forked from primeharbor/sensitive_iam_actions
-
Notifications
You must be signed in to change notification settings - Fork 0
/
annotated.yaml
3709 lines (3188 loc) · 133 KB
/
annotated.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
CredentialExposure:
Actions:
- appsync:ListApiKeys:
access_level: List
description: Grants permission to list the API keys for a given API
risk_category:
- CredentialExposure
service_name: AWS AppSync
- athena:GetSession:
access_level: Read
description: Grants permission to get a session
risk_category:
- CredentialExposure
service_name: Amazon Athena
- chatbot:GetMicrosoftTeamsOauthParameters:
access_level: Read
description: Grants permission to generate OAuth parameters to request Microsoft Teams OAuth code to be used by the AWS Chatbot service
risk_category:
- CredentialExposure
service_name: AWS Chatbot
- chatbot:GetSlackOauthParameters:
access_level: Read
description: Grants permission to generate OAuth parameters to request Slack OAuth code to be used by the AWS Chatbot service
risk_category:
- CredentialExposure
service_name: AWS Chatbot
- chime:CreateApiKey:
access_level: Write
description: Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration
risk_category:
- CredentialExposure
service_name: Amazon Chime
- cloud9:CreateEnvironmentSSH:
access_level: Write
description: Grants permission to create an AWS Cloud9 SSH development environment
risk_category:
- CredentialExposure
service_name: AWS Cloud9
- cloud9:CreateEnvironmentToken:
access_level: Read
description: Grants permission to create an authentication token that allows a connection between the AWS Cloud9 IDE and the user's environment
risk_category:
- CredentialExposure
service_name: AWS Cloud9
- codeartifact:GetAuthorizationToken:
access_level: Read
description: Grants permission to generate a temporary authentication token for accessing repositories in a domain
risk_category:
- CredentialExposure
service_name: AWS CodeArtifact
- codepipeline:PollForJobs:
access_level: Write
description: Grants permission to view information about any jobs for CodePipeline to act on
risk_category:
- CredentialExposure
service_name: AWS CodePipeline
- cognito-identity:GetCredentialsForIdentity:
access_level: Read
description: Grants permission to return credentials for the provided identity ID
risk_category:
- CredentialExposure
service_name: Amazon Cognito Identity
- cognito-identity:GetOpenIdToken:
access_level: Read
description: Grants permission to get an OpenID token, using a known Cognito ID
risk_category:
- CredentialExposure
service_name: Amazon Cognito Identity
- cognito-identity:GetOpenIdTokenForDeveloperIdentity:
access_level: Read
description: Grants permission to register (or retrieve) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process
risk_category:
- CredentialExposure
service_name: Amazon Cognito Identity
- cognito-idp:DescribeUserPoolClient:
access_level: Read
description: Grants permission to describe any user pool app client
risk_category:
- CredentialExposure
service_name: Amazon Cognito User Pools
- cognito-idp:GetUserAttributeVerificationCode:
access_level: Read
description: Grants permission to get the user attribute verification code for the specified attribute name
risk_category:
- CredentialExposure
service_name: Amazon Cognito User Pools
- connect:GetFederationToken:
access_level: Read
description: Grants permission to federate into an Amazon Connect instance when using SAML-based authentication for identity management
risk_category:
- CredentialExposure
service_name: Amazon Connect
- connect:ListSecurityKeys:
access_level: List
description: Grants permission to view the security keys of an existing Amazon Connect instance
risk_category:
- CredentialExposure
service_name: Amazon Connect
- ec2:GetPasswordData:
access_level: Read
description: Grants permission to retrieve the encrypted administrator password for a running Windows instance
risk_category:
- CredentialExposure
service_name: Amazon EC2
- ec2-instance-connect:SendSSHPublicKey:
access_level: Write
description: Grants permission to push an SSH public key to the specified EC2 instance to be used for standard SSH
risk_category:
- CredentialExposure
- PrivEsc
service_name: Amazon EC2 Instance Connect
- ecr-public:GetAuthorizationToken:
access_level: Read
description: Grants permission to retrieve a token that is valid for a specified registry for 12 hours
risk_category:
- CredentialExposure
service_name: Amazon Elastic Container Registry Public
- ecr:GetAuthorizationToken:
access_level: Read
description: Grants permission to retrieve a token that is valid for a specified registry for 12 hours
risk_category:
- CredentialExposure
service_name: Amazon Elastic Container Registry
- gamelift:GetComputeAuthToken:
access_level: Read
