomendasi tertentu, termasuk insiden yang akan dicegah dan panduan implementasi.
## Tindakan manajemen tugas backlog
Tindakan ini mengontrol kemampuan untuk mengelola rekomendasi sebagai tugas backlog:
+ **aidevops: CreateBacklogTask** - Memungkinkan pengguna untuk membuat investigasi insiden atau tugas evaluasi pencegahan.
+ **aidevops: UpdateBacklogTask** — Memungkinkan pengguna untuk menyetujui rencana mitigasi atau membatalkan penyelidikan atau evaluasi aktif.
+ **aidevops: GetBacklogTask** — Memungkinkan pengguna untuk mengambil detail tentang tugas tertentu.
+ **aidevops: ListBacklogTasks** — Memungkinkan pengguna membuat daftar tugas untuk Ruang Agen, difilter berdasarkan jenis tugas, status, prioritas, atau waktu pembuatan.
## Tindakan manajemen pengetahuan
Tindakan ini mengontrol kemampuan untuk menambah dan mengelola pengetahuan khusus yang dapat digunakan agen selama investigasi:
+ **aidevops: CreateKnowledgeItem** — Memungkinkan pengguna untuk menambahkan item pengetahuan khusus, seperti keterampilan, panduan pemecahan masalah, atau informasi khusus aplikasi yang harus dirujuk agen.
+ **aidevops: ListKnowledgeItems** — Memungkinkan pengguna untuk melihat semua item pengetahuan yang dikonfigurasi untuk Ruang Agen.
+ **aidevops: GetKnowledgeItem** — Memungkinkan pengguna untuk mengambil detail item pengetahuan tertentu.
+ **aidevops: UpdateKnowledgeItem** — Memungkinkan pengguna untuk memodifikasi item pengetahuan yang ada untuk menjaga informasi tetap terkini.
+ **aidevops: DeleteKnowledgeItem** — Memungkinkan pengguna untuk menghapus item pengetahuan yang tidak lagi relevan.
## AWS Support tindakan integrasi
Tindakan ini mengontrol integrasi dengan kasus AWS Support:
+ **aidevops: InitiateChatForCase** — Memungkinkan pengguna untuk memulai sesi obrolan dengan AWS Support langsung dari penyelidikan, secara otomatis memberikan konteks tentang insiden tersebut.
+ **aidevops: EndChatForCase** — Memungkinkan pengguna untuk mengakhiri sesi obrolan kasus AWS Support yang aktif.
+ **aidevops: DescribeSupportLevel** — Memungkinkan pengguna untuk memeriksa level paket AWS Support untuk akun untuk menentukan opsi dukungan yang tersedia.
## Tindakan penggunaan dan pemantauan
Tindakan ini mengontrol akses ke informasi penggunaan:
+ **aidevops: GetAccountUsage** — Memungkinkan pengguna untuk melihat kuota bulanan AWS DevOps Agen untuk jam investigasi, jam evaluasi pencegahan, dan permintaan obrolan, serta penggunaan bulan berjalan.
## Contoh kebijakan IAM umum
### Kebijakan administrator
Kebijakan ini memberikan akses penuh ke semua fitur AWS DevOps Agen:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "aidevops:*",
"Resource": "*"
}
]
}
```
### Kebijakan operator
Kebijakan ini memberikan akses ke fitur investigasi dan pencegahan tanpa kemampuan administratif:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"aidevops:GetAgentSpace",
"aidevops:InvokeAgent",
"aidevops:ListExecutions",
"aidevops:ListJournalRecords",
"aidevops:ListAssociations",
"aidevops:GetAssociation",
"aidevops:DiscoverTopology",
"aidevops:ListRecommendations",
"aidevops:GetRecommendation",
"aidevops:CreateBacklogTask",
"aidevops:UpdateBacklogTask",
"aidevops:GetBacklogTask",
"aidevops:ListBacklogTasks",
"aidevops:ListKnowledgeItems",
"aidevops:GetKnowledgeItem",
"aidevops:InitiateChatForCase",
"aidevops:EndChatForCase",
"aidevops:ListChats",
"aidevops:CreateChat",
"aidevops:SendMessage",
"aidevops:ListGoals",
"aidevops:CreateKnowledgeItem",
"aidevops:UpdateKnowledgeItem",
"aidevops:DescribeSupportLevel",
"aidevops:ListPendingMessages"
],
"Resource": "*"
}
]
}
```
### Kebijakan hanya-baca
Kebijakan ini memberikan akses hanya lihat ke investigasi dan rekomendasi:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"aidevops:GetAgentSpace",
"aidevops:ListAssociations",
"aidevops:GetAssociation",
"aidevops:ListExecutions",
"aidevops:ListJournalRecords",
"aidevops:ListRecommendations",
"aidevops:GetRecommendation",
"aidevops:ListBacklogTasks",
"aidevops:GetBacklogTask",
"aidevops:ListKnowledgeItems",
"aidevops:GetKnowledgeItem",
"aidevops:GetAccountUsage"
],
"Resource": "*"
}
]
}
```
## Menggunakan peran terkait layanan untuk Agen AWS DevOps
AWS DevOps [Agen menggunakan peran AWS terkait layanan Identity and Access Management (IAM).](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) Peran terkait layanan adalah jenis peran IAM unik yang ditautkan langsung ke Agen. AWS DevOps Peran terkait layanan telah ditentukan sebelumnya oleh AWS DevOps Agen dan mencakup semua izin yang diperlukan layanan untuk memanggil AWS layanan lain atas nama Anda.
### Izin peran terkait layanan
Peran terkait layanan `AWSServiceRoleForAIDevOps` mempercayai layanan utama `aidevops.amazonaws.com` untuk memegang peran tersebut.
