AWS: Inventory Permissions
This page outlines the permissions required for the AWS inventory connector. Enable these permissions to view the resource listing in the inventory tab.
As cloud environments evolve and providers introduce API changes, required permissions may change as well. These permissions are reviewed and updated with each product release to reflect the latest requirements. Stale API entries are periodically removed, and updates are included in subsequent releases.
| Resource Type | Permissions |
|---|---|
| ACM Certificate | acm:ListCertificates |
| Amazon Athena Workgroup | athena:GetWorkGroup athena:ListWorkGroups |
| Amazon Network Firewall Policy | network-firewall:ListFirewallPolicies network-firewall:DescribeFirewallPolicy |
| Amazon Open Search Domain | es:ListDomainNames es:DescribeElasticsearchDomain |
| AMIs | ec2:DescribeImages |
| API Gateway | apigateway:GET |
| Auto Scaling Group | autoscaling:DescribeAutoScalingGroups |
| AWS CodeBuild Project | codebuild:ListProjects codebuild:BatchGetProjects |
| AWS IAM Server Certificate | iam:ListServerCertificates iam:GetServerCertificate |
| AWS SSM Document | ssm:ListDocuments ssm:DescribeDocumentPermission |
| Backup Plan (AWS Backup) | backup:ListBackupPlans backup:GetBackupPlan |
| Bedrock Custom Model | bedrock:ListProvisionedModelThroughputs bedrock:GetCustomModel bedrock:ListCustomModels |
| Bedrock Knowledge Bases | bedrock:ListKnowledgeBases bedrock:GetKnowledgeBase |
| CloudFront Distributions | cloudfront:ListDistributions tag:GetResources |
| CloudTrail Trail | s3:ListAllMyBuckets s3:GetBucketLocation cloudtrail:DescribeTrails cloudtrail:GetTrailStatus cloudtrail:GetEventSelectors |
| Custom Domain Names | apigateway:GET |
| Data Stream (Kinesis) | kinesis:ListStreams kinesis:DescribeStreamSummary |
| Direct Connect Connections | directconnect:DescribeConnections |
| DMS Replication | dms:DescribeReplicationInstances |
| Document DB Clusters | rds:DescribeDBClusters |
| Document DB Snapshots | rds:DescribeDBClusterSnapshots |
| DynamoDB Table | dynamodb:ListTables dynamodb:DescribeTable |
| EBS Volume | ec2:DescribeVolumes |
| EC2 Transit Gateway | ec2:DescribeTransitGateways |
| EC2 Transit Gateway Attachment | ec2:DescribeTransitGatewayAttachments |
| ECR Repositories | ecr:GetRepositoryPolicy ecr:DescribeRepositories ecr-public:DescribeRepositories ecr-public:GetRepositoryPolicy ecr:DescribeImages ecr-public:DescribeImages ecr:GetLifecyclePolicy |
| ECS Clusters | ecs:DescribeClusters ecs:ListClusters ecs:ListServices ecs:ListTasks |
| EFS File System | elasticfilesystem:DescribeFileSystems |
| EKS Cluster | eks:ListClusters eks:DescribeCluster |
| EKS Fargate Profile | eks:ListClusters eks:ListFargateProfiles eks:DescribeFargateProfile |
| EKS Node Group | eks:ListClusters eks:ListNodegroups eks:DescribeNodegroup |
| Elasticache Replication Group | elasticache:DescribeReplicationGroups |
| EventBridge Rule | events:ListRules events:DescribeRule |
| Glue Connection | glue:GetConnections |
| IAM Group | iam:GetAccountAuthorizationDetails |
| IAM Password Policy | iam:GetAccountPasswordPolicy |
| IAM Policy | iam:GetAccountAuthorizationDetails |
| IAM Role | iam:GetAccountAuthorizationDetails |
| IAM User | iam:GetAccountAuthorizationDetails |
| Identity Pool | cognito-identity:ListIdentityPools cognito-identity:DescribeIdentityPool |
| Instance | ec2:DescribeInstances ec2:DescribeVpcs ec2:DescribeInstanceStatus iam:ListInstanceProfiles ec2:DescribeImages |
| Internet Gateway | ec2:DescribeInternetGateways |
| KMS | kms:ListKeys kms:GetKeyPolicy kms:GetKeyRotationStatus |
| Lambda Function | lambda:ListFunctions lambda:ListTags lambda:ListVersionsByFunction lambda:GetFunctionConcurrency lambda:ListAliases lambda:ListEventSourceMappings iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:GetPolicy iam:GetPolicyVersion iam:GetRole lambda:GetPolicy lambda:ListFunctionUrlConfigs |
| Launch Configuration | autoscaling:DescribeLaunchConfigurations |
| Load Balancer | elasticloadbalancing:DescribeLoadBalancers |
| MSK Clusters | kafka:ListClusters |
| Network ACL | ec2:DescribeNetworkAcls |
| Network Firewall | network-firewall:ListFirewalls network-firewall:DescribeFirewall |
| Network Interfaces | ec2:DescribeNetworkInterfaces |
| RDS | rds:ListTagsForResource rds:DescribeDBInstances |
| RDS Cluster | rds:DescribeDBClusters |
| RDS Cluster Snapshot | rds:DescribeDBClusterSnapshots |
| RDS Database Snapshot | rds:DescribeDBSnapshots |
| Recovery Point (AWS Backup) | backup:ListRecoveryPointsByBackupVault |
| Redshift Cluster | redshift:DescribeClusterParameters redshift:DescribeClusters redshift:DescribeLoggingStatus |
| Route Table | ec2:DescribeRouteTables |
| Route53 Domains | route53domains:ListDomains route53domains:GetDomainDetail route53domains:ListTagsForDomain |
| Route53 Hosted Zones | route53:ListHostedZones route53:ListResourceRecordSets route53:ListQueryLoggingConfigs |
| S3 Bucket | s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl s3:GetBucketPolicy s3:GetBucketPolicyStatus s3:GetBucketPublicAccessBlock s3:GetAccountPublicAccessBlock |
| Sagemaker Models | sagemaker:DescribeModel sagemaker:ListModels |
| Sagemaker Notebook | sagemaker:ListNotebookInstances sagemaker:DescribeNotebookInstance |
| Secrets | secretsmanager:ListSecrets |
| Security Group | ec2:DescribeSecurityGroups |
| SNS Topic | SNS:ListTopics SNS:GetTopicAttributes |
| SQS Queue | sqs:ListQueues sqs:GetQueueAttributes |
| State Machine | states:ListStateMachines states:DescribeStateMachine |
| Subnet | ec2:DescribeSubnets |
| VPC | ec2:DescribeVpcs |
| VPC Endpoint | ec2:DescribeVpcs |
| VPC Endpoint Service | ec2:DescribeVpcs |
| VPC Peering Connections | ec2:DescribeVpcPeeringConnections |
| Workspace | workspaces:DescribeWorkspaces |
| Workspace Directories | workspaces:DescribeWorkspaceDirectories |
| Workspace Pools | workspaces:DescribeWorkspacesPools |