description: Grants permission to retrieve an authorization token for a compute and fleet to use in game server processes
risk_category:
- CredentialExposure
service_name: Amazon GameLift
- gamelift:GetGameSessionLogUrl:
access_level: Read
description: Grants permission to retrieve the location of stored logs for a game session
risk_category:
- CredentialExposure
service_name: Amazon GameLift
- gamelift:GetInstanceAccess:
access_level: Read
description: Grants permission to request remote access to a specified fleet instance
risk_category:
- CredentialExposure
- DataAccess
service_name: Amazon GameLift
- gamelift:RequestUploadCredentials:
access_level: Read
description: Grants permission to retrieve fresh upload credentials to use when uploading a new game build
risk_category:
- CredentialExposure
service_name: Amazon GameLift
- iam:CreateAccessKey:
access_level: Write
description: Grants permission to create access key and secret access key for the specified IAM user
risk_category:
- CredentialExposure
- PrivEsc
- ResourceExposure
service_name: AWS Identity and Access Management (IAM)
- iam:CreateLoginProfile:
access_level: Write
description: Grants permission to create a password for the specified IAM user
risk_category:
- CredentialExposure
- PrivEsc
- ResourceExposure
service_name: AWS Identity and Access Management (IAM)
- iam:CreateServiceSpecificCredential:
access_level: Write
description: Grants permission to create a new service-specific credential for an IAM user
risk_category:
- CredentialExposure
- ResourceExposure
service_name: AWS Identity and Access Management (IAM)
- iam:ResetServiceSpecificCredential:
access_level: Write
description: Grants permission to reset the password for an existing service-specific credential for an IAM user
risk_category:
- CredentialExposure
- ResourceExposure
service_name: AWS Identity and Access Management (IAM)
- iam:UpdateAccessKey:
access_level: Write
description: Grants permission to update the status of the specified access key as Active or Inactive
risk_category:
- CredentialExposure
- ResourceExposure
service_name: AWS Identity and Access Management (IAM)
- lightsail:DownloadDefaultKeyPair:
access_level: Write
description: Grants permission to download the default key pair used to authenticate and connect to instances in a specific AWS Region
risk_category:
- CredentialExposure
service_name: Amazon Lightsail
- lightsail:GetBucketAccessKeys:
access_level: Read
description: Grants permission to get the existing access key IDs for the specified Amazon Lightsail bucket
risk_category:
- CredentialExposure
service_name: Amazon Lightsail
- lightsail:GetKeyPair:
access_level: Read
description: Grants permission to get information about a key pair
risk_category:
- CredentialExposure
service_name: Amazon Lightsail
- lightsail:GetKeyPairs:
access_level: Read
description: Grants permission to get information about all key pairs
risk_category:
- CredentialExposure
service_name: Amazon Lightsail
- lightsail:GetRelationalDatabaseMasterUserPassword:
access_level: Write
description: Grants permission to get the master user password of a relational database
risk_category:
- CredentialExposure
- ResourceExposure
service_name: Amazon Lightsail
- mediapackage:RotateChannelCredentials:
access_level: Write
description: Grants permission to rotate credentials for the first IngestEndpoint of a Channel in AWS Elemental MediaPackage
risk_category:
- CredentialExposure
service_name: AWS Elemental MediaPackage
- mediapackage:RotateIngestEndpointCredentials:
access_level: Write
description: Grants permission to rotate IngestEndpoint credentials for a Channel in AWS Elemental MediaPackage
risk_category:
- CredentialExposure
- ResourceExposure
service_name: AWS Elemental MediaPackage
- rds-db:connect:
access_level: Permissions management
description: Allows IAM role or user to connect to RDS database
risk_category:
- CredentialExposure
- ResourceExposure
service_name: Amazon RDS IAM Authentication
- redshift:GetClusterCredentials:
access_level: Write
description: Grants permission to get temporary credentials to access an Amazon Redshift database by the specified AWS account
risk_category:
- CredentialExposure
service_name: Amazon Redshift
- snowball:GetJobUnlockCode:
access_level: Read
description: Grants permission to get the UnlockCode code value for the specified job
risk_category:
- CredentialExposure
service_name: AWS Snowball
- sso-directory:ListBearerTokens:
access_level: Read
description: Grants permission to list bearer tokens for a given provisioning tenant
risk_category:
- CredentialExposure
service_name: AWS IAM Identity Center (successor to AWS Single Sign-On) directory
- storagegateway:DescribeChapCredentials:
access_level: Read