Peran menggunakan kebijakan terkelola `AWSServiceRoleForAIDevOpsPolicy` dengan izin berikut:
+ `cloudwatch:PutMetricData`— Publikasikan metrik penggunaan ke `AWS/AIDevOps` CloudWatch namespace. Dicakup oleh `cloudwatch:namespace` kondisi untuk hanya mengizinkan namespace. `AWS/AIDevOps`
+ `vpc-lattice:CreateResourceGateway`— Buat gateway sumber daya VPC Lattice untuk koneksi pribadi. Dicakup oleh `aws:RequestTag/AWSAIDevOpsManaged` kondisi sehingga layanan hanya dapat membuat gateway sumber daya yang membawa tag. `AWSAIDevOpsManaged`
+ `vpc-lattice:TagResource`— Tag gateway sumber daya Kisi VPC. Tercakup oleh suatu `aws:RequestTag/AWSAIDevOpsManaged` kondisi.
+ `vpc-lattice:DeleteResourceGateway`— Hapus gateway sumber daya VPC Lattice. Dicakup oleh suatu `aws:ResourceTag/AWSAIDevOpsManaged` kondisi sehingga layanan hanya dapat menghapus gateway sumber daya yang dibuatnya.
+ `vpc-lattice:GetResourceGateway`— Ambil informasi tentang gateway sumber daya VPC Lattice. Dicakup oleh suatu `aws:ResourceTag/AWSAIDevOpsManaged` kondisi sehingga layanan hanya dapat membaca gateway sumber daya yang dibuatnya.
+ `ec2:DescribeVpcs`,`ec2:DescribeSubnets`, `ec2:DescribeSecurityGroups` — Ambil informasi tentang sumber daya jaringan VPC yang diperlukan untuk mengonfigurasi gateway sumber daya. Tindakan hanya-baca ini berlaku untuk semua sumber daya VPC karena EC2 API tidak mendukung izin tingkat sumber daya untuk panggilan Deskripsikan.
+ `iam:CreateServiceLinkedRole`— Buat peran terkait layanan VPC Lattice yang diperlukan untuk operasi gateway sumber daya. Izin ini hanya mencakup prinsip `vpc-lattice.amazonaws.com` layanan dan tidak dapat digunakan untuk membuat peran terkait layanan untuk layanan lainnya.
### Membuat peran terkait layanan
Anda tidak perlu membuat peran tertaut layanan `AWSServiceRoleForAIDevOps` secara manual. Saat Anda mulai menggunakan AWS DevOps Agen, layanan akan menciptakan peran terkait layanan untuk Anda.
Untuk memungkinkan layanan membuat peran atas nama Anda, Anda harus memiliki `iam:CreateServiceLinkedRole` izin. Kami merekomendasikan pelingkupan izin ini dengan `iam:AWSServiceName` syarat `aidevops.amazonaws.com` untuk mengikuti prinsip hak istimewa paling sedikit. Untuk informasi selengkapnya, lihat Izin [peran terkait layanan](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions).
### Mengedit peran terkait layanan
Anda tidak dapat mengedit peran yang terhubung dengan layanan `AWSServiceRoleForAIDevOps`. Setelah peran dibuat, Anda tidak dapat mengubah nama peran karena berbagai entitas mungkin mereferensikan peran berdasarkan nama. Namun, Anda dapat mengedit penjelasan peran menggunakan IAM. Untuk informasi selengkapnya, lihat [Mengedit peran terkait layanan](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role).
### Menghapus peran tertaut layanan
Jika Anda tidak perlu lagi menggunakan AWS DevOps Agen, kami sarankan Anda menghapus peran `AWSServiceRoleForAIDevOps` terkait layanan. Sebelum Anda dapat menghapus peran, Anda harus terlebih dahulu menghapus koneksi pribadi yang dikonfigurasi di Ruang Agen Anda. Menghapus peran terkait layanan tidak secara otomatis menghapus gateway sumber daya VPC Lattice yang ditandai dengan yang sebelumnya dibuat oleh layanan. `AWSAIDevOpsManaged` Anda harus menghapus gateway sumber daya ini secara manual jika tidak lagi diperlukan. Untuk informasi selengkapnya, lihat [Menghapus peran terkait layanan](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role).
## AWS Kebijakan terkelola untuk AWS DevOps Agen
AWS mengatasi banyak kasus penggunaan umum dengan menyediakan kebijakan IAM mandiri yang dibuat dan dikelola oleh. AWS Kebijakan AWS terkelola ini memberikan izin yang diperlukan untuk kasus penggunaan umum sehingga Anda dapat menghindari keharusan menyelidiki izin apa yang diperlukan. Untuk informasi selengkapnya, lihat [kebijakan AWS terkelola](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) di \$1Panduan Pengguna IAM\$1.
Kebijakan AWS terkelola berikut, yang dapat Anda lampirkan ke pengguna di akun Anda, khusus untuk AWS DevOps Agen.
