AWS: Inventory Permissions
This page outlines the permissions required for the AWS inventory connector. Enable these permissions to view the resource listing in the inventory tab.
As cloud environments evolve and providers introduce API changes, required permissions may change as well. These permissions are reviewed and updated with each product release to reflect the latest requirements. Stale API entries are periodically removed, and updates are included in subsequent releases.
| Resource Type | Permissions |
|---|---|
| ACM Certificate | acm:ListCertificates |
| Amazon Athena Workgroup | athena:GetWorkGroup athena:ListWorkGroups |
| Amazon Network Firewall Policy | network-firewall:ListFirewallPolicies network-firewall:DescribeFirewallPolicy |
| Amazon Open Search Domain | es:ListDomainNames es:DescribeElasticsearchDomain |
| AMIs | ec2:DescribeImages |
| API Gateway | apigateway:GET |
| Auto Scaling Group | autoscaling:DescribeAutoScalingGroups |
| AWS CodeBuild Project | codebuild:ListProjects codebuild:BatchGetProjects |
| AWS EBS Encryption | ec2:GetEbsEncryptionByDefault ec2:GetEbsDefaultKmsKeyId kms:DescribeKey |
| AWS GuardDuty Detector | guardduty:ListDetectors guardduty:GetDetector guardduty:ListTagsForResource |
| AWS IAM Account Summary | iam:GetAccountSummary |
| AWS IAM Server Certificate | iam:ListServerCertificates iam:GetServerCertificate |
| AWS S3 Block Public Access Settings | s3:GetPublicAccessBlock s3:GetAccountPublicAccessBlock |
| AWS SSM Document | ssm:ListDocuments ssm:DescribeDocumentPermission |
| AWS SSM Service Setting | ssm:GetServiceSetting |
| AWS WAF Global Rule Group | wafv2:ListRuleGroups wafv2:GetRuleGroup |
| AWS WAF Rule Group | wafv2:ListRuleGroups wafv2:GetRuleGroup |
| AWS WAF V2 Global Web ACL | wafv2:ListWebACLs wafv2:GetWebACL |
| AWS WAF V2 Web ACL Resource | wafv2:ListWebACLs wafv2:GetWebACL |
| Backup Plan (AWS Backup) | backup:ListBackupPlans backup:GetBackupPlan |
| Bedrock Custom Model | bedrock:ListProvisionedModelThroughputs bedrock:GetCustomModel bedrock:ListCustomModels |
| Bedrock Knowledge Bases | bedrock:ListKnowledgeBases bedrock:GetKnowledgeBase |
| CloudFront Distributions | cloudfront:ListDistributions tag:GetResources |
| CloudTrail Trail | s3:ListAllMyBuckets s3:GetBucketLocation cloudtrail:DescribeTrails cloudtrail:GetTrailStatus cloudtrail:GetEventSelectors |
| CloudWatch Alarm | cloudwatch:DescribeAlarms |
| CloudWatch LogGroup | logs:DescribeLogGroups |
| Custom Domain Names | apigateway:GET |
| Data Stream (Kinesis) | kinesis:ListStreams kinesis:DescribeStreamSummary |
| Direct Connect Connections | directconnect:DescribeConnections |
| DMS Replication | dms:DescribeReplicationInstances |
| Document DB Clusters | rds:DescribeDBClusters |
| Document DB Snapshots | rds:DescribeDBClusterSnapshots |
| DynamoDB Table | dynamodb:ListTables dynamodb:DescribeTable |
| EBS Volume | ec2:DescribeVolumes |
| EC2 Elastic IP Address | ec2:DescribeAddresses |
| EC2 NAT Gateway | ec2:DescribeAddresses ec2:DescribeNatGateways |
| EC2 Transit Gateway | ec2:DescribeTransitGateways |
| EC2 Transit Gateway Attachment | ec2:DescribeTransitGatewayAttachments |
| ECR Repositories | ecr:GetRepositoryPolicy ecr:DescribeRepositories ecr-public:DescribeRepositories ecr-public:GetRepositoryPolicy ecr:DescribeImages ecr-public:DescribeImages ecr:GetLifecyclePolicy |
| ECS Clusters | ecs:DescribeClusters ecs:ListClusters ecs:ListServices ecs:ListTasks |
| EFS File System | elasticfilesystem:DescribeFileSystems |
| EKS Cluster | eks:ListClusters eks:DescribeCluster |
| EKS Fargate Profile | eks:ListClusters eks:ListFargateProfiles eks:DescribeFargateProfile |