description: Grants permission to get an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair
risk_category:
- CredentialExposure
service_name: AWS Storage Gateway
- sts:AssumeRole:
access_level: Write
description: Grants permission to obtain a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to
risk_category:
- CredentialExposure
service_name: AWS Security Token Service
- sts:AssumeRoleWithSAML:
access_level: Write
description: Grants permission to obtain a set of temporary security credentials for users who have been authenticated via a SAML authentication response
risk_category:
- CredentialExposure
service_name: AWS Security Token Service
- sts:AssumeRoleWithWebIdentity:
access_level: Write
description: Grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider
risk_category:
- CredentialExposure
service_name: AWS Security Token Service
- sts:GetFederationToken:
access_level: Read
description: Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user
risk_category:
- CredentialExposure
service_name: AWS Security Token Service
- sts:GetSessionToken:
access_level: Read
description: Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user
risk_category:
- CredentialExposure
service_name: AWS Security Token Service
- waf-regional:GetChangeToken:
access_level: Read
description: Grants permission to retrieve a change token to use in create, update, and delete requests
risk_category:
- CredentialExposure
service_name: AWS WAF Regional
- waf:GetChangeToken:
access_level: Read
description: Grants permission to retrieve a change token to use in create, update, and delete requests
risk_category:
- CredentialExposure
service_name: AWS WAF
DataAccess:
Actions:
- aoss:APIAccessAll:
access_level: Write
description: Grant permission to all the supported Opensearch APIs
risk_category:
- DataAccess
service_name: Amazon OpenSearch Serverless
- aoss:DashboardsAccessAll:
access_level: Write
description: Grants permission to Opensearch Serverless Dashboards
risk_category:
- DataAccess
service_name: Amazon OpenSearch Serverless
- appsync:GetDataSource:
access_level: Read
description: Grants permission to retrieve a data source
risk_category:
- DataAccess
service_name: AWS AppSync
- appsync:GetFunction:
access_level: Read
description: Grants permission to retrieve a function
risk_category:
- DataAccess
service_name: AWS AppSync
- athena:GetQueryExecution:
access_level: Read
description: Grants permission to get information about the specified query execution
risk_category:
- DataAccess
service_name: Amazon Athena
- athena:GetQueryResults:
access_level: Read
description: Grants permission to get the query results
risk_category:
- DataAccess
service_name: Amazon Athena
- athena:GetQueryResultsStream:
access_level: Read
description: Grants permission to get the query results stream
risk_category:
- DataAccess
service_name: Amazon Athena
- cassandra:Select:
access_level: Read
description: Grants permission to SELECT data from a table
risk_category:
- DataAccess
service_name: Amazon Keyspaces (for Apache Cassandra)
- chatbot:DescribeSlackChannels:
access_level: Read
description: Grants permission to list all public Slack channels in the Slack workspace connected to the AWS Account onboarded with AWS Chatbot service
risk_category:
- DataAccess
service_name: AWS Chatbot
- chatbot:DescribeSlackUserIdentities:
access_level: Read
description: Grants permission to describe AWS Chatbot Slack User Identities
risk_category:
- DataAccess
service_name: AWS Chatbot
- chatbot:ListMicrosoftTeamsConfiguredTeams:
access_level: Read
description: Grants permission to list all Microsoft Teams connected to the AWS Account onboarded with AWS Chatbot service
risk_category:
- DataAccess
service_name: AWS Chatbot
- chatbot:ListMicrosoftTeamsUserIdentities:
access_level: Read
description: Grants permission to describe AWS Chatbot Microsoft Teams User Identities
risk_category:
- DataAccess
service_name: AWS Chatbot
- chime:GetAttendee:
access_level: Read
description: Grants permission to get attendee details for a specified meeting ID and attendee ID
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetChannelMessage:
access_level: Read
description: Grants permission to get the full details of a channel message
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetMeeting:
access_level: Read
description: Grants permission to get the meeting record for a specified meeting ID
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetMeetingDetail:
access_level: Read
description: Grants permission to get attendee, connection, and other details for a meeting
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetRoom:
access_level: Read
description: Grants permission to retrieve a room
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetUser:
access_level: Read
