---
title: AWS IAM policy examples
source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples
---

Use these complete IAM policy templates for common workflow types. Each follows the principle of least privilege by restricting access to specific resources.

## SQS messaging workflow [#sqs-policy]

Restrict access to a specific queue:

```json
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "sqs:SendMessage",
        "Resource": "arn:aws:sqs:us-west-2:123456789012:my-workflow-queue"
      },
      {
        "Effect": "Allow",
        "Action": "sqs:GetQueueAttributes",
        "Resource": "arn:aws:sqs:us-west-2:123456789012:my-workflow-queue"
      }
    ]
  }
```

Replace `us-west-2` with your region, `123456789012` with your AWS account ID, and `my-workflow-queue` with your queue name.

## EC2 management workflow [#ec2-policy]

Restrict access to specific instances by tag:

```json
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ec2:DescribeInstances",
          "ec2:DescribeTags"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "ec2:StopInstances",
          "ec2:StartInstances",
          "ec2:ModifyInstanceAttribute"
        ],
        "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
        "Condition": {
          "StringEquals": {
            "aws:ResourceTag/Environment": "production"
          }
        }
      }
    ]
  }
```

This policy allows workflows to _stop/start/modify_ only EC2 instances tagged with `Environment=production`.

## DynamoDB workflow [#dynamodb-policy]

Restrict access to a specific table:

```json
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dynamodb:Query",
          "dynamodb:GetItem",
          "dynamodb:PutItem"
        ],
        "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/WorkflowData"
      }
    ]
  }
```

Replace `WorkflowData` with your table name.

## Systems Manager workflow [#ssm-policy]

Restrict access to specific automation documents:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:CreateDocument",
        "ssm:DeleteDocument"
      ],
      "Resource": "arn:aws:ssm:us-east-1:123456789012:document/WorkflowAutomation-*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartAutomationExecution",
        "ssm:GetAutomationExecution"
      ],
      "Resource": [
        "arn:aws:ssm:us-east-1:123456789012:automation-definition/WorkflowAutomation-*:*",
        "arn:aws:ssm:us-east-1:123456789012:automation-execution/*"
      ]
    }
  ]
}
```

This restricts automation documents to those prefixed with `WorkflowAutomation-`.

## API Gateway workflow [#apigateway-policy]

Restrict access to a specific API:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:GET",
        "apigateway:PUT"
      ],
      "Resource": "arn:aws:apigateway:us-west-2::/restapis/abc123xyz/*"
    }
  ]
}
```

Replace `abc123xyz` with your API Gateway ID.

## Additional resources [#additional-resources]

For comprehensive AWS permission references:

-   **[AWS integrations managed policies](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/get-started/integrations-managed-policies/)**: Complete list of AWS permissions by service, plus CloudFormation templates you can adapt
-   **[Set up AWS API polling](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/connect/set-up-aws-api-polling/)**: Additional setup patterns

> #### ⚠️ IMPORTANT
>
> Those resources use account ID `754728514883` for cloud integrations (monitoring). For workflow automation, always use `253490767857`.

## Related topics [#related-topics]

[AWS credentials overview](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials)

Compare authentication methods and choose the right one

[IAM role setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-role-setup)

Configure IAM role for production workflows (recommended)

[IAM user setup](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-user-setup)

Set up IAM user with access keys for testing

[AWS actions](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/actions-catalog)

Browse EC2, Lambda, S3, SQS, and other AWS actions