### AIDevOpsAgentReadOnlyAccess
Menyediakan akses baca saja ke DevOps Agen Amazon melalui Konsol AWS Manajemen
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AIDevOpsAgentReadOnlyAccess",
"Effect": "Allow",
"Action": [
"aidevops:Get*",
"aidevops:List*",
"aidevops:SearchServiceAccessibleResource"
],
"Resource": "*"
}
]
}
```
### AIDevOpsAgentFullAccess
Menyediakan akses penuh ke Amazon DevOps Agent melalui AWS Management Console
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AIDevOpsAgentSpaceAccess",
"Effect": "Allow",
"Action": [
"aidevops:CreateAgentSpace",
"aidevops:DeleteAgentSpace",
"aidevops:GetAgentSpace",
"aidevops:ListAgentSpaces",
"aidevops:UpdateAgentSpace"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsServiceAccess",
"Effect": "Allow",
"Action": [
"aidevops:DeregisterService",
"aidevops:GetService",
"aidevops:ListServices",
"aidevops:RegisterService",
"aidevops:SearchServiceAccessibleResource"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsAssociationAccess",
"Effect": "Allow",
"Action": [
"aidevops:AssociateService",
"aidevops:DisassociateService",
"aidevops:GetAssociation",
"aidevops:ListAssociations",
"aidevops:UpdateAssociation",
"aidevops:ValidateAwsAssociations"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsWebhookAccess",
"Effect": "Allow",
"Action": [
"aidevops:ListWebhooks"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsOperatorAppAccess",
"Effect": "Allow",
"Action": [
"aidevops:DisableOperatorApp",
"aidevops:EnableOperatorApp",
"aidevops:GetOperatorApp",
"aidevops:UpdateOperatorAppIdpConfig"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsKnowledgeAccess",
"Effect": "Allow",
"Action": [
"aidevops:CreateKnowledgeItem",
"aidevops:DeleteKnowledgeItem",
"aidevops:GetKnowledgeItem",
"aidevops:ListKnowledgeItems",
"aidevops:ListKnowledgeItemVersions",
"aidevops:UpdateKnowledgeItem"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsBacklogAccess",
"Effect": "Allow",
"Action": [
"aidevops:CreateBacklogTask",
"aidevops:GetBacklogTask",
"aidevops:ListBacklogTasks",
"aidevops:ListGoals",
"aidevops:UpdateBacklogTask",
"aidevops:UpdateGoal"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsRecommendationAccess",
"Effect": "Allow",
"Action": [
"aidevops:GetRecommendation",
"aidevops:ListRecommendations",
"aidevops:UpdateRecommendation"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsAgentChatAccess",
"Effect": "Allow",
"Action": [
"aidevops:CreateChat",
"aidevops:ListChats",
"aidevops:ListPendingMessages",
"aidevops:SendMessage"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsJournalAccess",
"Effect": "Allow",
"Action": [
"aidevops:ListExecutions",
"aidevops:ListJournalRecords"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsTopologyAccess",
"Effect": "Allow",
"Action": [
"aidevops:DiscoverTopology"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsSupportAccess",
"Effect": "Allow",
"Action": [
"aidevops:DescribeSupportLevel",
"aidevops:EndChatForCase",
"aidevops:InitiateChatForCase"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsUsageAccess",
"Effect": "Allow",
"Action": [
"aidevops:GetAccountUsage"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsTaggingAccess",
"Effect": "Allow",
"Action": [
"aidevops:ListTagsForResource",
"aidevops:TagResource",
"aidevops:UntagResource"
],
"Resource": "*"
},
{
"Sid": "AIDevOpsVendedLogs",
"Effect": "Allow",
"Action": [
"aidevops:AllowVendedLogDeliveryForResource"
],
"Resource": "*"
}
]
}
```
### AIDevOpsOperatorAppAccessPolicy
Menyediakan akses untuk menggunakan aplikasi web AWS DevOps operator untuk Ruang Agen.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowOperatorAgentSpaceActions",
"Effect": "Allow",
"Action": [
"aidevops:GetAgentSpace",
"aidevops:GetAssociation",
"aidevops:ListAssociations",
"aidevops:CreateBacklogTask",
"aidevops:GetBacklogTask",
"aidevops:UpdateBacklogTask",
"aidevops:ListBacklogTasks",
"aidevops:ListJournalRecords",
"aidevops:DiscoverTopology",
"aidevops:ListGoals",
"aidevops:ListRecommendations",
"aidevops:ListExecutions",
"aidevops:GetRecommendation",
"aidevops:UpdateRecommendation",
"aidevops:CreateKnowledgeItem",
"aidevops:ListKnowledgeItems",
"aidevops:ListKnowledgeItemVersions",
"aidevops:GetKnowledgeItem",
"aidevops:UpdateKnowledgeItem",
"aidevops:DeleteKnowledgeItem",
"aidevops:ListPendingMessages",
"aidevops:InitiateChatForCase",
"aidevops:EndChatForCase",
"aidevops:DescribeSupportLevel",
"aidevops:ListChats",
"aidevops:CreateChat",
"aidevops:SendMessage"
],
"Resource": "arn:aws:aidevops:*:*:agentspace/${aws:PrincipalTag/AgentSpaceId}",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowOperatorAccountActions",
"Effect": "Allow",
"Action": [
"aidevops:GetAccountUsage"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowSupportOperatorActions",
"Effect": "Allow",
"Action": [
"support:DescribeCases",
"support:InitiateChatForCase",
"support:DescribeSupportLevel"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
}
```
### AIDevOpsAgentAccessPolicy
Memberikan izin yang diperlukan oleh AWS DevOps Agen untuk melakukan investigasi dan melakukan analisis pada sumber daya pelanggan AWS .
