| iam:PassRole | Admin |
| workspaces:AssociateIpGroups | Admin |
| workspaces:AuthorizeIpRules | Admin |
| workspaces:CreateIpGroup | Admin |
| workspaces:CreateRegistration | Admin |
| workspaces:CreateWorkspaces | Admin |
| workspaces:DeleteIpGroup | Admin |
| workspaces:DeleteWorkspaceImage | Admin |
| workspaces:DeregisterWorkspaceDirectory | Admin |
| workspaces:DisassociateIpGroups | Admin |
| workspaces:ImportWorkspaceImage | Admin |
| workspaces:ModifyAccount | Admin |
| workspaces:ModifyClientProperties | Admin |
| workspaces:ModifySelfservicePermissions | Admin |
| workspaces:ModifyWorkspaceAccessProperties | Admin |
| workspaces:ModifyWorkspaceCreationProperties | Admin |
| workspaces:RegisterWorkspaceDirectory | Admin |
| workspaces:RestoreWorkspace | Admin |
| workspaces:RevokeIpRules | Admin |
| workspaces:TerminateWorkspaces | Admin |
| workspaces:UpdateRulesOfIpGroup | Admin |
| workspaces:CopyWorkspaceImage | Operator |
| workspaces:CreateTags | Operator |
| workspaces:DeleteTags | Operator |
| workspaces:ModifyWorkspaceProperties | Operator |
| workspaces:ModifyWorkspaceState | Operator |
| workspaces:RebootWorkspaces | Operator |
| workspaces:RebuildWorkspaces | Operator |
| workspaces:StartWorkspaces | Operator |
| workspaces:StopWorkspaces | Operator |
| iam:GetRole | Metadata |
| workspaces:DescribeAccount | Metadata |
| workspaces:DescribeAccountModifications | Metadata |
| workspaces:DescribeClientProperties | Metadata |
| workspaces:DescribeIpGroups | Metadata |
| workspaces:DescribeTags | Metadata |
| workspaces:DescribeWorkspaceBundles | Metadata |
| workspaces:DescribeWorkspaceDirectories | Metadata |
| workspaces:DescribeWorkspaceImages | Metadata |
| workspaces:DescribeWorkspaceSnapshots | Metadata |
| workspaces:DescribeWorkspaces | Metadata |
| workspaces:DescribeWorkspacesConnectionStatus | Metadata |
| workspaces:ListAvailableManagementCidrRanges | Metadata |
