tag:GetTagValues is a Read access-level action in the tag service. Grants permission to return tag values for the specified key that are used in the specified AWS Region for the calling account
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows tag:GetTagValues. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowTagGetTagValues",
"Effect": "Allow",
"Action": "tag:GetTagValues",
"Resource": "*"
}
]
}