> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/connectors/aws/permissions.md).

# AWS Permissions

Review the connector template before deployment and compare it with your organization's access policy. The integration primarily reads resource configuration, but its transport and encryption policies also permit writing collected data to the configured Nullify bucket. “Read-only integration” does not mean every IAM action is a read.

## Policy groups

| Policy                                         | Purpose                                                                                                                                                                                   |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ReadOnlyAccessPolicy and ReadOnlyAccessPolicy2 | Describe/list/get configuration across supported AWS services, including IAM, networking, compute, storage, databases, and security services. Many inventory operations use resource `*`. |
| DenyActionsPolicy                              | Explicitly deny sensitive data and access operations, including secret-value access and API Gateway key/usage-plan reads. These denials constrain the allows; inspect the full list.      |
| S3AccessPolicy                                 | Read/write transport access scoped to the configured bucket and, when provided, its access point.                                                                                         |
| KMSAccessPolicy                                | Key operations for the configured collection/encryption path, with resource and condition restrictions.                                                                                   |

[Download the complete extracted policy documents](https://github.com/Nullify-Platform/nullify/tree/main/public-docs/.gitbook/assets/aws/iam-policy-reference.json) for the action lists, resources, and conditions. This is a reference extraction, not a standalone deployable IAM policy: CloudFormation expressions such as `Ref`, `Fn::Sub`, and `Fn::If` require the template parameters.

The reference is generated from cloud-connector revision `8a524f427df4dfdb03c29fab3686e79a19df4fe8`. Check the [source CloudFormation template at that revision](https://github.com/Nullify-Platform/nullify-cloud-connector/blob/8a524f427df4dfdb03c29fab3686e79a19df4fe8/aws-integration-setup/cloudformation/nullify-cloudformation-template.json) for role attachments, trust policy, deployment conditions, and defaults. A Terraform or collector variant can differ; review the exact artifact you deploy.

## Trust and scope

Cross-account role assumption is constrained by the configured principal and external ID. Optional EKS federation adds the configured OIDC provider and collector service-account subject. Adding collection permissions is separate from configuring a principal that can assume the role.

Deploy only into the accounts and regions you intend to monitor. If you remove an action, confirm the affected inventory or rule coverage: a successful role assumption is not proof that every requested resource was collected. Use the [configuration guide](/connectors/aws/configuration.md) to validate the connection and the resulting inventory.