| ds:AcceptSharedDirectory | Admin |
| ds:AddIpRoutes | Admin |
| ds:AuthorizeApplication | Admin |
| ds:ConnectDirectory | Admin |
| ds:CreateAlias | Admin |
| ds:CreateConditionalForwarder | Admin |
| ds:CreateDirectory | Admin |
| ds:CreateIdentityPoolDirectory | Admin |
| ds:CreateLogSubscription | Admin |
| ds:CreateMicrosoftAD | Admin |
| ds:CreateTrust | Admin |
| ds:DeleteConditionalForwarder | Admin |
| ds:DeleteDirectory | Admin |
| ds:DeleteLogSubscription | Admin |
| ds:DeleteTrust | Admin |
| ds:DeregisterCertificate | Admin |
| ds:DisableLDAPS | Admin |
| ds:DisableRadius | Admin |
| ds:EnableLDAPS | Admin |
| ds:EnableRadius | Admin |
| ds:RegisterCertificate | Admin |
| ds:RejectSharedDirectory | Admin |
| ds:RemoveIpRoutes | Admin |
| ds:ResetUserPassword | Admin |
| ds:ShareDirectory | Admin |
| ds:UnauthorizeApplication | Admin |
| ds:UnshareDirectory | Admin |
| ds:UpdateConditionalForwarder | Admin |
| ds:UpdateNumberOfDomainControllers | Admin |
| ds:UpdateTrust | Admin |
| ds:AddTagsToResource | Operator |
| ds:CancelSchemaExtension | Operator |
| ds:CreateComputer | Operator |
| ds:CreateSnapshot | Operator |
| ds:DeleteSnapshot | Operator |
| ds:DeregisterEventTopic | Operator |
| ds:DisableSso | Operator |
| ds:EnableSso | Operator |
| ds:RegisterEventTopic | Operator |
| ds:RemoveTagsFromResource | Operator |
| ds:RestoreFromSnapshot | Operator |
| ds:StartSchemaExtension | Operator |
| ds:UpdateRadius | Operator |
| ds:CheckAlias | Metadata |
| ds:DescribeCertificate | Metadata |
| ds:DescribeConditionalForwarders | Metadata |
| ds:DescribeDirectories | Metadata |
| ds:DescribeDomainControllers | Metadata |
| ds:DescribeEventTopics | Metadata |
| ds:DescribeLDAPSSettings | Metadata |
| ds:DescribeSharedDirectories | Metadata |
| ds:DescribeSnapshots | Metadata |
| ds:DescribeTrusts | Metadata |
| ds:GetAuthorizedApplicationDetails | Metadata |
| ds:GetDirectoryLimits | Metadata |
| ds:GetSnapshotLimits | Metadata |
| ds:ListAuthorizedApplications | Metadata |
| ds:ListCertificates | Metadata |
| ds:ListIpRoutes | Metadata |
| ds:ListLogSubscriptions | Metadata |
| ds:ListSchemaExtensions | Metadata |
| ds:ListTagsForResource | Metadata |
| ds:VerifyTrust | Metadata |
| ec2:DescribeNetworkInterfaces | Metadata |
| ec2:DescribeSubnets | Metadata |
| ec2:DescribeVpcs | Metadata |
| sns:GetTopicAttributes | Metadata |
| sns:ListSubscriptions | Metadata |
| sns:ListSubscriptionsByTopic | Metadata |
| sns:ListTopics | Metadata |
