Commitment Manager Permissions
Commitment Manager
Used to purchase or renew Coverage commitments.
| Permission | Description | Why Zesty uses it | Savings Report | Managed: Mandatory | |||
|---|---|---|---|---|---|---|---|
| EC2 | EC2 | List | ec2:List* | Used to fetch a list of EC2 instances, EBS Volumes and IP addresses across all regions | Allows the platform to discover and identify resources inventory | √ | √ |
| EC2 | EC2 | List | tag:GetResources | Returns all the tagged or previously tagged resources that are located in the specified AWS Region for the account | Provides meaningful names and tags associated with resources | √ | √ |
| EC2 | EC2 | List | tag:GetTagKeys | Returns all tag keys currently in use in the specified AWS Region for the calling account | Provides meaningful names and tags associated with resources | √ | √ |
| EC2 | EC2 | List | tag:GetTagValues | Returns all tag values for the specified key that are used in the specified AWS Region for the calling account | Provides meaningful names and tags associated with resources | √ | √ |
| EC2 | EC2 | List | elasticloadbalancing:Describe* | Returns a full list of Load Balancers within the account | Used to identify idle/unused Load Balancers that don't have a target to route traffic to | √ | √ |
| EC2 | EC2 | Read | ec2:Describe* | Returns a full description of EC2 Instances, Reserved Instances, EBS Volumes and their specifications | Allow the platform to identify resources specifications and properties | √ | √ |
| EC2 | EC2 Autoscaling | Read | autoscaling:Describe* | Returns a list of auto-scaling groups and a list of EC2 Instances that belongs to this group | Used to fetch minimum and maximum thresholds of the scaling groups | √ | √ |
| EC2 | Organizations | List | organizations:List* | Returns a list of accounts within the organization | Used to verify that all sub-accounts belong to the same organization. Important for RI/Saving Plans savings sharing | √ | √ |
| EC2 | Organizations | Read | organizations:Describe* | Returns a description of the accounts - account name, creation date | Provides meaningful account names | √ | √ |
| EC2 | Cloudwatch | List | cloudwatch:List* | Returns the historical metrics | Used to identify available monitoring metrics provided by default CloudWatch | √ | √ |
| EC2 | Cloudwatch | Read | cloudwatch:Describe* | Returns a description about available metrics | Used to fetch a description of the monitoring metric | √ | √ |
| EC2 | Cloudwatch | Read | cloudwatch:GetMetricStatistics | Returns the historical metrics | Used to fetch utilization metrics | √ | √ |
| EC2 | SavingsPlans | List | savingsplans:List* | Returns list of available Savings Plans | Allows the platform to discover and identify available Saving Plans | √ | √ |
| EC2 | SavingsPlans | Read | savingsplans:Describe* | Returns a full description per Savings Plan offering purchased - Duration, Payment term, Expiration Date etc. | Used to monitor dollar value of Savings Plans in place and their expiration dates | √ | √ |
| EC2 | Cost Explorer | List | ce:List* | Returns historical cost and usage data | Used to collect historical usage trends and prices to calculate the potential savings and ongoing monitoring | √ | √ |
| EC2 | Cost Explorer | Read | ce:Describe* | Returns a description of cost and usage metrics available | Used to discover cost and usage metric descriptions | √ | √ |
| EC2 | Cost Explorer | Read | ce:Get* | Queries a specific cost metric | Used to load historical cost metrics | √ | √ |
| EC2 | Cost and Usage Report | Read | cur:DescribeReportDefinitions | Lists the AWS Cost and Usage reports available to this account | Used to verify the existing CUR report configurations | √ | √ |
| EC2 Reserved Instances | EC2 | List | servicequotas:ListService eQuotas | Lists the applied quota values for the specified AWS service | Used to find the Quota Code for purchasing new RIs | X | √ |
| EC2 Reserved Instances | EC2 | Read | servicequotas:GetService eQuota | Retrieves the applied quota value for the specified quota | Used to find the amount of new RIs that are able to be purchased per month | X | √ |