| EKS Node Group | eks:ListClusters eks:ListNodegroups eks:DescribeNodegroup |
| Elastic Beanstalk Environment | elasticbeanstalk:DescribeEnvironments |
| Elasticache Cluster | elasticache:DescribeCacheClusters |
| Elasticache Replication Group | elasticache:DescribeReplicationGroups |
| EventBridge Rule | events:ListRules events:DescribeRule |
| Glue Connection | glue:GetConnections |
| Glue Crawler | glue:ListCrawlers glue:GetCrawler |
| Glue ETL Job | glue:ListJobs glue:GetJobs |
| IAM Group | iam:GetAccountAuthorizationDetails |
| IAM Password Policy | iam:GetAccountPasswordPolicy |
| IAM Policy | iam:GetAccountAuthorizationDetails |
| IAM Role | iam:GetAccountAuthorizationDetails |
| IAM SAML Provider | iam:ListSAMLProviders iam:GetSAMLProvider |
| IAM User | iam:GetAccountAuthorizationDetails |
| Identity Pool | cognito-identity:ListIdentityPools cognito-identity:DescribeIdentityPool |
| Instance | ec2:DescribeInstances ec2:DescribeVpcs ec2:DescribeInstanceStatus iam:ListInstanceProfiles ec2:DescribeImages |
| Internet Gateway | ec2:DescribeInternetGateways |
| Kinesis Firehose Delivery Stream | firehose:ListDeliveryStreams firehose:DescribeDeliveryStream |
| KMS | kms:ListKeys kms:GetKeyPolicy kms:GetKeyRotationStatus |
| Lambda Function | lambda:ListFunctions lambda:ListTags lambda:ListVersionsByFunction lambda:GetFunctionConcurrency lambda:ListAliases lambda:ListEventSourceMappings iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:GetPolicy iam:GetPolicyVersion iam:GetRole lambda:GetPolicy lambda:ListFunctionUrlConfigs |
| Launch Configuration | autoscaling:DescribeLaunchConfigurations |
| Load Balancer | elasticloadbalancing:DescribeLoadBalancers |
| MSK Clusters | kafka:ListClusters |
| Network ACL | ec2:DescribeNetworkAcls |
| Network Firewall | network-firewall:ListFirewalls network-firewall:DescribeFirewall |
| Network Firewall Rule Groups | network-firewall:ListRuleGroups network-firewall:DescribeRuleGroup |
| Network Interfaces | ec2:DescribeNetworkInterfaces |
| RDS | rds:ListTagsForResource rds:DescribeDBInstances |
| RDS Cluster | rds:DescribeDBClusters |
| RDS Cluster Snapshot | rds:DescribeDBClusterSnapshots |
| RDS Database Snapshot | rds:DescribeDBSnapshots |
| Recovery Point (AWS Backup) | backup:ListRecoveryPointsByBackupVault |
| Redshift Cluster | redshift:DescribeClusterParameters redshift:DescribeClusters redshift:DescribeLoggingStatus |
| Route Table | ec2:DescribeRouteTables |
| Route53 Domains | route53domains:ListDomains route53domains:GetDomainDetail route53domains:ListTagsForDomain |
| Route53 Hosted Zones | route53:ListHostedZones route53:ListResourceRecordSets route53:ListQueryLoggingConfigs |
| S3 Bucket | s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl s3:GetBucketPolicy s3:GetBucketPolicyStatus s3:GetBucketPublicAccessBlock s3:GetAccountPublicAccessBlock |
| Sagemaker Models | sagemaker:DescribeModel sagemaker:ListModels |
| Sagemaker Notebook | sagemaker:ListNotebookInstances sagemaker:DescribeNotebookInstance |
| Secrets | secretsmanager:ListSecrets |
| Security Group | ec2:DescribeSecurityGroups |
| SNS Topic | SNS:ListTopics SNS:GetTopicAttributes |
| SQS Queue | sqs:ListQueues sqs:GetQueueAttributes |
| State Machine | states:ListStateMachines states:DescribeStateMachine |
| Subnet | ec2:DescribeSubnets |
| VPC | ec2:DescribeVpcs |
| VPC Endpoint | ec2:DescribeVpcs |
| VPC Endpoint Service | ec2:DescribeVpcs |
| VPC Peering Connections | ec2:DescribeVpcPeeringConnections |
| Workspace | workspaces:DescribeWorkspaces |
| Workspace Directories | workspaces:DescribeWorkspaceDirectories |
| Workspace Pools | workspaces:DescribeWorkspacesPools |