AWS Permissions
Antimetal only collects metadata about your infrastructure and never attempts to read sensitive information from the underlying services. We can’t touch workloads, introspect on server state, or terminate/stop instances.
"Statement": [
{
"Action": [
"application-autoscaling:Describe*",
"autoscaling:Describe*",
"ce:Describe*",
"ce:Get*",
"ce:List*",
"cur:Get*",
"cur:Describe*",
"cloudwatch:GetMetricData",
"ec2:Describe*",
"ec2:AcceptReservedInstancesExchangeQuote",
"ec2:CancelReservedInstancesListing",
"ec2:CreateReservedInstancesListing",
"ec2:DeleteQueuedReservedInstances",
"ec2:ModifyReservedInstances",
"ec2:PurchaseHostReservation",
"ec2:PurchaseReservedInstancesOffering",
"elasticache:List*",
"elasticache:Describe*",
"elasticache:PurchaseReservedCacheNodesOffering",
"es:Describe*",
"es:List*",
"es:PurchaseReservedInstanceOffering",
"organizations:InviteAccountToOrganization",
"organizations:List*",
"organizations:Describe*",
"organizations:AcceptHandshake",
"iam:CreateServiceLinkedRole",
"pricing:DescribeServices",
"pricing:GetAttributeValues",
"pricing:GetProducts",
"rds:Describe*",
"rds:List*",
"rds:PurchaseReservedDbInstancesOffering",
"savingsplans:Describe*",
"savingsplans:List*",
"savingsplans:CreateSavingsPlan",
"servicequotas:Get*",
"servicequotas:List*",
"sagemaker:Describe*",
"sagemaker:List*",
"medialive:Describe*",
"medialive:List*",
"medialive:PurchaseOffering",
"redshift:Describe*",
"redshift:List*",
"redshift:PurchaseReservedNodeOffering",
"support:*"
],
"Effect": "Allow",
"Resource": "*"
}
]
IAM Permission Descriptions
Below is a list of AWS permissions and a brief description of what each permission does.
Our Cross-Account IAM Role Permissions:
Permission | Brief Description |
---|---|
"application-autoscaling:Describe*" | Determine EC2-related application autoscaling behavior and policies (for services like ECS and SageMaker) to make recommendation decisions. |
"autoscaling:Describe*" | Determine application EC2 autoscaling behavior and policies to make recommendation decisions. |
"ce:Describe/Get/List*" | Fetch historical spending data; list existing savings infrastructure across accounts (within an organization); and collect utilization information for on-demand instances, reserved instances, and savings plans. |
"cur:Describe/Get*" | Fetch cost and usage report data to provide a detailed breakdown of your AWS spend. |
"cloudwatch:GetMetricData" | Get per-instance metric data to make right-sizing recommendations and measure instance utilization. |
"ec2:Describe*" | Fetch and store data related to EC2 on-demand and reserved instances. In particular, stores instance type, platform, tenancy, region, and how long instance has been on. |
"ec2:AcceptReservedInstancesExchangeQuote" | Allows accepting exchange quotes for Reserved Instances in EC2 |
"ec2:CancelReservedInstancesListing" | Allows canceling Reserved Instances listings in EC2 |
"ec2:CreateReservedInstancesListing" | Allows creating Reserved Instances listings in EC2 |
"ec2:DeleteQueuedReservedInstances" | Allows deleting queued Reserved Instances in EC2 |
"ec2:ModifyReservedInstances" | Allows modifying Reserved Instances in EC2 |
"ec2:PurchaseHostReservation" | Allows purchasing host reservations in EC2 |
"ec2:PurchaseReservedInstancesOffering" | Allows purchasing Reserved Instances offerings in EC2 |
"elasticache:Describe/List" | Fetch and store data related to ElastiCache on-demand and reserved instances. |
"elasticache:PurchaseReservedCacheNodesOffering" | Allows purchasing of ElastiCache on-demand and reserved instances. |
"es:Describe/List" | Fetch and store data related to ElasticSearch and OpenSearch on-demand and reserved instances. |
"es:PurchaseReservedInstanceOffering" | Allows purchasing of ElasticSearch and OpenSearch on-demand and reserved instances. |
"organizations:List/Describe*" | Fetch and store data related to AWS Organizations. In particular, stores account information, organizational unit information, and service control policy information. |
"organizations:InviteAccountToOrganization" | Allows inviting accounts to join an organization. Relevant if you invite another account to your Antimetal OU after onboarding. |
"organizations:AcceptHandshake" | Allows programmatic acceptance of the Antimetal organization invite. Only used for accounts that are invited after initial onboarding. |
"iam:CreateServiceLinkedRole" | Allows creating service-linked roles for AWS services. If you haven't already created a service linked role for some services, Antimetal will need to create it to collect infrastructure metadata and billing data. |
"pricing:DescribeServices" | Allows describing services related to pricing |
"pricing:GetAttributeValues" | Allows getting attribute values related to pricing |
"pricing:GetProducts" | Allows getting products related to pricing |
"rds:Describe/List" | Fetch and store data related to RDS on-demand and reserved instances. In particular, stores instance type, engine, multi-AZ, region, and how long the instance has been on. |
"rds:PurchaseReservedDbInstancesOffering" | Allows purchasing of RDS Reserved Instances |
"savingsplans:Describe/List" | Fetch and store type and spend commitment data for Compute and EC2 savings plans. |
"savingsplans:CreateSavingsPlan" | Allows purchasing Compute, EC2, and Sagemaker savings plans. |
"servicequotas:Get/List*" | Determine existing service quota limits for attributes such as number of tags that can be created, number of reserved instances that can be purchased, etc. |
servicequotas:RequestServiceQuotaIncrease | Request a service quota increase. The only service quota Antimetal currently requests an increase for is the number of reserved instances that can be purchased per month. |
"sagemaker:Describe/List*" | Fetch and store data related to SageMaker on-demand and reserved instances. In particular, stores instance type, region, and how long the instance has been on. |
"medialive:Describe/List*" | Fetch and store data related to MediaLive on-demand and reserved instances. In particular, stores instance type, region, and how long the instance has been on. |
"medialive:PurchaseOffering" | Allows purchasing of MediaLive reserved instances. |
"redshift:Describe/List*" | Fetch and store data related to Redshift on-demand and reserved instances. In particular, stores instance type, region, and how long the instance has been on. |
"redshift:PurchaseReservedNodeOffering" | Allows purchasing of Redshift reserved instances. |
"support:*" | Resolve support cases related to service quota increases. Antimetal only touches support cases that it created via a RequestServiceQuotaIncrease call. |