Every summer I tell myself AWS will slow down a bit. It never does.

Four months, 248 new policy versions, 93 new policies and 1,022 IAM actions that never showed up in a managed policy before. That is roughly twice last summer. And September is not even over (AWS will probably ship a few more before Wednesday).

Here is what changed in AWS managed IAM policies in Summer 2026 (June to September), straight from the IAMTrail archive. Every policy below links to its full version history and diffs.

The Numbers

Summer 2026 Jun to Sep 2025
Policy versions published 248 152
Distinct policies updated 158 107
New policies 93 50
Policies removed 0 0
Actions added to existing policies 3,141 1,401
Actions removed from existing policies 34 60
IAM actions seen for the first time 1,022 467
New service prefixes 15 8

New Service Prefixes

The strongest signal in the archive: the IAM prefix usually lands before the SDK and the docs.

The theme is not subtle: agents everywhere. FinOps Agent, Agent Registry, Bedrock web search, Nova Act, and the DevOps Agent policies shipping a new version every two weeks or so. And assurance and builderid do not even have a public service name in the IAM dataset yet.

That is exactly why I track prefixes: IAM tells the story before the marketing does.

New Wildcard Grants

Most of these are expected. A FullAccess policy with agent-registry:* does what it says on the tin, and the scanning roles need a lot of Describe* by design.

The ones I would look at twice are the SageMaker Studio Permissive execution policies: events:*, elasticmapreduce:*, emr-containers:*, comprehend:* and application-autoscaling:*, all on Resource: *, no condition. The name is honest, at least. If a data scientist’s execution role uses one of them, it can now manage any EventBridge rule and any EMR cluster in the account.

New Policies

The 15 largest of 93, by action count:

Biggest Updates

  • AWSResourceExplorerServiceRolePolicy (v51 to v55): +1,220 / -0. Added access-analyzer:CheckNoPublicAccess, access-analyzer:GetAnalyzer, access-analyzer:ListArchiveRules, access-analyzer:ValidatePolicy, acm-pca:DescribeCertificateAuthority and 1,215 more.
  • AWSSupportServiceRolePolicy (v58 to v59): +364 / -0. Added acm:describeAcmeAccount, acm:describeAcmeDomainValidation, acm:describeAcmeEndpoint, acm:describeAcmeExternalAccountBinding, acm:listAcmeAccounts and 359 more.
  • AWS_ConfigRole (v71 to v73): +231 / -0. Added access-analyzer:CheckNoPublicAccess, access-analyzer:ValidatePolicy, account-access:GetEntitlement, account-access:ListEntitlements, aoss:BatchGetCollectionGroup and 226 more.
  • AWSConfigServiceRolePolicy (v94 to v96): +231 / -0. Added access-analyzer:CheckNoPublicAccess, access-analyzer:ValidatePolicy, account-access:GetEntitlement, account-access:ListEntitlements, aoss:BatchGetCollectionGroup and 226 more.
  • ReadOnlyAccess (v186 to v190): +175 / -0. Added agent-registry:GetDiscoverableRegistryRecord, agent-registry:GetRegistry, agent-registry:GetRegistryRecord, agent-registry:InvokeRegistryMcp, agent-registry:ListDiscoverableRegistryRecords and 170 more.
  • AIDevOpsAgentAccessPolicy (v5 to v11): +99 / -4. Added acm:GetCertificate, acm:ListCertificates, aidevops:GetAsset, aidevops:GetAssetContent, aidevops:GetAssetFile and 94 more. Removed health:DescribeEventDetails, health:DescribeEvents, servicequotas:GetServiceQuota, servicequotas:ListServiceQuotas.
  • AWSElasticBeanstalkServiceRolePolicy (v7 to v8): +84 / -0. Added acm:AddTagsToCertificate, acm:DeleteCertificate, acm:DescribeCertificate, acm:ListCertificates, acm:ListTagsForCertificate and 79 more.
  • AmazonLaunchWizardFullAccessV2 (v2): +62 / -0. Added backup:ListBackupPlans, cloudformation:UntagResource, dynamodb:TagResource, dynamodb:UntagResource, ec2:CreateLaunchTemplate and 57 more.
  • SecurityAudit (v89 to v93): +53 / -0. Added bedrock-agentcore:GetABTest, bedrock-agentcore:GetBatchEvaluation, bedrock-agentcore:GetConfigurationBundle, bedrock-agentcore:GetConfigurationBundleVersion, bedrock-agentcore:GetEvaluator and 48 more.
  • SageMakerStudioProjectUserRolePolicy (v69 to v75): +14 / -27. Added codeconnections:GetConnection, codeconnections:GetHost, codeconnections:ListConnections, codeconnections:ListTagsForResource, codeconnections:UseConnection and 9 more. Removed emr-containers:DescribeManagedEndpoint, emr-containers:GetManagedEndpointSessionCredentials, glue:CancelDataQualityRuleRecommendationRun, glue:CancelDataQualityRulesetEvaluationRun, glue:CancelStatement and 22 more.

The ones that matter for almost everyone:

  • ReadOnlyAccess (+175): attached to auditors, vendors, and a lot of “read-only” roles. It now includes agent-registry:InvokeRegistryMcp. An Invoke in a read-only policy. Probably harmless, but read-only is not what it used to be.
  • SecurityAudit (+53): mostly Bedrock AgentCore reads. Good news if your security tooling relies on it: more visibility for free.
  • Resource Explorer and Config (+1,220 and +231 twice): both learn to see new resource types. Nothing to do, just nice to know.

Not in this list because it is brand new: the Well-Architected agent. AWSWellArchitectedAgentResourceScanningServiceRolePolicy was created in August with 816 actions, and got 1,965 more in September. The biggest newcomer of the summer, by far.

Brand-New IAM Actions

1,022 actions appeared in a managed policy for the first time. Where they came from:

Most Active

What to Check in Your Accounts

Who has ReadOnlyAccess attached, and do they really need to read your Agent Registry?

1
2

aws iam list-entities-for-policy \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Is any role using the SageMaker Studio Permissive execution policies?

1
2
3
4
5
6
7

for arn in $(aws iam list-policies --scope AWS \
    --query "Policies[?contains(PolicyName, 'PermissiveExecutionPolicy')].Arn" \
    --output text); do
  echo "$arn"
  aws iam list-entities-for-policy --policy-arn "$arn" \
    --query 'PolicyRoles[].RoleName' --output text
done

And subscribe on IAMTrail to the policies you actually attach, so the next change is not a surprise.

Takeaways

  • AWS ships agents, and agents ship IAM: 15 new service prefixes this summer, most of them agent-shaped.
  • Read-only is a moving target: ReadOnlyAccess got 5 new versions in four months. The policy you approved in June is not the one attached today.
  • Wildcards hide from action counts: events:* adds zero new actions in a literal diff. Look at both.
  • AWS hits the undo button too: AWSObservabilityAdminTelemetryEnablementServiceRolePolicy went to v16 on Sep 23, and was back on v15 two hours later.

If you want the background, this archive started as MAMIP in 2019 and became IAMTrail.

IAMTrail sends instant or daily alerts when a policy you care about changes, and every change is also on the RSS feeds.

Want someone to check how these changes land in your own AWS Organization? That is literally my job at zoph.io (Self-promotion).

That’s all, folks! 👋🏼

zoph.