AWS

Updates Certificate Transparency (CT) logging for an AWS Certificate Manager (ACM) certificate (ENABLED or DISABLED). Required IAM permission: acm:UpdateCertificateOptions.

Lists the notifications associated with a budget. Required IAM permission: budgets:DescribeNotificationsForBudget.

Lists configured budgets for a given AWS account. Required IAM permission: budgets:DescribeBudgets.

Retrieves actual cost and usage data for a given time range and optional service filter. Required IAM permission: ce:GetCostAndUsage.

Forecasts AWS spending over a given future time period using historical trends. Required IAM permission: ce:GetCostForecast.

Starts recording AWS API calls and log file delivery for a trail. For trails enabled in all regions, this must be executed from the region where the trail was created. Cannot be executed on shadow trails (replicated trails in other regions). Required IAM permission: cloudtrail:StartLogging.

Enables CloudTrail logging. Required IAM permission: cloudtrail:StartLogging.

Enables log file validation for the reported CloudTrail. Required IAM permission: cloudtrail:UpdateTrail.

Updates trail settings for event logging and log file handling. Designates an existing bucket for log delivery without requiring a service restart. Note: This must be executed from the region where the trail was created. Required IAM permission: cloudtrail:UpdateTrail.

Retrieves settings for a specific trail or returns information about all trails in the current AWS account. Required IAM permission: cloudtrail:DescribeTrails.

Allocates an Elastic IP address to your AWS account. After you allocate the Elastic IP address you can associate it with an instance or network interface. Required IAM Permission: ec2:AllocateAddress.

Associates an Elastic IP address, or carrier IP address (for instances that are in subnets in Wavelength Zones) with an instance or a network interface. Required IAM Permission: ec2:AssociateAddress.

Disassociates an Elastic IP address from the instance or network interface it's associated with. Required IAM Permission: ec2:DisassociateAddress.

Releases the specified Elastic IP address. After releasing an Elastic IP address, it is released to the IP address pool and might be unavailable to you. Required IAM Permission: ec2:ReleaseAddress.

Describes one or more of your Elastic IP addresses. Required IAM Permission: ec2:DescribeAddresses.

Enables instance metadata services v2.0 for the EC2 instance. Required IAM permission: ec2:ModifyInstanceMetadataOptions.

Launches an EC2 Fleet. Required IAM Permission: ec2:CreateFleet.

Deletes the specified EC2 Fleet. Required IAM Permission: ec2:DeleteFleets.

Describes the running instances for the specified EC2 Fleet. Required IAM Permission: ec2:DescribeFleetInstances.

Modifies the specified EC2 Fleet. Required IAM Permission: ec2:ModifyFleet.

Describes one or more of your EC2 Fleets. Required IAM Permission: ec2:DescribeFleets.

Allocates Dedicated Hosts to your account. Requires the instance type or family, the Availability Zone, and the quantity of hosts to allocate. Required IAM Permission: ec2:AllocateHosts.

Releases the specified Dedicated Hosts. Required IAM Permission: ec2:ReleaseHosts.

Describes IAM instance profile associations. Required IAM Permission: ec2:DescribeIamInstanceProfileAssociations.

Modifies a specific attribute of the specified AMI. Required IAM permission: ec2:ModifyImageAttribute.

Revokes public launch permissions for the EC2 AMI. Required IAM permission: ec2:ModifyImageAttribute.

Waits until an AMI is in the 'available' state. This command polls the AMI status until it becomes available or the maximum wait time is reached. Required IAM Permission: ec2:DescribeImages.

Initiates the copy of an AMI from the specified source region to the current region. You can copy an AMI across regions to enable consistent global deployment. Required IAM Permission: ec2:CopyImage.

Creates an Amazon Machine Image (AMI) from an Amazon EBS-backed instance. The instance must be in the running or stopped state. Required IAM Permission: ec2:CreateImage.

Deregisters the specified Amazon Machine Image (AMI). After you deregister an AMI, it can't be used to launch new instances. However, it doesn't affect any instances that you've already launched from the AMI. Required IAM Permission: ec2:DeregisterImage.

Describes the specified images (AMIs, AKIs, and ARIs) available to you or all of the images available to you. Required IAM Permission: ec2:DescribeImages.

Modifies a specific attribute for a specific instance. You can define only one attribute at a time. Required IAM permission: ec2:ModifyInstanceAttribute.

Removes the associated security group from the EC2 instance profile. Required IAM permission: ec2:ModifyInstanceAttribute.

Modifes the EC2 instance metadata parameters on a running or stopped instance. Required IAM permission: ec2:ModifyInstanceMetadataOptions.