| EC2 Reserved Instances | EC2 | Read | servicequotas:GetRequestedService eQuotaChange | Retrieves information about the specified quota increase request | Used to check that the quota request has been completed successfully | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:CreateReservedInstances Listing | Creates a listing for Amazon EC2 Standard Reserved Instances to be sold in the Reserved Instance Marketplace | Used to sell RI's on the marketplace | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:PurchaseReservedInstances Offering | Purchases a Reserved Instance for use with your account | Used to buy RI's | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:PurchaseHostReservation | Purchases a reservation with configurations that match those of your Dedicated Host | Used to purchase RI's for Dedicated Hosts | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:GetReservedInstances ExchangeQuote | Returns a quote and exchange information for exchanging one or more specified Convertible Reserved Instances for a new Convertible Reserved Instance | Used to manage convertible RI's offering | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:AcceptReservedInstances ExchangeQuote | Accepts the Convertible Reserved Instance exchange quote described in the GetReservedInstancesExchangeQuote call | Used to exchange RI's types between families | X | √ |
| EC2 Reserved Instances | EC2 | Write | ec2:CancelReservedInstances Listing | Cancels the specified Reserved Instance listing in the Reserved Instance Marketplace | Cancel RI listing on the marketplace | X | √ |
| ec2:ModifyReservedInstances | Modifies the Availability Zone, instance count, instance type, or network platform(EC2-Classic or EC2-VPC) of your Reserved Instances | Used to modify RI scope from zonal to regional | X | √ | |||
| servicequotas:RequestServiceQuotaIncrease | Submits a quota increase request for the specified quota | Used to create the Quota increase request | X | √ | |||
| Database | RDS | List | rds:List* | Lists all Amazon RDS Resources | Used to get a list of RDS instances | X | X |
| Database | RDS | List | rds:ListTagsForResource | Lists all tags on an Amazon RDS Resource | Provides meaningful names and tags associated with database resources | X | X |
| Database | RDS | Read | rds:Describe* | Returns a description of RDS instance and usage metrics available | Allows the platform to identify database resources specifications and properties | X | X |
| Database | elasticache | List | elasticache:List* | Lists all Amazon ElastiCache Resources | Allows the platform to discover and identify database resources inventory | X | X |
| Database | elasticache | Read | elasticache:Describe* | Returns a description of ElastiCache instance and usage metrics available | Allows the platform to identify database resources specifications and properties | X | X |
| Database | redshift | Read | redshift:Describe* | Returns a description of RedShift instance and usage metrics available | Allows the platform to identify database resources specifications and properties | X | X |
| Database | Database | elasticsearch | List | es:List* | Lists all Amazon ElasticSearch Resources | Allows the platform to discover and identify database resources inventory | X |
| Read | Database | elasticsearch | es:Describe* | Returns a description of ElasticSearch instance and usage metrics available | Allows the platform to identify database resources specifications and properties | X | X |
| es:GetCompatibleElastic search Versions | Returns a list of upgrade compatible Elasticsearch versions | Used to provide upgrade insights and recommendations | X | X | |||
| S3 | S3 | List | s3:HeadBucket | This action is useful to determine if a bucket exists and you have permission to access it | Allows the platform to assess bucket permissions | X | X |
| S3 | S3 | List | s3:ListAllMyBuckets | Returns a list of all buckets owned by the sender of the request | Allows the platform to discover and identify S3 bucket inventory | X | X |
| S3 | S3 | List | s3:ListBucket | Returns a list of all buckets owned by the authenticated sender of the request | Lists files inside the bucket | X | X |
| S3 | S3 | Read | s3:GetBucketAcl | This implementation of the “get” action uses the ACL subresource to return the access control list (ACL) of a bucket | Allows the platform to assess users access list | X | X |
| S3 | S3 | Read | s3:GetBucketCORS | Returns the Cross-Origin Resource Sharing (CORS) configuration information set for the bucket | Allows the platform to assess CORS configuration of website hosting buckets | X | X |
| S3 | S3 | Read | s3:GetBucketLocation | Returns the Region the bucket resides in | Used to aggregate bucket size per region to know what region this bucket is located in | X | X |
| S3 | S3 | Read | s3:GetBucketLogging | Returns the logging status of a bucket and the permissions users have to view and modify that status | Allows the platform to assess buckets logging status | X | X |
| S3 | S3 | Read | s3:GetBucketPolicy | Returns the policy of a specified bucket | Allows the platform to assess the access policy of a bucket | X | X |
| S3 | S3 | Read | s3:GetBucketRequestPayment | Returns the request payment configuration of a bucket | Allows the platform to assess who bucket access charges would be billed to | X | X |
| S3 | S3 | Read | s3:GetBucketTagging | Returns the tag set associated with the bucket | Provides meaningful names and tags associated with S3 buckets | X | X |