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AIOPSServiceAccess",
"Effect": "Allow",
"Action": [
"access-analyzer:GetAnalyzer",
"access-analyzer:List*",
"acm-pca:Describe*",
"acm-pca:GetCertificate",
"acm-pca:GetCertificateAuthorityCertificate",
"acm-pca:GetCertificateAuthorityCsr",
"acm-pca:List*",
"acm:DescribeCertificate",
"acm:GetAccountConfiguration",
"aidevops:GetKnowledgeItem",
"aidevops:ListKnowledgeItems",
"airflow:List*",
"amplify:GetApp",
"amplify:GetBranch",
"amplify:GetDomainAssociation",
"amplify:List*",
"aoss:BatchGetCollection",
"aoss:BatchGetLifecyclePolicy",
"aoss:BatchGetVpcEndpoint",
"aoss:GetAccessPolicy",
"aoss:GetSecurityConfig",
"aoss:GetSecurityPolicy",
"aoss:List*",
"appconfig:GetApplication",
"appconfig:GetConfigurationProfile",
"appconfig:GetEnvironment",
"appconfig:GetHostedConfigurationVersion",
"appconfig:List*",
"appflow:Describe*",
"appflow:List*",
"application-autoscaling:Describe*",
"application-signals:BatchGetServiceLevelObjectiveBudgetReport",
"application-signals:GetService",
"application-signals:GetServiceLevelObjective",
"application-signals:List*",
"applicationinsights:Describe*",
"applicationinsights:List*",
"apprunner:Describe*",
"apprunner:List*",
"appstream:Describe*",
"appstream:List*",
"appsync:GetApiAssociation",
"appsync:GetDataSource",
"appsync:GetDomainName",
"appsync:GetFunction",
"appsync:GetGraphqlApi",
"appsync:GetGraphqlApiEnvironmentVariables",
"appsync:GetIntrospectionSchema",
"appsync:GetResolver",
"appsync:GetSourceApiAssociation",
"appsync:List*",
"aps:Describe*",
"aps:List*",
"arc-zonal-shift:GetManagedResource",
"arc-zonal-shift:List*",
"athena:GetCapacityAssignmentConfiguration",
"athena:GetCapacityReservation",
"athena:GetDataCatalog",
"athena:GetNamedQuery",
"athena:GetPreparedStatement",
"athena:GetWorkGroup",
"athena:List*",
"auditmanager:GetAssessment",
"auditmanager:List*",
"autoscaling:Describe*",
"backup-gateway:GetHypervisor",
"backup-gateway:List*",
"backup:Describe*",
"backup:GetBackupPlan",
"backup:GetBackupSelection",
"backup:GetBackupVaultAccessPolicy",
"backup:GetBackupVaultNotifications",
"backup:GetRestoreTestingPlan",
"backup:GetRestoreTestingSelection",
"backup:List*",
"batch:DescribeComputeEnvironments",
"batch:DescribeJobQueues",
"batch:DescribeSchedulingPolicies",
"batch:List*",
"bedrock:GetAgent",
"bedrock:GetAgentActionGroup",
"bedrock:GetAgentAlias",
"bedrock:GetAgentKnowledgeBase",
"bedrock:GetDataSource",
"bedrock:GetGuardrail",
"bedrock:GetKnowledgeBase",
"bedrock:List*",
"budgets:Describe*",
"budgets:List*",
"ce:Describe*",
"ce:GetAnomalyMonitors",
"ce:GetAnomalySubscriptions",
"ce:List*",
"chatbot:Describe*",
"chatbot:GetMicrosoftTeamsChannelConfiguration",
"chatbot:List*",
"cleanrooms-ml:GetTrainingDataset",
"cleanrooms-ml:List*",
"cleanrooms:GetAnalysisTemplate",
"cleanrooms:GetCollaboration",
"cleanrooms:GetConfiguredTable",
"cleanrooms:GetConfiguredTableAnalysisRule",
"cleanrooms:GetConfiguredTableAssociation",
"cleanrooms:GetMembership",
"cleanrooms:List*",
"cloudformation:Describe*",
"cloudformation:GetResource",
"cloudformation:GetStackPolicy",
"cloudformation:GetTemplate",
"cloudformation:List*",
"cloudfront:Describe*",
"cloudfront:GetCachePolicy",
"cloudfront:GetCloudFrontOriginAccessIdentity",
"cloudfront:GetContinuousDeploymentPolicy",
"cloudfront:GetDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:GetFunction",
"cloudfront:GetKeyGroup",
"cloudfront:GetMonitoringSubscription",
"cloudfront:GetOriginAccessControl",
"cloudfront:GetOriginRequestPolicy",
"cloudfront:GetPublicKey",
"cloudfront:GetRealtimeLogConfig",
"cloudfront:GetResponseHeadersPolicy",
"cloudfront:List*",
"cloudtrail:Describe*",
"cloudtrail:GetChannel",
"cloudtrail:GetEventConfiguration",
"cloudtrail:GetEventDataStore",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetInsightSelectors",
"cloudtrail:GetQueryResults",
"cloudtrail:GetResourcePolicy",
"cloudtrail:GetTrail",
"cloudtrail:GetTrailStatus",
"cloudtrail:List*",
"cloudtrail:LookupEvents",
"cloudtrail:StartQuery",
"cloudwatch:Describe*",
"cloudwatch:GenerateQuery",
"cloudwatch:GetDashboard",
"cloudwatch:GetInsightRuleReport",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:GetMetricStream",
"cloudwatch:GetService",
"cloudwatch:GetServiceLevelObjective",
"cloudwatch:List*",
"codeartifact:Describe*",
"codeartifact:GetDomainPermissionsPolicy",
"codeartifact:GetRepositoryPermissionsPolicy",
"codeartifact:List*",
"codebuild:BatchGetFleets",
"codebuild:List*",
"codecommit:GetRepository",
"codecommit:GetRepositoryTriggers",
"codedeploy:BatchGetDeployments",
"codedeploy:BatchGetDeploymentTargets",
"codedeploy:GetApplication",
"codedeploy:GetDeploymentConfig",
"codedeploy:GetDeploymentTarget",
"codedeploy:List*",
"codeguru-profiler:Describe*",
