AWS actions

Action	Risk	Idempotency	Scopes
Filter CloudWatch Logs events `cloudwatch_logs.events.filter`	Read	Safe	`logs:FilterLogEvents`
List CloudWatch alarms `cloudwatch.alarms.list`	Read	Safe	`cloudwatch:DescribeAlarms`
Get CloudWatch metric data `cloudwatch.metric_data.get`	Read	Safe	`cloudwatch:GetMetricData`
Get Cost Explorer cost and usage `cost_explorer.cost_and_usage.get`	Read	Safe	`ce:GetCostAndUsage`
Describe EC2 instances `ec2.instances.describe`	Read	Safe	`ec2:DescribeInstances`
Start EC2 instances `ec2.instances.start`	Write	Unsafe	`ec2:StartInstances`
Stop EC2 instances `ec2.instances.stop`	Destructive	Unsafe	`ec2:StopInstances`
Get IAM access key last used `iam.access_keys.last_used.get`	Read	Safe	`iam:GetAccessKeyLastUsed`
Generate IAM credential report `iam.credential_reports.generate`	Read	Safe	`iam:GenerateCredentialReport`
Get IAM credential report `iam.credential_reports.get`	Read	Safe	`iam:GetCredentialReport`
List managed policies attached to IAM group `iam.groups.attached_managed_policies.list`	Read	Safe	`iam:ListAttachedGroupPolicies`
List IAM groups `iam.groups.list`	Read	Safe	`iam:ListGroups`
Add IAM user to group `iam.groups.members.add`	Write	Safe	`iam:AddUserToGroup`
List IAM group members `iam.groups.members.list`	Read	Safe	`iam:GetGroup`
Remove IAM user from group `iam.groups.members.remove`	Destructive	Safe	`iam:RemoveUserFromGroup`
Get IAM managed policy `iam.managed_policies.get`	Read	Safe	`iam:GetPolicy`
List IAM managed policies `iam.managed_policies.list`	Read	Safe	`iam:ListPolicies`
Get IAM managed policy version `iam.managed_policy_versions.get`	Read	Safe	`iam:GetPolicyVersion`
Simulate IAM principal policy `iam.principal_policy.simulate`	Read	Safe	`iam:SimulatePrincipalPolicy`
List managed policies attached to IAM role `iam.roles.attached_managed_policies.list`	Read	Safe	`iam:ListAttachedRolePolicies`
Get IAM role `iam.roles.get`	Read	Safe	`iam:GetRole`
List IAM roles `iam.roles.list`	Read	Safe	`iam:ListRoles`
Deactivate IAM user access key `iam.users.access_keys.deactivate`	Destructive	Safe	`iam:UpdateAccessKey`
List IAM user access keys `iam.users.access_keys.list`	Read	Safe	`iam:ListAccessKeys`
List managed policies attached to IAM user `iam.users.attached_managed_policies.list`	Read	Safe	`iam:ListAttachedUserPolicies`
Create IAM user `iam.users.create`	Write	Unsafe	`iam:CreateUser` `iam:TagUser`
Get IAM user `iam.users.get`	Read	Safe	`iam:GetUser`
List IAM groups for user `iam.users.groups.list`	Read	Safe	`iam:ListGroupsForUser`
List IAM users `iam.users.list`	Read	Safe	`iam:ListUsers`
List IAM user MFA devices `iam.users.mfa_devices.list`	Read	Safe	`iam:ListMFADevices`
Invoke Lambda function asynchronously `lambda.functions.invoke_async`	Write	Unsafe	`lambda:InvokeFunction`
Invoke Lambda function synchronously `lambda.functions.invoke_sync`	Write	Unsafe	`lambda:InvokeFunction`
List Lambda functions `lambda.functions.list`	Read	Safe	`lambda:ListFunctions`
Describe RDS DB instances `rds.db_instances.describe`	Read	Safe	`rds:DescribeDBInstances`
Start RDS DB instance `rds.db_instances.start`	Write	Unsafe	`rds:DescribeDBInstances` `rds:StartDBInstance`
Stop RDS DB instance `rds.db_instances.stop`	Destructive	Unsafe	`rds:DescribeDBInstances` `rds:StopDBInstance`
List S3 buckets `s3.buckets.list`	Read	Safe	`s3:ListAllMyBuckets`
List S3 objects `s3.objects.list`	Read	Safe	`s3:ListBucket`
Presign S3 object GET `s3.objects.presign_get`	Read	Safe	`s3:GetObject`
Presign S3 object PUT `s3.objects.presign_put`	Write	Safe	`s3:PutObject`
Send SQS message `sqs.messages.send`	Write	Unsafe	`sqs:SendMessage`