AWS Managed Policy Lookup

Attaching the right AWS managed policy means first knowing it exists and remembering its exact name and ARN — AWS ships over 1,000 of these ready-made, AWS-maintained policies, and typing one wrong (or confusing AmazonS3ReadOnlyAccess with AmazonS3FullAccess) is an easy mistake. AWS Managed Policy Lookup is a searchable table of commonly used AWS managed policies with their exact ARN and a one-line description of what each grants, so you can find and copy the right one quickly.

Every AWS managed policy's ARN follows the pattern arn:aws:iam::aws:policy/PolicyName, using the literal account id aws instead of your own 12-digit account id — the giveaway that a policy is AWS-managed rather than something your own account created. A handful of policies meant for service roles, like AWSLambdaBasicExecutionRole, live under an extra service-role/ path segment, which is easy to miss if you're typing the ARN from memory.

This is a curated subset of roughly 25 of the most frequently referenced managed policies, spanning broad-access policies (AdministratorAccess, PowerUserAccess, ReadOnlyAccess), per-service read-only/full-access pairs (S3, EC2, DynamoDB, SNS, SQS, CloudWatch, RDS, VPC), and a few specialized ones (SecurityAudit, AWSSupportAccess, the Lambda execution role, the EKS cluster policy) — not AWS's complete catalog. Policy contents can also change over time as AWS extends them, so treat the description shown here as a helpful summary and verify the current permissions in the IAM console or AWS CLI before relying on it for an access decision.

• ~25 curated AWS managed policies spanning broad-access, per-service, and specialized policies.
• Exact ARN for every policy, including the service-role/ path segment where it applies.
• One-line description of what each policy grants.
• Live search across policy name, ARN, and description.
• One-click copy of any policy's ARN.
• 100% client-side — a static reference table, nothing sent anywhere.

1. Type a keyword into the search box (e.g. "s3", "read only", "lambda").
2. Scan the matching rows for the policy name and description.
3. Click the copy icon to copy that policy's exact ARN.
4. Verify current permissions in the IAM console before attaching, especially for anything security-sensitive.

Example 1 — granting a new engineer read access. Search "read only" to compare ReadOnlyAccess (all services) against ViewOnlyAccess (metadata only, no resource content) and pick the narrower one that fits.

Example 2 — a Lambda execution role. Search "lambda" to find AWSLambdaBasicExecutionRole and its service-role/-prefixed ARN for CloudWatch Logs permissions.

Example 3 — an auditor role. Search "audit" to find SecurityAudit, which reads security configuration across services without granting write access to anything.

• Saves time versus hunting through the IAM console for an exact policy name and ARN.
• Reduces ARN typos — copy the exact string instead of retyping it.
• Flags the service-role/ path quirk that's easy to miss on policies like AWSLambdaBasicExecutionRole.
• Honest about its limits — a curated subset with an explicit prompt to verify current permissions before relying on them.