Waits until the specified EC2 instances reach the 'running' state. Checks the status every `waiter_delay` seconds until successful or until `waiter_max_attempts` is reached (default maximum attempts: `waiter_max_attempts`). Required IAM Permission: ec2:DescribeInstances.

Waits until EC2 instance status checks pass. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstanceStatus.

Waits until EC2 instances are in the 'stopped' state. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstances.

Waits until the specified EC2 instances reach the 'terminated' state. Checks every `waiter_delay` seconds until successful or until the maximum number of attempts (`waiter_max_attempts`) is reached. Required IAM Permission: ec2:DescribeInstances.

Returns details for specific instances or all instances. Required IAM permission: ec2:DescribeInstances.

Enables detailed monitoring on one or more running Amazon EC2 instances. Required IAM Permission: ec2:MonitorInstances.

Requests a reboot of one or more instances. This operation is asynchronous; it only queues a request to reboot the specified instances. Required IAM Permission: ec2:RebootInstances.

Launches a defined number of instances using an authorized AMI. Supports using a launch template to automate parameter entry. Check instance status using the aws-ec2-instances-describe command. Required IAM permission: ec2:RunInstances.

Starts an Amazon EBS-backed instance that was previously stopped. Required IAM permission: ec2:StartInstances.

Stops an Amazon EBS-backed instance. Required IAM permission: ec2:StopInstances.

Shuts down specific instances. This operation is idempotent; you can terminate an instance multiple times without causing an error. Required IAM permission: ec2:TerminateInstances.

Disables detailed monitoring for one or more running Amazon EC2 instances. Required IAM Permission: ec2:UnmonitorInstances.

Deletes the specified internet gateway. You must detach the internet gateway from the VPC before you can delete it. Required IAM Permission: ec2:DeleteInternetGateway.

A description of one or more of your internet gateways. Required IAM Permission: ec2:DescribeInternetGateways.

Detaches an internet gateway from a VPC, disabling connectivity between the internet and the VPC. Required IAM Permission: ec2:DetachInternetGateway.

Retrieves the public IP addresses that have been discovered by IPAM, the Amazon VPC IP Address Manager. Required IAM permission: ec2:GetIpamDiscoveredPublicAddresses.

Returns details for IPAM resource discoveries. A resource discovery is an IPAM component that enables IPAM to manage and monitor resources owned by the account. Required IAM permission: ec2:DescribeIpamResourceDiscoveries.

Returns details for a resource discovery associated with an Amazon VPC IPAM. Required IAM permission: ec2:DescribeIpamResourceDiscoveryAssociations.

Describes the specified key pairs or all of your key pairs. Required IAM Permission: ec2:DescribeKeyPairs.

Retrieves the latest AMI. Required IAM permission: ec2:DescribeImages.

Creates a launch template. A launch template contains the parameters to launch an instance. Required IAM Permission: ec2:CreateLaunchTemplate.

Deletes a launch template. Deleting a launch template deletes all of its versions. Required IAM Permission: ec2:DeleteLaunchTemplate.

Describes one or more launch templates. Required IAM Permission: ec2:DescribeLaunchTemplates.

Creates a network ACL in the defined VPC, providing an optional layer of security (in addition to security groups) for the instances in your VPC. Required IAM permission: ec2:CreateNetworkAcl.

Creates an entry (a rule) in a network ACL with the specified rule number. Required IAM Permission: ec2:CreateNetworkAclEntry.

Modifies a specific network interface attribute. You can specify only one attribute at a time. You can use this action to attach and detach security groups from an existing EC2 instance. Required IAM permission: ec2:ModifyNetworkInterfaceAttribute.

Retrieves the encrypted administrator password for a running Windows instance. Required IAM Permission: ec2:GetPasswordData.

Returns details for the regions enabled for your account, or for all regions. Required IAM permission: ec2:DescribeRegions.

Describes one or more of the Reserved Instances that you purchased. Required IAM Permission: ec2:DescribeReservedInstances.

Creates a security group. Required IAM permission: ec2:CreateSecurityGroup.

Deletes a security group. Required IAM permission: ec2:DeleteSecurityGroup.

Adds the specified inbound (egress) rules to a security group. Required IAM Permission: ec2:AuthorizeSecurityGroupEgress.

Removes specified outbound (egress) rules from a security group. Required IAM permission: ec2:RevokeSecurityGroupEgress.

Adds specified inbound (ingress) rules to a security group. Required IAM permission: ec2:AuthorizeSecurityGroupIngress.

