AWS permissions

CloudYali reads your AWS account through a read-only IAM role that its CloudFormation stack creates, with one inline policy and five CloudYali managed policies. The role can read billing, resources and recommendations; it cannot create, change or delete anything in your account.

Who can assume the role


Role name	Generated by CloudFormation: `CloudYali-ReadOnly-AccessRole-<id>-CrossAccountRole-<id>`
Trusted principal	The IAM user `cloudyalisync` in CloudYali's AWS account, `310957700191`
Condition	`sts:ExternalID` must equal the external ID CloudYali generated for this connection
Template	`onboarding_iam_role.tmpl`, linked from the console's Open in AWS Console button

The external ID is a 15-character value, new for every connection. Do not change it: CloudYali cannot assume the role without it.

Policies

Policy	Grants	Used for
`CloudYaliReadOnlyAccess` (inline)	`Describe`, `Get` and `List*` actions across 204 AWS services; listed below	Resource Inventory, Cost Explorer data, budgets, Savings Plans, CloudTrail events, savings rules
`CloudYali-CUR-S3-Policy-<id>`	`s3:Get`, `s3:List` on the report bucket only	Reading the Cost & Usage Report files
`CloudYali-CostUsageReport-Policy-<id>`	`cur:List`, `cur:Describe`, `bcm-data-exports:GetExport`, `ListExports`, `GetTable`	Reading the report definition
`CloudYali-CostOptHubReadOnly-<id>`	`cost-optimization-hub:Get`, `List`	Cost Savings recommendations
`CloudYali-ComputeOptReadOnly-<id>`	`compute-optimizer:Describe`, `Get`	Rightsizing recommendations
`CloudYali-TrustedAdvisor-Policy-<id>`	`support:Describe`, `trustedadvisor:Describe`	Trusted Advisor checks

Read-only

Every action the role carries reads: Describe*, Get*, List* and their batch forms. The role has no permission to create, change or delete anything, from your workloads to your account settings.

CloudYali reads AWS's recommendations through Cost Optimization Hub but does not turn it on. To see them in Cost Savings, turn on Cost Optimization Hub in the account, and Compute Optimizer for its rightsizing recommendations.

What else the stack creates

Resource	Details
S3 bucket `cloudyali-cur-<id>`	Private, public access blocked; files expire after 200 days. AWS's billing services can write to it; the CloudYali role can read it
Cost & Usage Report `CloudYali-CUR-<id>`	Daily, compressed CSV, with resource IDs, delivered to the bucket under `daily-v1/`
Custom resource	Calls CloudYali when the stack is created, with the role ARN, account ID and report details, so the console can confirm the connection

All read actions

Every action in the inline policy, by service (204 services)