description: Grants permission to get details for the specified user ID
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetUserActivityReportData:
access_level: Read
description: Grants permission to get a summary of user activity on the user details page
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetUserByEmail:
access_level: Read
description: Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:GetUserSettings:
access_level: Read
description: Grants permission to get user settings related to the specified Amazon Chime user
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:ListAttendees:
access_level: List
description: Grants permission to list up to 100 attendees for a specified Amazon Chime SDK meeting
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:ListMeetingEvents:
access_level: List
description: Grants permission to list all events that occurred for a specified meeting
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:ListMeetings:
access_level: List
description: Grants permission to list up to 100 active Amazon Chime SDK meetings
risk_category:
- DataAccess
service_name: Amazon Chime
- chime:ListUsers:
access_level: List
description: Grants permission to list the users that belong to the specified Amazon Chime account
risk_category:
- DataAccess
service_name: Amazon Chime
- cleanrooms:GetProtectedQuery:
access_level: Read
description: Grants permission to view a protected query
risk_category:
- DataAccess
service_name: AWS Clean Rooms
- cloudformation:GetTemplate:
access_level: Read
description: Grants permission to return the template body for a specified stack
risk_category:
- DataAccess
service_name: AWS CloudFormation & Cloud Control API
- cloudfront:GetFunction:
access_level: Read
description: Grants permission to get a CloudFront function's code
risk_category:
- DataAccess
service_name: Amazon CloudFront
- cloudtrail:GetQueryResults:
access_level: Read
description: Grants permission to fetch results of a complete query
risk_category:
- DataAccess
service_name: AWS CloudTrail
- cloudtrail:LookupEvents:
access_level: Read
description: Grants permission to look up and retrieve metric data for API activity events captured by CloudTrail that create, update, or delete resources in your account
risk_category:
- DataAccess
service_name: AWS CloudTrail
- codeartifact:GetPackageVersionAsset:
access_level: Read
description: Grants permission to return an asset (or file) that is part of a package version
risk_category:
- DataAccess
service_name: AWS CodeArtifact
- codeartifact:GetPackageVersionReadme:
access_level: Read
description: Grants permission to return a package version's readme file
risk_category:
- DataAccess
service_name: AWS CodeArtifact
- codeartifact:ReadFromRepository:
access_level: Read
description: Grants permission to return package assets and metadata from a repository endpoint
risk_category:
- DataAccess
service_name: AWS CodeArtifact
- codebuild:BatchGetReportGroups:
access_level: Read
description: Grants permission to return an array of ReportGroup objects that are specified by the input reportGroupArns parameter
risk_category:
- DataAccess
service_name: AWS CodeBuild
- codebuild:BatchGetReports:
access_level: Read
description: Grants permission to return an array of the Report objects specified by the input reportArns parameter
risk_category:
- DataAccess
service_name: AWS CodeBuild
- codecommit:BatchGetCommits:
access_level: Read
description: Grants permission to return information about one or more commits in an AWS CodeCommit repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:BatchGetPullRequests:
access_level: Read
description: Grants permission to return information about one or more pull requests in an AWS CodeCommit repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:BatchGetRepositories:
access_level: Read
description: Grants permission to get information about multiple repositories
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:DescribeMergeConflicts:
access_level: Read
description: Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:DescribePullRequestEvents:
access_level: Read
description: Grants permission to return information about one or more pull request events
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetApprovalRuleTemplate:
access_level: Read
description: Grants permission to return information about an approval rule template
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetBlob:
access_level: Read
description: Grants permission to view the encoded content of an individual file in an AWS CodeCommit repository from the AWS CodeCommit console
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetBranch:
access_level: Read
description: Grants permission to get details about a branch in an AWS CodeCommit repository with this API; does not control Git branch actions