"codeguru-profiler:GetNotificationConfiguration",
"codeguru-profiler:GetPolicy",
"codeguru-profiler:List*",
"codeguru-reviewer:Describe*",
"codeguru-reviewer:List*",
"codepipeline:GetPipeline",
"codepipeline:GetPipelineState",
"codepipeline:List*",
"codestar-connections:GetConnection",
"codestar-connections:GetRepositoryLink",
"codestar-connections:GetSyncConfiguration",
"codestar-connections:List*",
"codestar-notifications:Describe*",
"codestar-notifications:List*",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:GetIdentityPoolRoles",
"cognito-identity:ListIdentityPools",
"cognito-identity:ListTagsForResource",
"cognito-idp:AdminListGroupsForUser",
"cognito-idp:DescribeIdentityProvider",
"cognito-idp:DescribeResourceServer",
"cognito-idp:DescribeRiskConfiguration",
"cognito-idp:DescribeUserImportJob",
"cognito-idp:DescribeUserPool",
"cognito-idp:DescribeUserPoolDomain",
"cognito-idp:GetGroup",
"cognito-idp:GetLogDeliveryConfiguration",
"cognito-idp:GetUICustomization",
"cognito-idp:GetUserPoolMfaConfig",
"cognito-idp:GetWebACLForResource",
"cognito-idp:ListGroups",
"cognito-idp:ListIdentityProviders",
"cognito-idp:ListResourceServers",
"cognito-idp:ListUserPoolClients",
"cognito-idp:ListUserPools",
"cognito-idp:ListTagsForResource",
"comprehend:Describe*",
"comprehend:List*",
"config:Describe*",
"config:GetStoredQuery",
"config:List*",
"connect:Describe*",
"connect:GetTaskTemplate",
"connect:List*",
"databrew:Describe*",
"databrew:List*",
"datapipeline:Describe*",
"datapipeline:GetPipelineDefinition",
"datapipeline:List*",
"datasync:Describe*",
"datasync:List*",
"deadline:GetFarm",
"deadline:GetFleet",
"deadline:GetLicenseEndpoint",
"deadline:GetMonitor",
"deadline:GetQueue",
"deadline:GetQueueEnvironment",
"deadline:GetQueueFleetAssociation",
"deadline:GetStorageProfile",
"deadline:List*",
"detective:GetMembers",
"detective:List*",
"devicefarm:GetDevicePool",
"devicefarm:GetInstanceProfile",
"devicefarm:GetNetworkProfile",
"devicefarm:GetProject",
"devicefarm:GetTestGridProject",
"devicefarm:GetVPCEConfiguration",
"devicefarm:List*",
"devops-guru:Describe*",
"devops-guru:GetResourceCollection",
"devops-guru:List*",
"dms:Describe*",
"dms:List*",
"ds:Describe*",
"dynamodb:Describe*",
"dynamodb:GetResourcePolicy",
"dynamodb:List*",
"ec2:Describe*",
"ec2:GetAssociatedEnclaveCertificateIamRoles",
"ec2:GetIpamPoolAllocations",
"ec2:GetIpamPoolCidrs",
"ec2:GetManagedPrefixListEntries",
"ec2:GetNetworkInsightsAccessScopeContent",
"ec2:GetSnapshotBlockPublicAccessState",
"ec2:GetTransitGatewayMulticastDomainAssociations",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:GetVerifiedAccessEndpointPolicy",
"ec2:GetVerifiedAccessGroupPolicy",
"ec2:GetVerifiedAccessInstanceWebAcl",
"ec2:SearchLocalGatewayRoutes",
"ec2:SearchTransitGatewayRoutes",
"ecr:Describe*",
"ecr:GetLifecyclePolicy",
"ecr:GetRegistryPolicy",
"ecr:GetRepositoryPolicy",
"ecr:List*",
"ecs:Describe*",
"ecs:List*",
"eks:AccessKubernetesApi",
"eks:Describe*",
"eks:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticbeanstalk:Describe*",
"elasticbeanstalk:List*",
"elasticfilesystem:Describe*",
"elasticloadbalancing:GetResourcePolicy",
"elasticloadbalancing:GetTrustStoreCaCertificatesBundle",
"elasticloadbalancing:GetTrustStoreRevocationContent",
"elasticloadbalancing:Describe*",
"elasticmapreduce:Describe*",
"elasticmapreduce:List*",
"emr-containers:Describe*",
"emr-containers:List*",
"emr-serverless:GetApplication",
"emr-serverless:List*",
"es:Describe*",
"es:List*",
"events:Describe*",
"events:List*",
"evidently:GetExperiment",
"evidently:GetFeature",
"evidently:GetLaunch",
"evidently:GetProject",
"evidently:GetSegment",
"evidently:List*",
"firehose:Describe*",
"firehose:List*",
"fis:GetExperimentTemplate",
"fis:GetTargetAccountConfiguration",
"fis:List*",
"fms:GetNotificationChannel",
"fms:GetPolicy",
"fms:List*",
"forecast:Describe*",
"forecast:List*",
"frauddetector:BatchGetVariable",
"frauddetector:Describe*",
"frauddetector:GetDetectors",
"frauddetector:GetDetectorVersion",
"frauddetector:GetEntityTypes",
"frauddetector:GetEventTypes",
"frauddetector:GetExternalModels",
"frauddetector:GetLabels",
"frauddetector:GetListElements",
"frauddetector:GetListsMetadata",
"frauddetector:GetModelVersion",
"frauddetector:GetOutcomes",
"frauddetector:GetRules",
"frauddetector:GetVariables",
"frauddetector:List*",
"fsx:Describe*",
"gamelift:Describe*",
"gamelift:List*",
"globalaccelerator:Describe*",
"globalaccelerator:List*",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:GetJob",
"glue:GetRegistry",
"glue:GetSchema",
"glue:GetSchemaVersion",
"glue:GetTable",
"glue:GetTags",
"glue:GetTrigger",
"glue:List*",
"glue:querySchemaVersionMetadata",
"grafana:Describe*",
"grafana:List*",
"greengrass:Describe*",
"greengrass:GetDeployment",
"greengrass:List*",