| S3 | S3 | Read | s3:GetBucketVersioning | Returns the versioning state of a bucket | Allows the platform to assess if object versioning is enabled | X | X |
| S3 | S3 | Read | s3:GetBucketWebsite | Returns the website configuration for a bucket | Allows the platform to identify buckets that are configured as website hosting | X | X |
| S3 | S3 | Read | s3:GetEncryptionConfiguration | Returns the default encryption configuration for an Amazon S3 bucket | Allows the platform to assess if bucket encryption is enabled | X | X |
| S3 | S3 | Read | s3:GetLifecycleConfiguration | Returns the lifecycle configuration information set on the bucket | Identifies object's lifecycle configuration policies | X | X |
| S3 | S3 | Read | s3:GetMetricsConfiguration | Gets a metrics configuration (specified by the metrics configuration ID) from the bucket | Allows the platform to provide bucket size and the total amount of object metrics | X | X |
| S3 | S3 | Read | s3:GetReplicationConfiguration | Retrieves the application replication configuration associated with the specified application. | Identifies if a replication configuration is enabled | X | X |
| Kubernetes | EKS | List | eks:ListClusters | Lists the Amazon EKS clusters | Discovers and identifies existing EKS clusters and their configuration | X | X |
| Read | eks:ListNodegroups | Lists the Amazon EKS node groups attached to given cluster | Discovers and identifies existing EKS node groups and their configuration | X | X | ||
| Read | eks:ListUpdates | Lists the updates for a given Amazon EKS cluster/nodegroup/add-on | Discovers and identifies updates to existing EKS clusters/node groups/add-ons | X | X | ||
| Read | eks:ListAddons | Lists the Amazon EKS add-ons for a given cluster | Discovers and identifies existing EKS add-ons and their configuration | X | X | ||
| Read | eks:ListIdentityProviderConfigs | Lists the IDP configurations associated with a given cluster | Used to ensure that Zesty can access the EKS Cluster, and to display the current access permissions | X | X | ||
| Read | eks:AccessKubernetesApi | View Kubernetes objects via AWS EKS console | Used to provide meaning and context to the information associated with EKS resources from the AWS dashboard | X | X | ||
| eks:DescribeCluster | Retrieves descriptive information about an Amazon EKS cluster | Identifies EKS cluster resource specifications and properties | X | X | |||
| eks:DescribeUpdate | Retrieves a given update for a given Amazon EKS cluster/nodegroup/add-on | Identifies updates to existing EKS clusters/node groups/add-ons with their specifications and properties | X | X | |||
| eks:DescribeAddon | Retrieve descriptive information about an Amazon EKS add-on | Identifies existing EKS add-ons with their specifications and properties | X | X | |||
| eks:DescribeNodegroup | Retrieves descriptive information about an Amazon EKS NodeGroup | Identifies existing EKS NodeGroup with their specifications and properties | X | X | |||
| eks:DescribeAddonConfiguration | Retrieves configuration options about an Amazon EKS add-on | Identifies existing EKS add-on configuration options with their specifications and properties | X | X | |||
| Write | eks:DescribeAddonVersions | Retrieves descriptive version information about the add-ons that Amazon EKS Add-ons supports | Identifies existing EKS add-on versions with their specifications and properties | X | X | ||
| Write | eks:DescribeIdentityProviderConfig | Retrieves descriptive information about an IDP configuration associated with a cluster | Identifies existing access permissions to an EKS cluster with their specifications and properties. | X | X | ||
| Write | eks:ListTagsForResource | Lists tags for the specified resource | Provides meaningful names and tags associated with EKS resources | X | X | ||
| Write | eks:UpdateAddon | Updates Amazon EKS add-on configurations | Used as part of Zesty service to modify EKS add-ons | X | X | ||
| eks:UpdateNodegroupConfig | Updates Amazon EKS nodegroup configurations | Used to modify EKS NodeGroup configurations (eg: min/max/desired capacity or labels) | X | X | |||
| eks:CreateNodegroup | Grants permission to create an Amazon EKS Nodegroup | Used to provision new EKS NodeGroups in order to scale up the EKS cluster | X | X | |||
| eks:DeleteNodegroup | Grants permission to delete an Amazon EKS Nodegroup | Used to delete EKS NodeGroups in order to scale down the EKS cluster | X | X | |||
| eks:TagResource | Grants permission to tag the specified resource | Used to tag EKS Resources which are managed by Zesty | X | X | |||
| eks:UntagResource | Grants permission to untag the specified resource | Used to remove tags from EKS Resources which are no longer managed by Zesty | X | X |