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetComment:
access_level: Read
description: Grants permission to get the content of a comment made on a change, file, or commit in a repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommentReactions:
access_level: Read
description: Grants permission to get the reactions on a comment
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommentsForComparedCommit:
access_level: Read
description: Grants permission to get information about comments made on the comparison between two commits
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommentsForPullRequest:
access_level: Read
description: Grants permission to get comments made on a pull request
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommit:
access_level: Read
description: Grants permission to return information about a commit, including commit message and committer information, with this API; does not control Git log actions
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommitHistory:
access_level: Read
description: Grants permission to get information about the history of commits in a repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetCommitsFromMergeBase:
access_level: Read
description: Grants permission to get information about the difference between commits in the context of a potential merge
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetDifferences:
access_level: Read
description: Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetFile:
access_level: Read
description: Grants permission to return the base-64 encoded contents of a specified file and its metadata
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetFolder:
access_level: Read
description: Grants permission to return the contents of a specified folder in a repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetMergeCommit:
access_level: Read
description: Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits. Not all merge options create merge commits. This permission does not control Git merge actions
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetMergeConflicts:
access_level: Read
description: Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetMergeOptions:
access_level: Read
description: Grants permission to get information about merge options for pull requests that can be used to merge two commits; does not control Git merge actions
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetObjectIdentifier:
access_level: Read
description: Grants permission to resolve blobs, trees, and commits to their identifier
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetPullRequest:
access_level: Read
description: Grants permission to get information about a pull request in a specified repository
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetPullRequestApprovalStates:
access_level: Read
description: Grants permission to retrieve the current approvals on an inputted pull request
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetPullRequestOverrideState:
access_level: Read
description: Grants permission to retrieve the current override state of a given pull request
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetReferences:
access_level: Read
description: Grants permission to get details about references in an AWS CodeCommit repository; does not control Git reference actions
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GetTree:
access_level: Read
description: Grants permission to view the contents of a specified tree in an AWS CodeCommit repository from the AWS CodeCommit console
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codecommit:GitPull:
access_level: Read
description: Grants permission to pull information from an AWS CodeCommit repository to a local repo
risk_category:
- DataAccess
service_name: AWS CodeCommit
- codeguru-profiler:GetRecommendations:
access_level: Read
description: Grants permission to get recommendations
risk_category:
- DataAccess
service_name: Amazon CodeGuru Profiler
- codeguru-reviewer:DescribeCodeReview:
access_level: Read
description: Grants permission to describe a code review
risk_category:
- DataAccess
service_name: Amazon CodeGuru Reviewer
- codeguru-reviewer:DescribeRecommendationFeedback:
access_level: Read
description: Grants permission to describe a recommendation feedback on a code review
risk_category:
- DataAccess
service_name: Amazon CodeGuru Reviewer
- codepipeline:GetPipelineExecution:
access_level: Read
description: Grants permission to view information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline
risk_category:
- DataAccess
service_name: AWS CodePipeline
- cognito-identity:LookupDeveloperIdentity:
access_level: Read
