Policy: AWSWellArchitectedDiscoveryServiceRolePolicy ARN: arn:aws:iam::aws:policy/aws-service-role/AWSWellArchitectedDiscoveryServiceRolePolicy Allowed Actions Actions Services cloudformation:DescribeStacks cloudformation cloudformation:ListStackResources cloudformation resource-groups:ListGroupResources resource-groups servicecatalog:AssociateAttributeGroup servicecatalog servicecatalog:CreateAttributeGroup servicecatalog servicecatalog:DeleteAttributeGroup servicecatalog servicecatalog:DisassociateAttributeGroup servicecatalog servicecatalog:GetApplication servicecatalog servicecatalog:ListAssociatedResources servicecatalog servicecatalog:UpdateAttributeGroup servicecatalog tag:GetResources tag trustedadvisor:DescribeCheckItems trustedadvisor trustedadvisor:DescribeChecks trustedadvisor