Policy: AWSResourceGroupsReadOnlyAccess ARN: arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess Allowed Actions Actions Services cloudformation:DescribeStacks cloudformation cloudformation:ListStackResources cloudformation ec2:DescribeInstances ec2 ec2:DescribeSecurityGroups ec2 ec2:DescribeSnapshots ec2 ec2:DescribeVolumes ec2 ec2:DescribeVpcs ec2 elasticache:DescribeCacheClusters elasticache elasticache:DescribeSnapshots elasticache elasticache:ListTagsForResource elasticache elasticbeanstalk:DescribeEnvironments elasticbeanstalk elasticloadbalancing:DescribeLoadBalancers elasticloadbalancing elasticloadbalancing:DescribeTags elasticloadbalancing elasticmapreduce:DescribeCluster elasticmapreduce elasticmapreduce:ListClusters elasticmapreduce glacier:DescribeVault glacier glacier:ListTagsForVault glacier glacier:ListVaults glacier kinesis:DescribeStream kinesis kinesis:ListStreams kinesis kinesis:ListTagsForStream kinesis opsworks:DescribeStacks opsworks opsworks:ListTags opsworks rds:DescribeDBInstances rds rds:DescribeDBSnapshots rds rds:ListTagsForResource rds redshift:DescribeClusters redshift redshift:DescribeTags redshift resource-groups:Get* resource-groups resource-groups:List* resource-groups resource-groups:Search* resource-groups route53:GetHealthCheck route53 route53:GetHostedZone route53 route53:ListHealthChecks route53 route53:ListHostedZones route53 route53:ListTagsForResource route53 route53domains:ListDomains route53domains s3:GetBucketTagging s3 s3:ListAllMyBuckets s3 ssm:ListDocuments ssm storagegateway:DescribeGatewayInformation storagegateway storagegateway:ListGateways storagegateway storagegateway:ListTagsForResource storagegateway tag:Get* tag