Policy: AWSServiceCatalogAdminReadOnlyAccess ARN: arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess Allowed Actions Actions Services cloudformation:DescribeChangeSet cloudformation cloudformation:DescribeStackEvents cloudformation cloudformation:DescribeStackInstance cloudformation cloudformation:DescribeStackSet cloudformation cloudformation:DescribeStackSetOperation cloudformation cloudformation:DescribeStacks cloudformation cloudformation:GetTemplateSummary cloudformation cloudformation:ListChangeSets cloudformation cloudformation:ListStackInstances cloudformation cloudformation:ListStackResources cloudformation cloudformation:ListStackSetOperationResults cloudformation cloudformation:ListStackSetOperations cloudformation config:DescribeConfigurationRecorderStatus config config:DescribeConfigurationRecorders config iam:GetGroup iam iam:GetRole iam iam:GetUser iam iam:ListGroups iam iam:ListRoles iam iam:ListUsers iam servicecatalog:Describe* servicecatalog servicecatalog:Get* servicecatalog servicecatalog:List* servicecatalog servicecatalog:ScanProvisionedProducts servicecatalog servicecatalog:Search* servicecatalog ssm:DescribeDocument ssm ssm:GetAutomationExecution ssm ssm:ListDocumentVersions ssm ssm:ListDocuments ssm