Revokes ingress rules in a security group. Required IAM permission: ec2:RevokeSecurityGroupIngress.

Returns details for a specific security group or all of your security groups, including their rules, tags, and associated VPC information. Required IAM permission: ec2:DescribeSecurityGroups.

Revokes public access to the EC2 snapshot. Required IAM permission: ec2:ModifySnapshotAttribute.

Adds or removes permission settings for a specified snapshot. Note: snapshots encrypted with the AWS-managed default key (alias/aws/ebs) cannot be shared. Use unencrypted snapshots or those encrypted with a customer-managed KMS key to allow permission modifications. Required IAM permission: ec2:ModifySnapshotAttribute.

A waiter function that waits until the snapshot is complete. Required IAM Permission: ec2:DescribeSnapshots.

Copies a point-in-time snapshot of an EBS volume and stores it in Amazon S3. You can copy a snapshot within the same Region, from one Region to another, or from a Region to an Outpost. Required IAM Permission: ec2:CopySnapshot.

Creates a snapshot of an EBS volume and stores it in Amazon S3. You can use snapshots for backups, to make copies of EBS volumes, and to save data before shutting down an instance. Required IAM permission: ec2:CreateSnapshot.

Deletes the specified snapshot. Required IAM Permission: ec2:DeleteSnapshot.

Adds or removes permission settings for a specific snapshot. Required IAM permission: ec2:ModifySnapshotAttribute.

Describes the EBS snapshots available to you or all snapshots accessible in your environment. Required IAM Permission: ec2:DescribeSnapshots.

Modifies a subnet attribute. Required IAM permission: ec2:ModifySubnetAttribute.

Deletes the specified subnet. You must terminate all running instances in the subnet before you can delete the subnet. Required IAM Permission: ec2:DeleteSubnet.

Returns details for one or more provided subnets. Required IAM permission: ec2:DescribeSubnets.

Adds or overwrites one or more tags for specific Amazon EC2 resources. When you specify an existing tag key, the value is overwritten with the new value. Required IAM permission: ec2:CreateTags.

Creates a Traffic Mirror session. A Traffic Mirror session actively copies packets from a Traffic Mirror source to a Traffic Mirror target. Required IAM Permission: ec2:CreateTrafficMirrorSession.

Attaches an EBS volume to a running or stopped instance and exposes it to the instance with the specified device name. Required IAM Permission: ec2:AttachVolume.

Creates an EBS volume that can be attached to an instance in the same Availability Zone. Required IAM Permission: ec2:CreateVolume.

Deletes the specified EBS volume. The volume must be in the available state (not attached to an instance). Required IAM Permission: ec2:DeleteVolume.

Detaches an EBS volume from an instance. Required IAM Permission: ec2:DetachVolume.

You can modify several parameters of an existing EBS volume, including volume size, volume type, and IOPS capacity. Required IAM Permission: ec2:ModifyVolume.

Describes the specified EBS volumes or all of your EBS volumes. Required IAM Permission: ec2:DescribeVolumes.

Deletes a specified VPC. You must detach or delete all gateways and resources that are associated with the VPC before you can delete it. Required IAM Permission: ec2:DeleteVpc.

Creates a VPC endpoint for a specified service. An endpoint enables you to create a private connection between your VPC and the service. Required IAM Permission: ec2:CreateVpcEndpoint.

Returns details for one or more provided VPCs. Required IAM permission: ec2:DescribeVpcs.

Updates the containerInsights setting of an ECS cluster. Required IAM permission: ecs:UpdateClusterSettings.

Creates a new Access Entry for an Amazon EKS cluster. Required IAM Permission: eks:CreateAccessEntry.

Updates an existing Access Entry for an Amazon EKS cluster. Required IAM Permission: eks:UpdateAccessEntry.

Associates an access policy and its scope to an access entry. Required IAM permission: eks:AssociateAccessPolicy.

Updates an Amazon EKS cluster configuration. Only one type of update is allowed per call (logging or resources_vpc_config). Required IAM permission: eks:UpdateClusterConfig.

Returns details for an Amazon EKS cluster. Required IAM permission: eks:DescribeCluster.

Returns a list of EKS clusters. Required IAM Permission: eks:ListClusters.

Disables public access to the EKS cluster's API endpoint, making it only accessible from within the cluster's VPC. Required IAM permission: eks:UpdateClusterConfig.

Enables control plane logging for an EKS cluster. Required IAM permission: eks:UpdateClusterConfig.

Modifies attributes for a Classic Elastic Load Balancer. Required IAM permission: elasticloadbalancing:ModifyLoadBalancerAttributes.

