config:GetDiscoveredResourceCounts is a Read access-level action in the config service. Grants permission to return the resource types, the number of each resource type, and the total number of resources that AWS Config is recording in this region for your AWS account
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows config:GetDiscoveredResourceCounts. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowConfigGetDiscoveredResourceCounts",
"Effect": "Allow",
"Action": "config:GetDiscoveredResourceCounts",
"Resource": "*"
}
]
}