Service prefix	Actions
`a4b`	`Get`, `List`
`accessanalyzer`	`List*`
`acm`	`Describe`, `Get`, `List*`
`acm-pca`	`List*`
`airflow`	`Get`, `List`
`amplify`	`List`, `Get`
`apigateway`	`Get*`
`appflow`	`List`, `Describe`
`application-autoscaling`	`Describe*`
`applicationinsights`	`Describe`, `List`
`appmesh`	`Describe`, `List`
`apprunner`	`Describe`, `List`
`appstream`	`Describe`, `Get`, `List*`
`appsync`	`Get`, `List`
`aps`	`Describe`, `Get`, `List*`
`athena`	`List`, `Batch`, `Get*`
`auditmanager`	`Get*`
`autoscaling`	`Describe*`
`autoscaling-plans`	`Describe*`
`backup`	`Describe`, `Get`, `List*`
`batch`	`List`, `Describe`
`bedrock`	`Get`, `List`
`bedrock-agent`	`Get`, `List`
`bedrock-agent-runtime`	`Get`, `List`
`bedrock-runtime`	`Get`, `List`
`braket`	`Get*`
`budgets`	`Describe*`
`ce`	`Describe`, `Get`, `List*`
`chatbot`	`Describe`, `Get`
`chime`	`Get`, `List`
`cloud9`	`Describe`, `List`
`clouddirectory`	`List`, `Get`
`cloudformation`	`Describe`, `Get`, `List*`
`cloudfront`	`Get`, `List`
`cloudhsm`	`List`, `Describe`, `Get*`
`cloudsearch`	`Describe`, `List`
`cloudshell`	`Get*`
`cloudtrail`	`Describe`, `Get`, `List*`, `LookupEvents`
`cloudwatch`	`Describe`, `Get`, `List*`
`codeartifact`	`Describe`, `Get`, `List*`
`codebuild`	`BatchGet`, `List`
`codecommit`	`BatchGet`, `Get`, `List*`
`codedeploy`	`BatchGet`, `Get`, `List*`
`codeguru-profiler`	`Describe`, `Get`, `List*`
`codeguru-reviewer`	`Describe`, `Get`, `List*`
`codepipeline`	`List`, `Get`
`codestar`	`List`, `Describe`, `Get*`
`codestar-notifications`	`List*`
`cognito-identity`	`List`, `Describe`, `Lookup*`
`cognito-idp`	`AdminGet`, `AdminList`, `List`, `Describe`, `Get*`
`cognito-sync`	`List`, `Describe`, `Get*`, `QueryRecords`
`comprehend`	`Describe`, `List`
`comprehendmedical`	`Describe`, `List`
`compute-optimizer`	`Describe`, `Get`
`config`	`Describe`, `Get`, `List*`
`configservice`	`Describe*`
`connect`	`List`, `Describe`, `Get*`
`dataexchange`	`List*`
`datapipeline`	`Describe`, `Get`, `List*`
`datasync`	`Describe`, `List`
`dax`	`Describe`, `Get`, `List*`
`deepcomposer`	`Get`, `List`
`detective`	`Get`, `List`
`devicefarm`	`List`, `Get`
`devops-guru`	`Describe`, `List`
`directconnect`	`Describe*`
`discovery`	`Describe`, `List`, `Get*`
`dlm`	`Get`, `List`
`dms`	`Describe`, `List`
`ds`	`Check`, `Describe`, `Get`, `List`, `Verify*`
`dynamodb`	`Describe`, `Get`, `List*`
`ec2`	`Describe`, `Get`
`ec2messages`	`Get*`
`ecr`	`Describe`, `Get`, `List*`
`ecr-public`	`Describe`, `List`, `Get*`
`ecs`	`Describe`, `List`
`eks`	`Describe`, `List`
`elastic-inference`	`Describe`, `List`
`elasticache`	`Describe`, `List`
`elasticbeanstalk`	`Describe`, `List`
`elasticfilesystem`	`Describe`, `List`, `Describe*`
`elasticloadbalancing`	`Describe*`
`elasticmapreduce`	`Describe`, `List`
`elastictranscoder`	`List*`
`elemental-appliances-software`	`Get`, `List`
`es`	`Describe`, `List`, `Get*`
`events`	`Describe`, `List`
`firehose`	`Describe`, `List`
`fis`	`Get`, `List`
`fms`	`Get`, `List`
`forecast`	`Describe*`
`freertos`	`Describe`, `List`
`fsx`	`Describe`, `List`
`gamelift`	`List`, `Get`, `Describe*`
`geo`	`Describe`, `Get`, `List*`
`glacier`	`List`, `Describe`, `Get*`
`globalaccelerator`	`Describe`, `List`
`glue`	`Get`, `List`
`grafana`	`Describe`, `List`
`greengrass`	`Describe`, `Get`, `List*`
`groundstation`	`Describe`, `Get`, `List*`
`guardduty`	`Describe`, `Get`, `List*`
`health`	`Describe*`
`healthlake`	`Describe`, `Get`, `List*`
