AWS Permissions

Review the connector template before deployment and compare it with your organization's access policy. The integration primarily reads resource configuration, but its transport and encryption policies also permit writing collected data to the configured Nullify bucket. “Read-only integration” does not mean every IAM action is a read.

Policy groups

Policy	Purpose
ReadOnlyAccessPolicy and ReadOnlyAccessPolicy2	Describe/list/get configuration across supported AWS services, including IAM, networking, compute, storage, databases, and security services. Many inventory operations use resource *.
DenyActionsPolicy	Explicitly deny sensitive data and access operations, including secret-value access and API Gateway key/usage-plan reads. These denials constrain the allows; inspect the full list.
S3AccessPolicy	Read/write transport access scoped to the configured bucket and, when provided, its access point.
KMSAccessPolicy	Key operations for the configured collection/encryption path, with resource and condition restrictions.

Download the complete extracted policy documents for the action lists, resources, and conditions. This is a reference extraction, not a standalone deployable IAM policy: CloudFormation expressions such as Ref, Fn::Sub, and Fn::If require the template parameters.

The reference is generated from cloud-connector revision 8a524f427df4dfdb03c29fab3686e79a19df4fe8. Check the source CloudFormation template at that revision for role attachments, trust policy, deployment conditions, and defaults. A Terraform or collector variant can differ; review the exact artifact you deploy.

Trust and scope

Cross-account role assumption is constrained by the configured principal and external ID. Optional EKS federation adds the configured OIDC provider and collector service-account subject. Adding collection permissions is separate from configuring a principal that can assume the role.

Deploy only into the accounts and regions you intend to monitor. If you remove an action, confirm the affected inventory or rule coverage: a successful role assumption is not proof that every requested resource was collected. Use the configuration guide to validate the connection and the resulting inventory.