IAM permission set requirements for AWS plugin asset access in CloudQuery

CloudQuery Plugins
1

Is there a spec defining the IAM permission set required for the AWS plugin? For each asset/service type: SNS, S3, WAF, EC2, EKS, etc. Right now I am building this by searching 403s through logs.

2

There is not a permission set for the AWS plugin. We recommend using the ReadOnly managed policy and then adding in explicit denies for data plane operations like kinesis:GetRecord and s3:GetObject.

  "cloudformation:GetTemplate",
  "dynamodb:BatchGetItem",
  "dynamodb:GetItem",
  "dynamodb:Query",
  "dynamodb:Scan",
  "ec2:GetConsoleOutput",
  "ec2:GetConsoleScreenshot",
  "ecr:BatchGetImage",
  "ecr:GetAuthorizationToken",
  "ecr:GetDownloadUrlForLayer",
  "kinesis:Get*",
  "lambda:GetFunction",
  "logs:GetLogEvents",
  "s3:GetObject",
  "sdb:Select*",
  "secretsmanager:GetSecretValue",
  "sqs:ReceiveMessage",
  "ssm:GetCommandInvocation",
  "ssm:GetParameter*"
3

This does not cover all asset types, but I get the idea.

4

The above list are the explicit denies.
If you have any other suggestions about permissions that should be denied, let us know.

5

You mean using this one to allow: AWS ReadOnlyAccess then provide a deny list.

Or do you recommend doing something like:

managed_policy_arns = [
    "AmazonGuardDutyReadOnlyAccess", 
    "AWSWAFReadOnlyAccess", 
    "ServiceQuotasReadOnlyAccess",
    "AWSXrayReadOnlyAccess", 
    "AmazonRedshiftReadOnlyAccess", 
    ...
]

I went through all the policies and came up with this list:

"Action": [
    "cloudformation:GetTemplate",
    "cloudwatch:GenerateQuery",
    "cognito-sync:QueryRecords",
    "datapipeline:QueryObjects",
    "dax:query",
    "dynamodb:BatchGetItem",
    "dynamodb:GetItem",
    "dynamodb:Query",
    "dynamodb:Scan",
    "ec2:GetConsoleOutput",
    "ec2:GetConsoleScreenshot",
    "ecr:BatchGetImage",
    "ecr:GetAuthorizationToken",
    "ecr:GetDownloadUrlForLayer",
    "kendra:Query",
    "kinesis:Get*",
    "lambda:GetFunction",
    "logs:GetLogEvents",
    "logs:Start*",
    "logs:Stop*",
    "mediapackagev2:GetHeadObject",
    "mediapackagev2:GetObject",
    "mediastore:GetObject",
    "s3:GetObject",
    "s3-object-lambda:GetObject",
    "sdb:Select*",
    "secretsmanager:GetSecretValue",
    "sqs:ReceiveMessage",
    "ssm:GetCommandInvocation",
    "ssm:GetParameter*"
]
6

This may be very useful, I’ll try this one.