"groundstation:GetConfig",
"groundstation:GetDataflowEndpointGroup",
"groundstation:GetMissionProfile",
"groundstation:List*",
"guardduty:GetDetector",
"guardduty:GetFilter",
"guardduty:GetIPSet",
"guardduty:GetMalwareProtectionPlan",
"guardduty:GetMasterAccount",
"guardduty:GetMembers",
"guardduty:GetThreatIntelSet",
"guardduty:List*",
"health:DescribeEvents",
"health:DescribeEventDetails",
"healthlake:Describe*",
"healthlake:List*",
"iam:GetGroup",
"iam:GetGroupPolicy",
"iam:GetInstanceProfile",
"iam:GetLoginProfile",
"iam:GetOpenIDConnectProvider",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetSAMLProvider",
"iam:GetServerCertificate",
"iam:GetServiceLinkedRoleDeletionStatus",
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAttachedRolePolicies",
"iam:ListOpenIDConnectProviders",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListServerCertificates",
"iam:ListVirtualMFADevices",
"identitystore:DescribeGroup",
"identitystore:DescribeGroupMembership",
"identitystore:ListGroupMemberships",
"identitystore:ListGroups",
"imagebuilder:GetComponent",
"imagebuilder:GetContainerRecipe",
"imagebuilder:GetDistributionConfiguration",
"imagebuilder:GetImage",
"imagebuilder:GetImagePipeline",
"imagebuilder:GetImageRecipe",
"imagebuilder:GetInfrastructureConfiguration",
"imagebuilder:GetLifecyclePolicy",
"imagebuilder:GetWorkflow",
"imagebuilder:List*",
"inspector2:List*",
"inspector:Describe*",
"inspector:List*",
"internetmonitor:GetMonitor",
"internetmonitor:List*",
"iot:Describe*",
"iot:GetPackage",
"iot:GetPackageVersion",
"iot:GetPolicy",
"iot:GetThingShadow",
"iot:GetTopicRule",
"iot:GetTopicRuleDestination",
"iot:GetV2LoggingOptions",
"iot:List*",
"iotanalytics:Describe*",
"iotanalytics:List*",
"iotevents:Describe*",
"iotevents:List*",
"iotsitewise:Describe*",
"iotsitewise:List*",
"iotwireless:GetDestination",
"iotwireless:GetDeviceProfile",
"iotwireless:GetFuotaTask",
"iotwireless:GetMulticastGroup",
"iotwireless:GetNetworkAnalyzerConfiguration",
"iotwireless:GetServiceProfile",
"iotwireless:GetWirelessDevice",
"iotwireless:GetWirelessGateway",
"iotwireless:GetWirelessGatewayTaskDefinition",
"iotwireless:List*",
"ivs:GetChannel",
"ivs:GetEncoderConfiguration",
"ivs:GetPlaybackRestrictionPolicy",
"ivs:GetRecordingConfiguration",
"ivs:GetStage",
"ivs:List*",
"ivschat:GetLoggingConfiguration",
"ivschat:GetRoom",
"ivschat:List*",
"kafka:Describe*",
"kafka:GetClusterPolicy",
"kafka:List*",
"kafkaconnect:Describe*",
"kafkaconnect:List*",
"kendra:Describe*",
"kendra:List*",
"kinesis:Describe*",
"kinesis:GetResourcePolicy",
"kinesis:List*",
"kinesisanalytics:Describe*",
"kinesisanalytics:List*",
"kinesisvideo:Describe*",
"kms:DescribeKey",
"kms:ListResourceTags",
"kms:ListKeys",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:ListAliases",
"kms:ListKeyRotations",
"lakeformation:Describe*",
"lakeformation:GetLFTag",
"lakeformation:GetResourceLFTags",
"lakeformation:List*",
"lambda:GetAlias",
"lambda:GetCodeSigningConfig",
"lambda:GetEventSourceMapping",
"lambda:GetFunctionCodeSigningConfig",
"lambda:GetFunctionConfiguration",
"lambda:GetFunctionEventInvokeConfig",
"lambda:GetFunctionRecursionConfig",
"lambda:GetFunctionUrlConfig",
"lambda:GetLayerVersion",
"lambda:GetLayerVersionPolicy",
"lambda:GetPolicy",
"lambda:GetProvisionedConcurrencyConfig",
"lambda:GetRuntimeManagementConfig",
"lambda:List*",
"launchwizard:GetDeployment",
"launchwizard:List*",
"license-manager:GetLicense",
"license-manager:List*",
"lightsail:GetAlarms",
"lightsail:GetBuckets",
"lightsail:GetCertificates",
"lightsail:GetContainerServices",
"lightsail:GetDisk",
"lightsail:GetDisks",
"lightsail:GetInstance",
"lightsail:GetInstances",
"lightsail:GetLoadBalancer",
"lightsail:GetLoadBalancers",
"lightsail:GetLoadBalancerTlsCertificates",
"lightsail:GetStaticIp",
"lightsail:GetStaticIps",
"logs:Describe*",
"logs:FilterLogEvents",
"logs:GetDataProtectionPolicy",
"logs:GetDelivery",
"logs:GetDeliveryDestination",
"logs:GetDeliveryDestinationPolicy",
"logs:GetDeliverySource",
"logs:GetLogAnomalyDetector",
"logs:GetLogDelivery",
"logs:GetLogGroupFields",
"logs:GetQueryResults",
"logs:List*",
"logs:StartQuery",
"logs:StopLiveTail",
"logs:StopQuery",
"logs:TestMetricFilter",
"m2:GetApplication",
"m2:GetEnvironment",
"m2:List*",
"macie2:GetAllowList",
"macie2:GetCustomDataIdentifier",
"macie2:GetFindingsFilter",
"macie2:GetMacieSession",
"macie2:List*",
"mediaconnect:Describe*",
"mediaconnect:List*",
"medialive:Describe*",
"medialive:GetCloudWatchAlarmTemplate",
"medialive:GetCloudWatchAlarmTemplateGroup",
"medialive:GetEventBridgeRuleTemplate",
"medialive:GetEventBridgeRuleTemplateGroup",
"medialive:GetSignalMap",
"medialive:List*",
"mediapackage-vod:Describe*",
"mediapackage-vod:List*",
"mediapackage:Describe*",
