Policy: ConfigConformsServiceRolePolicy ARN: arn:aws:iam::aws:policy/aws-service-role/ConfigConformsServiceRolePolicy Allowed Actions Actions Services cloudformation:CreateStack cloudformation cloudformation:DeleteStack cloudformation cloudformation:DescribeStackEvents cloudformation cloudformation:DescribeStackResource cloudformation cloudformation:DescribeStackResources cloudformation cloudformation:DescribeStacks cloudformation cloudformation:GetStackPolicy cloudformation cloudformation:ListStackResources cloudformation cloudformation:SetStackPolicy cloudformation cloudformation:UpdateStack cloudformation cloudformation:UpdateTerminationProtection cloudformation cloudformation:ValidateTemplate cloudformation cloudwatch:PutMetricData cloudwatch config:DeleteConfigRule config config:DeleteRemediationConfiguration config config:DescribeConfigRules config config:DescribeRemediationConfigurations config config:PutConfigRule config config:PutRemediationConfigurations config iam:CreateServiceLinkedRole iam iam:GetRole iam iam:GetRole iam iam:PassRole iam s3:GetBucketAcl s3 s3:GetObject s3 s3:PutObject s3 s3:PutObjectAcl s3 ssm:DescribeDocument ssm ssm:GetDocument ssm