Changes the status of the specified access key from Active to Inactive, or vice versa. Can be used to disable a user's access key as part of a key rotation workflow. Required IAM permission: iam:UpdateAccessKey.

Retrieves the AWS account password policy. Required IAM permission: iam:GetAccountPasswordPolicy.

Creates or updates AWS account password policy. Required IAM permission: iam:UpdateAccountPasswordPolicy.

Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console. Required IAM permission: iam:DeleteLoginProfile.

Removes the specified IAM role from the specified EC2 instance profile. Required IAM permission: iam:RemoveRoleFromInstanceProfile.

Adds or updates an inline policy document that is embedded in the specified IAM role. Required IAM permission: iam:PutRolePolicy.

Adds or updates an inline policy document that is embedded in the specified IAM user. Required IAM permission: iam:PutUserPolicy.

Enables automatic rotation for a symmetric customer-managed KMS key. Not supported for asymmetric/HMAC keys, keys with imported material, or custom key stores. Default is us-east-1. Required IAM permission: kms:EnableKeyRotation.

Retrieves details about the account's limits and usage in an AWS Region. Required IAM Permission: lambda:GetAccountSettings.

Returns a list of aliases created for a Lambda function. Required IAM Permission: lambda:ListAliases.

Retrieves configuration information about a Lambda function. Required IAM permission: lambda:GetFunctionConfiguration.

Updates the configuration for a Lambda function. Required IAM Permission: lambda:UpdateFunctionConfiguration.

Creates a Lambda function. To create a function, you need a deployment package and an execution role. Required IAM Permission: lambda:CreateFunction.

Deletes a Lambda function. Required IAM Permission: lambda:DeleteFunction.

Returns information about the function or the specified version, including a link to download the deployment package (valid for 10 minutes). If a version is specified, only version-specific details are returned. Required IAM Permission: lambda:GetFunction.

Deletes a Lambda function URL. When you delete a function URL, you can't recover it. Creating a new function URL results in a different URL address. Required IAM Permission: lambda:DeleteFunctionUrlConfig.

Returns the configuration for a Lambda function URL. Required IAM permission: lambda:GetFunctionUrlConfig.

Updates the configuration for a Lambda function URL. Required IAM permission: lambda:UpdateFunctionUrlConfig.

Returns a list of versions, with the version-specific configuration of each. Required IAM Permission: lambda:ListVersionsByFunction.

Returns a list of your Lambda functions. For each function, the response includes the function configuration information. Required IAM Permission: lambda:ListFunctions.

Invokes a Lambda function. Define only the function name to invoke the latest version, or use the Qualifier parameter for a specific version or alias. Note: Synchronous calls may retry on timeout, potentially causing client disconnection. Asynchronous calls require idempotent functions to handle multiple possible invocations. Required IAM permission: lambda:InvokeFunction.

Deletes a version of a Lambda layer. Required IAM Permission: lambda:DeleteLayerVersion.

Lists the versions of an Lambda layer. Required IAM Permission: lambda:ListLayerVersions.

Creates a Lambda layer from a ZIP archive. Required IAM Permission: lambda:PublishLayerVersion.

Returns the resource-based IAM policy for a Lambda function. Required IAM permission: lambda:GetPolicy.

Enables deletion protection for the RDS DB cluster to prevent accidental deletion. Required IAM permission: rds:ModifyDBCluster.

Enables 'iam database authentication' for the RDS cluster. Required IAM permission: rds:ModifyDBCluster.

Modifies settings for an Amazon RDS DB cluster. Allows you to update cluster settings such as port, master credentials, VPC security groups, deletion protection, and other configuration options. Required IAM Permission: rds:ModifyDBCluster.

Modifies the attributes associated with a DB cluster snapshot. Required IAM permission: rds:ModifyDBClusterSnapshotAttribute.

Revokes public access to the RDS DB cluster snapshot, making it private. Required IAM permission: rds:ModifyDBClusterSnapshotAttribute.

Enables automatic minor version upgrades for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance.

Enables deletion protection for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance.

Enables IAM database authentication for the RDS DB instance. Required IAM permission: rds:ModifyDBInstance.

Enables Multi-AZ deployment for the RDS database instance to enhance availability and durability. Required IAM permission: rds:ModifyDBInstance.

Modifies an existing Amazon RDS DB instance. Enables updating the instance class, storage capacity, security groups, and other configuration parameters without the need to create a new instance. Required IAM permission: rds:ModifyDBInstance.

Enables 'copy tags to snapshots' for the RDS instance. Required IAM permission: rds:ModifyDBInstance.