description: Grants permission to retrieve the IdentityId associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifiers associated with an IdentityId for an existing identity
risk_category:
- DataAccess
service_name: Amazon Cognito Identity
- cognito-idp:AdminGetDevice:
access_level: Read
description: Grants permission to get information about any user's devices
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:AdminGetUser:
access_level: Read
description: Grants permission to look up any user by user name
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:AdminListDevices:
access_level: List
description: Grants permission to list any user's remembered devices
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:AdminListGroupsForUser:
access_level: List
description: Grants permission to list the groups that any user belongs to
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:AdminListUserAuthEvents:
access_level: Read
description: Grants permission to lists sign-in events for any user
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:GetDevice:
access_level: Read
description: Grants permission to get the device
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:GetGroup:
access_level: Read
description: Grants permission to describe a user pool group
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:GetUser:
access_level: Read
description: Grants permission to get the user attributes and metadata for a user
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:ListUsers:
access_level: List
description: Grants permission to list all user pool users
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:ListDevices:
access_level: List
description: Grants permission to list the devices
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-idp:ListGroups:
access_level: List
description: Grants permission to list all groups in user pools
risk_category:
- DataAccess
service_name: Amazon Cognito User Pools
- cognito-sync:ListRecords:
access_level: Read
description: Grants permission to get paginated records, optionally changed after a particular sync count for a dataset and identity
risk_category:
- DataAccess
service_name: Amazon Cognito Sync
- cognito-sync:QueryRecords:
access_level: Read
description: Grants permission to query records
risk_category:
- DataAccess
service_name: Amazon Cognito Sync
- connect:ListUsers:
access_level: List
description: Grants permission to list user resources in an Amazon Connect instance
risk_category:
- DataAccess
service_name: Amazon Connect
- datapipeline:QueryObjects:
access_level: Read
description: Grants permission to query the specified pipeline for the names of objects that match the specified set of conditions
risk_category:
- DataAccess
service_name: AWS Data Pipeline
- dax:BatchGetItem:
access_level: Read
description: Grants permission to return the attributes of one or more items from one or more tables
risk_category:
- DataAccess
service_name: Amazon DynamoDB Accelerator (DAX)
- dax:GetItem:
access_level: Read
description: Grants permission to the GetItem operation that returns a set of attributes for the item with the given primary key
risk_category:
- DataAccess
service_name: Amazon DynamoDB Accelerator (DAX)
- dax:Query:
access_level: Read
description: Grants permission to use the primary key of a table or a secondary index to directly access items from that table or index
risk_category:
- DataAccess
service_name: Amazon DynamoDB Accelerator (DAX)
- dax:Scan:
access_level: Read
description: Grants permission to return one or more items and item attributes by accessing every item in a table or a secondary index
risk_category:
- DataAccess
service_name: Amazon DynamoDB Accelerator (DAX)
- dynamodb:BatchGetItem:
access_level: Read
description: Grants permission to return the attributes of one or more items from one or more tables
risk_category:
- DataAccess
service_name: Amazon DynamoDB
- dynamodb:GetItem:
access_level: Read
description: Grants permission to the GetItem operation that returns a set of attributes for the item with the given primary key
risk_category:
- DataAccess
service_name: Amazon DynamoDB
- dynamodb:GetRecords:
access_level: Read
description: Grants permission to retrieve the stream records from a given shard
risk_category:
- DataAccess
service_name: Amazon DynamoDB
- dynamodb:Query:
access_level: Read
description: Grants permission to use the primary key of a table or a secondary index to directly access items from that table or index
risk_category:
- DataAccess
service_name: Amazon DynamoDB
- dynamodb:Scan:
access_level: Read
description: Grants permission to return one or more items and item attributes by accessing every item in a table or a secondary index
risk_category:
- DataAccess
service_name: Amazon DynamoDB
- ecr:GetDownloadUrlForLayer:
access_level: Read