To add permissions to users, groups, and roles, it's easier to use AWS managed policies than to write policies yourself. It takes time and expertise to create IAM customer managed policies that provide your team with only the permissions they need. To get started quickly, you can use our AWS managed policies. These policies cover common use cases and are available in your AWS account. For more information about AWS managed policies, see AWS managed policies in the IAM User Guide.
AWS services maintain and update AWS managed policies. You can't change the permissions in AWS managed policies. Services occasionally add additional permissions to an AWS managed policy to support new features. This type of update affects all identities (users, groups, and roles) where the policy is attached. Services are most likely to update an AWS managed policy when a new feature is launched or when new operations become available. Services do not remove permissions from an AWS managed policy, so policy updates won't break your existing permissions.
Additionally, AWS supports managed policies for job functions that span multiple services. For example, the ReadOnlyAccess AWS managed policy provides read-only access to all AWS services and resources. When a service launches a new feature, AWS adds read-only permissions for new operations and resources. For a list and descriptions of job function policies, see AWS managed policies for job functions in the IAM User Guide.
You can attach the AWSDataSyncReadOnlyAccess policy to your IAM identities.
This policy grants read-only permissions for DataSync.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "DataSyncReadOnlyAccessPermissions",
"Effect": "Allow",
"Action": [
"datasync:Describe*",
"datasync:List*",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeMountTargets",
"fsx:DescribeFileSystems",
"iam:GetRole",
"iam:ListRoles",
"logs:DescribeLogGroups",
"logs:DescribeResourcePolicies",
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource": "*"
}]
}
You can attach the AWSDataSyncFullAccess policy to your IAM identities.
This policy grants administrative permissions for DataSync and is required for AWS Management Console access to the service. AWSDataSyncFullAccess provides full access to DataSync API operations and the operations that interact with related resources (such as Amazon S3 buckets, Amazon EFS file systems, AWS KMS keys, and Secrets Manager secrets). The policy also grants permissions for Amazon CloudWatch, including creating log groups and creating or updating a resource policy.
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "DataSyncFullAccessPermissions",
"Effect": "Allow",
"Action": [
"datasync:*",
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRegions",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcEndpoints",
"ec2:ModifyNetworkInterfaceAttribute",
"fsx:DescribeFileSystems",
"fsx:DescribeStorageVirtualMachines",
"elasticfilesystem:DescribeAccessPoints",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeMountTargets",
"iam:GetRole",
"iam:ListRoles",
"logs:CreateLogGroup",
"logs:DescribeLogGroups",
"logs:DescribeResourcePolicies",
"outposts:ListOutposts",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:ListBucketVersions",
"s3-outposts:ListAccessPoints",
"s3-outposts:ListRegionalBuckets",
"secretsmanager:ListSecrets",
"kms:ListAliases",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "DataSyncPassRolePermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"datasync.amazonaws.com"
]
}
}
},
{
"Sid": "DataSyncCreateSLRPermissions",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "arn:aws:iam::*:role/aws-service-role/datasync.amazonaws.com/AWSServiceRoleForDataSync",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "datasync.amazonaws.com"
}
}
},
{
"Sid": "DataSyncSecretsManagerCreateAccess",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret"
],
"Resource": [
"arn:*:secretsmanager:*:*:secret:aws-datasync!*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "DataSyncSecretsManagerAccess",
"Effect": "Allow",
"Action": [
"secretsmanager:DeleteSecret",
"secretsmanager:UpdateSecret",
"secretsmanager:PutSecretValue"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:aws-datasync!*"
],
"Condition": {
"StringEquals": {
"secretsmanager:ResourceTag/aws:secretsmanager:owningService": "aws-datasync",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
}
You can't attach the AWSDataSyncServiceRolePolicy policy to your IAM identities. This policy is attached to a service-linked role that allows DataSync to perform actions on your behalf. For more information, see Using service-linked roles for DataSync.
This policy grants administrative permissions that allow the service-linked role to create Amazon CloudWatch logs for DataSync tasks using Enhanced mode.
Policy updates Change Description Date AWSDataSyncFullAccess â ChangeDataSync modified permission statements for AWSDataSyncFullAccess:
The updated statements remove tagging conditions from the permissions DataSync uses to create Secrets Manager secrets.
May 13, 2025 AWSDataSyncFullAccess â ChangeDataSync added new permissions to AWSDataSyncFullAccess:
secretsmanager:CreateSecret
secretsmanager:PutSecretValue
secretsmanager:DeleteSecret
secretsmanager:UpdateSecret
These permissions let DataSync create, edit, and delete AWS Secrets Manager secrets.
May 7, 2025 AWSDataSyncFullAccess â ChangeDataSync added new permissions to AWSDataSyncFullAccess:
secretsmanager:ListSecrets
kms:ListAliases
kms:DescribeKey
These permissions let DataSync retrieve metadata about your AWS Secrets Manager secrets and AWS KMS keys, including any aliases associated with your keys.
April 23, 2025 AWSDataSyncServiceRolePolicy â ChangeDataSync added new permissions to the AWSDataSyncServiceRolePolicy policy that's used by the DataSync service-linked role AWSServiceRoleForDataSync:
secretsmanager:DescribeSecret
secretsmanager:GetSecretValue
These permissions let DataSync read metadata and values for secrets managed by AWS Secrets Manager.
April 15, 2025 AWSDataSyncServiceRolePolicy â New policyDataSync added a policy that's used by the DataSync service-linked role AWSServiceRoleForDataSync. This new managed policy automatically creates Amazon CloudWatch logs for your DataSync tasks that use Enhanced mode.
DataSync added new a permission to AWSDataSyncFullAccess:
iam:CreateServiceLinkedRole
This permission lets DataSync create service-linked roles for you.
October 30, 2024 AWSDataSyncFullAccess â ChangeDataSync added new a permission to AWSDataSyncFullAccess:
ec2:DescribeRegions
This permission lets you choose opt-in Regions when creating a DataSync task for transfers between AWS Regions.
July 22, 2024 AWSDataSyncFullAccess â ChangeDataSync added new a permission to AWSDataSyncFullAccess:
s3:ListBucketVersions
This permission lets you choose a specific version of your DataSync manifest.
February 16, 2024AWSDataSyncFullAccess â Change
DataSync added new permissions to AWSDataSyncFullAccess:
ec2:DescribeVpcEndpoints
elasticfilesystem:DescribeAccessPoints
fsx:DescribeStorageVirtualMachines
outposts:ListOutposts
s3:GetBucketLocation
s3-outposts:ListAccessPoints
s3-outposts:ListRegionalBuckets
These permissions help you create DataSync agents and locations for Amazon EFS, Amazon FSx for NetApp ONTAP, Amazon S3, and S3 on Outposts.
May 2, 2023DataSync started tracking changes
DataSync started tracking changes for its AWS managed policies.
March 1, 2021RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4