Enables automatic backup settings for the RDS DB instance with a default retention period of 30 days. Required IAM permission: rds:ModifyDBInstance.

Disables public access for AWS RDS database instance by modifying the instance settings. Required IAM permission: rds:ModifyDBInstance.

Returns information about provisioned RDS instances. Required IAM Permission: rds:DescribeDBInstances.

Adds or removes permission for the specified AWS account ID to restore the specified DB snapshot. Required IAM permission: rds:ModifyDBSnapshotAttribute.

Revokes public access to the RDS DB snapshot, making it private. Required IAM permission: rds:ModifyDBSnapshotAttribute.

Modifies an existing RDS event notification subscription. Required IAM permission: rds:ModifyEventSubscription.

Activates an existing RDS event subscription. Required IAM permission: rds:ModifyEventSubscription.

Modifies the settings of a cluster. Required IAM Permission: redshift:ModifyCluster.

Retrieves the access control list (ACL) of a bucket. Required IAM permission: s3:GetBucketAcl.

Sets the access control list (ACL) permissions for an existing Amazon S3 bucket. This command allows you to define who can access the bucket and what actions they can perform, using predefined ACLs. Since 2023, all new S3 buckets block ACLs by default for better security. Required IAM permission: s3:PutBucketAcl.

Sets the Access Control List (ACL) for the S3 bucket to private. Required IAM permission: s3:PutBucketAcl.

Creates a new S3 bucket. Required IAM permission: s3:CreateBucket.

Delete AWS S3 bucket, the bucket must be empty from files. Required IAM Permission: s3:DeleteBucket.

Enables server access logging for the S3 bucket, delivering logs to a target bucket and prefix. Required IAM permission: s3:PutBucketLogging.

Retrieves the default encryption configuration for an Amazon S3 bucket. Shows the server-side encryption settings that are applied to new objects stored in the bucket. Required IAM permission: s3:GetEncryptionConfiguration.

Configures logging settings for an AWS S3 bucket, enabling monitoring bucket access via logs delivered to a designated target bucket. Required IAM permission: s3:PutBucketLogging.

Returns some or all (up to 1,000) of the objects in a bucket. Required IAM Permission: s3:ListBucket.

Creates or modifies ownership controls for an Amazon S3 bucket. Required IAM permission: s3:PutBucketOwnershipControls.

Switches the bucket to "Bucket Owner Enforced" mode, placing all access control under your account policies. Required IAM permission: s3:PutBucketOwnershipControls.

Deletes the bucket policy from an Amazon S3 bucket, removing all policy-based access controls from the bucket and potentially changing access permissions. Required IAM permission: s3:DeleteBucketPolicy.

Retrieves the bucket policy for an Amazon S3 bucket. Returns the policy document in JSON format if one exists. Required IAM permission: s3:GetBucketPolicy.

Applies an Amazon S3 bucket policy to an Outposts bucket. Required IAM permission: s3:PutBucketPolicy.

Enforces SSL-only access on the S3 bucket by applying a bucket policy that denies all non-HTTPS requests. Required IAM permission: s3:PutBucketPolicy.

Enables versioning on the S3 bucket to retain multiple versions of objects. Required IAM permission: s3:PutBucketVersioning.

Sets the versioning state of an existing bucket. Required IAM permission: s3:PutBucketVersioning.

Removes the website configuration for a bucket. Required IAM permission: s3:DeleteBucketWebsite.

Removes the static website hosting configuration from an S3 bucket. Required IAM permission: s3:DeleteBucketWebsite.

Retrieves the website configuration for a bucket. Required IAM permission: s3:GetBucketWebsite.

Returns a list of all buckets owned by the authenticated sender of the request. Required IAM permission: s3:ListAllMyBuckets.

Downloads a file from the S3 bucket to the War Room. Required IAM permission: s3:GetObject.

Uploads a file to the S3 bucket. Required IAM permission: s3:PutObject.

Retrieves the public access block configuration for an Amazon S3 bucket. Shows the current settings that control public access to the bucket and its objects. Required IAM permission: s3:GetBucketPublicAccessBlock.

Blocks all public access to the S3 bucket. Required IAM permission: s3:PutBucketPublicAccessBlock.

Creates or modifies the PublicAccessBlock configuration for an Amazon S3 bucket. Required IAM permission: s3:PutBucketPublicAccessBlock.

Runs commands on one or more managed nodes. Required IAM permission: ssm:SendCommand, ssm:ListCommands.

Returns a list of inventory items. Required IAM permission: ssm:ListInventoryEntries.