`iam`	`Get`, `List`
`imagebuilder`	`Get`, `List`
`importexport`	`Get`, `List`
`inspector`	`Describe`, `Get`, `List*`
`iot`	`Describe`, `Get`, `List*`
`iotanalytics`	`Describe`, `List`, `Get*`
`iotevents`	`Describe`, `List`
`iotfleethub`	`Describe*`
`iotsitewise`	`Describe`, `Get`, `List*`
`iotwireless`	`Get`, `List`
`ivs`	`Get`, `List`
`kafka`	`Describe`, `Get`, `List*`
`kendra`	`Describe`, `List`
`kinesis`	`Describe`, `Get`, `List*`
`kinesisanalytics`	`Describe`, `Discover`, `Get`, `List`
`kinesisvideo`	`Describe`, `Get`, `List*`
`kms`	`Describe`, `Get`, `List*`
`lambda`	`List`, `Get`
`lex`	`Get`, `List`
`license-manager`	`Get`, `List`
`lightsail`	`Get*`
`logs`	`Describe`, `Get`, `FilterLogEvents`, `List*`
`lookoutvision`	`Describe`, `List`
`machinelearning`	`Describe`, `Get`
`macie`	`List*`
`macie2`	`Describe`, `List`, `Get*`
`mediaconnect`	`Describe`, `List`
`mediaconvert`	`Describe`, `Get`, `List*`
`medialive`	`Describe`, `List`
`mediapackage`	`Describe`, `List`
`mediastore`	`Describe`, `Get`, `List*`
`mediatailor`	`Get`, `List`
`mgh`	`Describe`, `Get`, `List*`
`mgn`	`Describe`, `Get`
`mobileanalytics`	`Get*`
`mobilehub`	`Describe`, `Get`, `List*`
`mobiletargeting`	`Get*`
`mq`	`Describe`, `List`
`network-firewall`	`Describe`, `List`
`networkmanager`	`Describe`, `Get`
`opsworks`	`Describe`, `Get`
`opsworks-cm`	`Describe`, `List`
`organizations`	`Describe`, `List`
`outposts`	`Get`, `List`
`personalize`	`Describe`, `Get`, `List*`
`pi`	`Describe`, `Get`
`polly`	`Describe`, `Get`, `List*`
`qldb`	`Describe`, `List`
`quicksight`	`Describe`, `Get`, `List*`
`ram`	`Get`, `List`
`rds`	`Describe`, `List`
`redshift`	`Describe*`
`rekognition`	`List*`
`resource-groups`	`Get`, `List`
`robomaker`	`Describe`, `Get`, `List*`
`route53`	`Get`, `List`
`route53domains`	`Get`, `List`
`route53resolver`	`List*`
`s3`	`Get`, `List`
`s3control`	`Get*`
`sagemaker`	`Describe`, `List`
`savingsplans`	`Describe`, `List`
`schemas`	`Describe`, `Get`, `List*`
`sdb`	`Get`, `List`
`secretsmanager`	`List*`
`securityhub`	`Describe`, `Get`, `List*`
`serverlessrepo`	`List`, `Get`
`servicecatalog`	`List`, `Describe`
`servicediscovery`	`Get`, `List`
`servicequotas`	`Get`, `List`
`ses`	`Get`, `List`, `Describe*`
`shield`	`Describe`, `List`
`signer`	`Describe`, `Get`, `List*`
`sms-voice`	`List`, `Get`
`snowball`	`Get`, `Describe`, `List*`
`sns`	`Get`, `List`
`sqs`	`Get`, `List`
`ssm`	`Describe`, `Get`, `List*`
`ssm-contacts`	`Describe`, `Get`, `List*`
`ssm-incidents`	`Get`, `List`
`sso`	`Describe`, `Get`, `List*`
`sso-directory`	`Describe`, `List`
`states`	`List`, `Describe`, `Get*`
`storagegateway`	`Describe`, `List`
`sts`	`Get*`
`swf`	`Describe`, `Get`, `List*`
`synthetics`	`Describe`, `Get`, `List*`
`tag`	`Get*`
`timestream`	`Describe`, `List`
`transcribe`	`Get`, `List`
`transfer`	`Describe`, `List`
`translate`	`Describe`, `Get`, `List*`
`trustedadvisor`	`Describe*`
`waf`	`Get`, `List`
`waf-regional`	`List`, `Get`
`wafv2`	`Describe`, `Get`, `List*`
`workdocs`	`Describe`, `Get`
`workmail`	`Describe`, `Get`, `List*`
`workspaces`	`Describe*`
`xray`	`BatchGet`, `Get`

Where you see it in CloudYali

The Connected tab of Integrations shows each AWS account's role ARN in the Detail column. To connect an account, see Connect AWS.

Was this page helpful?

Who can assume the role​

Policies​

Read-only​

What else the stack creates​

All read actions​

Where you see it in CloudYali​