"mediapackage:List*",
"mediapackagev2:GetChannel",
"mediapackagev2:GetChannelGroup",
"mediapackagev2:GetChannelPolicy",
"mediapackagev2:GetOriginEndpoint",
"mediapackagev2:GetOriginEndpointPolicy",
"mediapackagev2:List*",
"memorydb:Describe*",
"memorydb:List*",
"mobiletargeting:GetInAppTemplate",
"mobiletargeting:List*",
"mq:Describe*",
"mq:List*",
"network-firewall:Describe*",
"network-firewall:List*",
"networkmanager:Describe*",
"networkmanager:GetConnectAttachment",
"networkmanager:GetConnectPeer",
"networkmanager:GetCoreNetwork",
"networkmanager:GetCoreNetworkPolicy",
"networkmanager:GetCustomerGatewayAssociations",
"networkmanager:GetDevices",
"networkmanager:GetLinkAssociations",
"networkmanager:GetLinks",
"networkmanager:GetSites",
"networkmanager:GetSiteToSiteVpnAttachment",
"networkmanager:GetTransitGatewayPeering",
"networkmanager:GetTransitGatewayRegistrations",
"networkmanager:GetTransitGatewayRouteTableAttachment",
"networkmanager:GetVpcAttachment",
"networkmanager:List*",
"oam:GetLink",
"oam:GetSink",
"oam:GetSinkPolicy",
"oam:List*",
"omics:GetAnnotationStore",
"omics:GetReferenceStore",
"omics:GetRunGroup",
"omics:GetSequenceStore",
"omics:GetVariantStore",
"omics:GetWorkflow",
"omics:List*",
"organizations:Describe*",
"organizations:List*",
"osis:GetPipeline",
"osis:List*",
"payment-cryptography:GetAlias",
"payment-cryptography:GetKey",
"payment-cryptography:List*",
"pca-connector-ad:GetConnector",
"pca-connector-ad:GetDirectoryRegistration",
"pca-connector-ad:GetServicePrincipalName",
"pca-connector-ad:GetTemplate",
"pca-connector-ad:GetTemplateGroupAccessControlEntry",
"pca-connector-ad:List*",
"pca-connector-scep:GetChallengeMetadata",
"pca-connector-scep:GetConnector",
"pca-connector-scep:List*",
"personalize:Describe*",
"personalize:List*",
"pi:DescribeDimensionKeys",
"pi:GetResourceMetadata",
"pi:GetResourceMetrics",
"pi:ListAvailableResourceDimensions",
"pi:ListAvailableResourceMetrics",
"pipes:Describe*",
"pipes:List*",
"proton:GetEnvironmentTemplate",
"proton:GetServiceTemplate",
"proton:List*",
"qbusiness:GetApplication",
"qbusiness:GetDataSource",
"qbusiness:GetIndex",
"qbusiness:GetPlugin",
"qbusiness:GetRetriever",
"qbusiness:GetWebExperience",
"qbusiness:List*",
"ram:GetPermission",
"ram:GetResourceShares",
"ram:List*",
"rds:Describe*",
"rds:List*",
"redshift-serverless:GetNamespace",
"redshift-serverless:GetWorkgroup",
"redshift-serverless:List*",
"redshift:Describe*",
"refactor-spaces:GetApplication",
"refactor-spaces:GetEnvironment",
"refactor-spaces:GetRoute",
"refactor-spaces:List*",
"rekognition:Describe*",
"rekognition:List*",
"resiliencehub:Describe*",
"resiliencehub:List*",
"resource-explorer-2:GetDefaultView",
"resource-explorer-2:GetIndex",
"resource-explorer-2:GetView",
"resource-explorer-2:List*",
"resource-explorer-2:Search",
"resource-groups:GetGroup",
"resource-groups:GetGroupConfiguration",
"resource-groups:GetGroupQuery",
"resource-groups:GetTags",
"resource-groups:List*",
"route53-recovery-control-config:Describe*",
"route53-recovery-control-config:List*",
"route53-recovery-readiness:GetCell",
"route53-recovery-readiness:GetReadinessCheck",
"route53-recovery-readiness:GetRecoveryGroup",
"route53-recovery-readiness:GetResourceSet",
"route53-recovery-readiness:List*",
"route53:GetDNSSEC",
"route53:GetHealthCheck",
"route53:GetHealthCheckStatus",
"route53:GetHostedZone",
"route53:List*",
"route53profiles:GetProfile",
"route53profiles:GetProfileAssociation",
"route53profiles:GetProfileResourceAssociation",
"route53profiles:List*",
"route53resolver:GetFirewallDomainList",
"route53resolver:GetFirewallRuleGroup",
"route53resolver:GetFirewallRuleGroupAssociation",
"route53resolver:GetOutpostResolver",
"route53resolver:GetResolverConfig",
"route53resolver:GetResolverQueryLogConfig",
"route53resolver:GetResolverQueryLogConfigAssociation",
"route53resolver:GetResolverRule",
"route53resolver:GetResolverRuleAssociation",
"route53resolver:List*",
"rum:GetAppMonitor",
"rum:List*",
"s3-outposts:ListEndpoints",
"s3-outposts:ListOutpostsWithS3",
"s3:GetAccessGrant",
"s3:GetAccessGrantsInstance",
"s3:GetAccessGrantsLocation",
"s3:GetAccessPoint",
"s3:GetAccessPointConfigurationForObjectLambda",
"s3:GetAccessPointForObjectLambda",
"s3:GetAccessPointPolicy",
"s3:GetAccessPointPolicyForObjectLambda",
"s3:GetAccessPointPolicyStatusForObjectLambda",
"s3:GetBucketAbac",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketMetadataTableConfiguration",
"s3:GetBucketNotification",
"s3:GetBucketObjectLockConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPolicy",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetMultiRegionAccessPoint",
"s3:GetMultiRegionAccessPointPolicy",
"s3:GetMultiRegionAccessPointPolicyStatus",
"s3:GetReplicationConfiguration",
