AWS IAM permission requirements

This topic lists the AWS IAM permissions required for Zesty products.

Click a selection to see its permissions.

Baseline permissions

These permissions are required when no products are selected.

Linked account permissions - no product

Custom

{
  "Policies": [
    {
      "PolicyDocument": {
        "Statement": [
          {
            "Action": [
              "ec2:List*",
              "ec2:Describe*",
              "elasticloadbalancing:Describe*",
              "autoscaling:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "EC2Access"
          },
          {
            "Action": [
              "organizations:List*",
              "organizations:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "OrganizationsAccess"
          },
          {
            "Action": [
              "servicequotas:ListServiceQuotas",
              "servicequotas:GetServiceQuota",
              "servicequotas:GetRequestedServiceQuotaChange"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "ServiceQuotasAccess"
          },
          {
            "Action": [
              "cloudwatch:List*",
              "cloudwatch:Describe*",
              "cloudwatch:GetMetricStatistics"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "MetricsAccess"
          },
          {
            "Action": [
              "savingsplans:List*",
              "savingsplans:Describe*",
              "savingsplans:CreateSavingsPlan"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "SavingsPlansAccess"
          },
          {
            "Action": [
              "ce:List*",
              "ce:Describe*",
              "ce:Get*"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "CostExplorerAccess"
          },
          {
            "Action": [
              "eks:List*",
              "eks:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ],
            "Sid": "EKSAccess"
          }
        ]
      },
      "PolicyName": {
        "Fn::Sub": "Zesty-Policy_${AWS::AccountId}"
      }
    }
  ]
}

Management account permissions - no product

Custom

Kompass permissions

Kompass Linked account permissions

Custom

Kompass Management account permissions

Custom

Commitment Manager permissions

Commitment Manager Management account permissions

Custom

Zesty Disk permissions

Zesty Disk Linked account permissions

Custom

Zesty Disk Management account permissions

Custom