IAM Permissions

Pass 2 — Enablement checks

These are IAM action names, resolved per operation from the Service Authorization Reference. Most match the operation name; some do not, for example detective:ListOrganizationAdminAccount for the ListOrganizationAdminAccounts operation. The Security Hub V2 exceptions are listed in Security Hub (opens in a new tab).

Identity confirmation uses sts:GetCallerIdentity. Optional simulation uses iam:SimulatePrincipalPolicy; it is not required for the assessment. Request only the reads selected for the workflow; apigateway:GET includes REST API stage reads.

Diagnosing gaps

AccessDenied and “not enabled” are different answers, and several of these APIs return the same error for both. Distinguish them before reporting:

Resolve an IAM user/role ARN before optional simulation; do not pass an STS assumed-role session ARN. If identity cannot be resolved, skip simulation. An allowed decision does not prove live authorization or service disablement. Ambiguous failures remain UNKNOWN; retain documented, validated not-enabled responses as negative evidence.

Managed policies

SecurityAudit and ViewOnlyAccess cover most of the above. Neither is complete for this skill — SecurityAudit omits some newer inspector2 and securitylake read actions. Verify with simulate-principal-policy rather than assuming coverage.

Admin/FullAccess policies grant more than this assessment needs. For an accepted recommendation, hand off implementation separately for operation-specific least-privilege permission design. Do not provide write commands or expand this assessment’s permissions; do not use admin policies as a default.

Organization scope

Permission availability does not authorize enumeration. ListAccounts, service member reads, and per-member reconciliation require an explicit request for detailed account-level information. Otherwise prefer counts/statistics and mark unrequested detail NOT ASSESSED.

Member accounts cannot read describe-organization-configuration for these services. Run pass 2’s org checks from the delegated administrator account, or the management account to identify who the delegated admins are. From a member account, report the scope limitation explicitly rather than presenting single-account results as organization-wide.

Focused evidence and scoped coverage

The matrix (opens in a new tab) adds focused customer-evidence paths, not blanket new permissions. Existing inspector2:ListCoverage and guardduty:ListCoverage authorize reads whose API requests must still use the account predicates in enablement checks (opens in a new tab). An allowed IAM result or delegated-admin role does not widen the approved collection scope. Verify exact new action/resource permissions separately before any future read is added; manual configuration excerpts do not justify granting provisioning or scan permissions.