"s3:GetStorageLensConfiguration",
"s3:GetStorageLensConfigurationTagging",
"s3:GetStorageLensGroup",
"s3:ListAllMyBuckets",
"sagemaker:Describe*",
"sagemaker:List*",
"scheduler:GetSchedule",
"scheduler:GetScheduleGroup",
"scheduler:List*",
"schemas:Describe*",
"schemas:GetResourcePolicy",
"schemas:List*",
"secretsmanager:Describe*",
"secretsmanager:GetResourcePolicy",
"secretsmanager:List*",
"securityhub:BatchGetAutomationRules",
"securityhub:BatchGetSecurityControls",
"securityhub:Describe*",
"securityhub:GetConfigurationPolicy",
"securityhub:GetConfigurationPolicyAssociation",
"securityhub:GetEnabledStandards",
"securityhub:GetFindingAggregator",
"securityhub:GetInsights",
"securityhub:List*",
"securitylake:GetSubscriber",
"securitylake:List*",
"servicecatalog:Describe*",
"servicecatalog:GetApplication",
"servicecatalog:GetAttributeGroup",
"servicecatalog:List*",
"servicequotas:GetServiceQuota",
"ses:Describe*",
"ses:GetAccount",
"ses:GetAddonInstance",
"ses:GetAddonSubscription",
"ses:GetArchive",
"ses:GetConfigurationSet",
"ses:GetConfigurationSetEventDestinations",
"ses:GetContactList",
"ses:GetDedicatedIpPool",
"ses:GetDedicatedIps",
"ses:GetEmailIdentity",
"ses:GetEmailTemplate",
"ses:GetIngressPoint",
"ses:GetRelay",
"ses:GetRuleSet",
"ses:GetTemplate",
"ses:GetTrafficPolicy",
"ses:List*",
"shield:Describe*",
"shield:List*",
"signer:GetSigningProfile",
"signer:List*",
"sns:GetDataProtectionPolicy",
"sns:GetSubscriptionAttributes",
"sns:GetTopicAttributes",
"sns:List*",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:List*",
"ssm-contacts:GetContact",
"ssm-contacts:GetContactChannel",
"ssm-contacts:List*",
"ssm-incidents:GetReplicationSet",
"ssm-incidents:GetResponsePlan",
"ssm-incidents:List*",
"ssm-sap:GetApplication",
"ssm-sap:List*",
"ssm:Describe*",
"ssm:GetDefaultPatchBaseline",
"ssm:GetDocument",
"ssm:GetParameters",
"ssm:GetPatchBaseline",
"ssm:GetResourcePolicies",
"ssm:List*",
"sso:GetInlinePolicyForPermissionSet",
"sso:GetManagedApplicationInstance",
"sso:GetPermissionsBoundaryForPermissionSet",
"sso:GetSharedSsoConfiguration",
"sso:ListAccountAssignments",
"sso:ListApplicationAssignments",
"sso:ListApplications",
"sso:ListCustomerManagedPolicyReferencesInPermissionSet",
"sso:ListInstances",
"sso:ListManagedPoliciesInPermissionSet",
"sso:ListTagsForResource",
"states:GetExecutionHistory",
"states:Describe*",
"states:List*",
"support:CreateCase",
"support:DescribeCases",
"synthetics:Describe*",
"synthetics:GetCanary",
"synthetics:GetCanaryRuns",
"synthetics:GetGroup",
"synthetics:List*",
"tag:GetResources",
"timestream:Describe*",
"timestream:List*",
"transfer:Describe*",
"transfer:List*",
"verifiedpermissions:GetIdentitySource",
"verifiedpermissions:GetPolicy",
"verifiedpermissions:GetPolicyStore",
"verifiedpermissions:GetPolicyTemplate",
"verifiedpermissions:GetSchema",
"verifiedpermissions:List*",
"vpc-lattice:GetAccessLogSubscription",
"vpc-lattice:GetAuthPolicy",
"vpc-lattice:GetListener",
"vpc-lattice:GetResourcePolicy",
"vpc-lattice:GetRule",
"vpc-lattice:GetService",
"vpc-lattice:GetServiceNetwork",
"vpc-lattice:GetServiceNetworkServiceAssociation",
"vpc-lattice:GetServiceNetworkVpcAssociation",
"vpc-lattice:GetTargetGroup",
"vpc-lattice:List*",
"wafv2:GetIPSet",
"wafv2:GetLoggingConfiguration",
"wafv2:GetRegexPatternSet",
"wafv2:GetRuleGroup",
"wafv2:GetWebACL",
"wafv2:GetWebACLForResource",
"wafv2:List*",
"workspaces-web:GetBrowserSettings",
"workspaces-web:GetIdentityProvider",
"workspaces-web:GetNetworkSettings",
"workspaces-web:GetPortal",
"workspaces-web:GetPortalServiceProviderMetadata",
"workspaces-web:GetTrustStore",
"workspaces-web:GetUserAccessLoggingSettings",
"workspaces-web:GetUserSettings",
"workspaces-web:List*",
"workspaces:Describe*",
"xray:BatchGetTraces",
"xray:GetGroup",
"xray:GetGroups",
"xray:GetSamplingRules",
"xray:GetServiceGraph",
"xray:GetTraceSummaries",
"xray:List*"
],
"Resource": "*"
},
{
"Sid": "AIOPSAPIGatewayAccess",
"Effect": "Allow",
"Action": [
"apigateway:GET"
],
"Resource": [
"arn:aws:apigateway:*::/restapis",
"arn:aws:apigateway:*::/restapis/*",
"arn:aws:apigateway:*::/restapis/*/deployments",
"arn:aws:apigateway:*::/restapis/*/deployments/*",
"arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations",
"arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations/*",
"arn:aws:apigateway:*::/restapis/*/stages",
"arn:aws:apigateway:*::/restapis/*/stages/*",
"arn:aws:apigateway:*::/apis",
"arn:aws:apigateway:*::/apis/*",
"arn:aws:apigateway:*::/apis/*/deployments",
"arn:aws:apigateway:*::/apis/*/deployments/*",
"arn:aws:apigateway:*::/apis/*/integrations",
"arn:aws:apigateway:*::/apis/*/integrations/*",
"arn:aws:apigateway:*::/apis/*/stages",
"arn:aws:apigateway:*::/apis/*/stages/*",
"arn:aws:apigateway:*::/domainnames/*"
]
}
]
}
```