AWS: Inventory Permissions
This page outlines the permissions required for the AWS inventory connector. Enable these permissions to view the resource listing in the inventory tab.
As cloud environments evolve and providers introduce API changes, required permissions may change as well. These permissions are reviewed and updated with each product release to reflect the latest requirements. Stale API entries are periodically removed, and updates are included in subsequent releases.
| Resource Type | Permissions |
|---|---|
| Instance | ec2:DescribeInstances ec2:DescribeVpcs ec2:DescribeInstanceStatus iam:ListInstanceProfiles ec2:DescribeImages |
| VPC | ec2:DescribeVpcs |
| RDS | rds:ListTagsForResource rds:DescribeDBInstances |
| Subnet | ec2:DescribeSubnets |
| Security Group | ec2:DescribeSecurityGroups |
| Route Table | ec2:DescribeRouteTables |
| Network ACL | ec2:DescribeNetworkAcls |
| S3 Bucket | s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl s3:GetBucketPolicy s3:GetBucketPolicyStatus s3:GetBucketPublicAccessBlock s3:GetAccountPublicAccessBlock |
| Internet Gateway | ec2:DescribeInternetGateways |
| Auto Scaling Group | autoscaling:DescribeAutoScalingGroups |
| Load Balancer | elasticloadbalancing:DescribeLoadBalancers |
| IAM User | iam:GetAccountAuthorizationDetails |
| EBS Volume | ec2:DescribeVolumes |
| Lambda Function | lambda:ListFunctions lambda:ListTags lambda:ListVersionsByFunction lambda:GetFunctionConcurrency lambda:ListAliases lambda:ListEventSourceMappings iam:ListRolePolicies iam:GetRolePolicy iam:ListAttachedRolePolicies iam:GetPolicy iam:GetPolicyVersion iam:GetRole lambda:GetPolicy lambda:ListFunctionUrlConfigs |
| EKS Cluster | eks:ListClusters eks:DescribeCluster |
| EKS Node Group | eks:ListClusters eks:ListNodegroups eks:DescribeNodegroup |
| EKS Fargate Profile | eks:ListClusters eks:ListFargateProfiles eks:DescribeFargateProfile |
| VPC Endpoint | ec2:DescribeVpcs |
| VPC Endpoint Service | ec2:DescribeVpcs |
| IAM Group | iam:GetAccountAuthorizationDetails |
| IAM Policy | iam:GetAccountAuthorizationDetails |
| IAM Role | iam:GetAccountAuthorizationDetails |
| Sagemaker Notebook | sagemaker:ListNotebookInstances sagemaker:DescribeNotebookInstance |
| Secrets | secretsmanager:ListSecrets |
| Redshift Cluster | redshift:DescribeClusterParameters redshift:DescribeClusters redshift:DescribeLoggingStatus |
| CloudFront Distributions | cloudfront:ListDistributions tag:GetResources |
| ECS Clusters | ecs:DescribeClusters ecs:ListClusters ecs:ListServices ecs:ListTasks |
| Route53 Hosted Zones | route53:ListHostedZones route53:ListResourceRecordSets route53:ListQueryLoggingConfigs |
| Route53 Domains | route53domains:ListDomains route53domains:GetDomainDetail route53domains:ListTagsForDomain |
| ECR Repositories | ecr:GetRepositoryPolicy ecr:DescribeRepositories ecr-public:DescribeRepositories ecr-public:GetRepositoryPolicy ecr:DescribeImages ecr-public:DescribeImages ecr:GetLifecyclePolicy |
| Custom Domain Names | apigateway:GET |
| API Gateway | apigateway:GET |
| State Machine | states:ListStateMachines states:DescribeStateMachine |
| SNS Topic | SNS:ListTopics SNS:GetTopicAttributes |
| EFS File System | elasticfilesystem:DescribeFileSystems |
| SQS Queue | sqs:ListQueues sqs:GetQueueAttributes |
| Network Interfaces | ec2:DescribeNetworkInterfaces |
| AMIs | ec2:DescribeImages |
| Bedrock Custom Model | bedrock:ListProvisionedModelThroughputs bedrock:GetCustomModel bedrock:ListCustomModels |
| Bedrock Knowledge Bases | bedrock:ListKnowledgeBases bedrock:GetKnowledgeBase |
| Workspace | workspaces:DescribeWorkspaces |
| Workspace Pools | workspaces:DescribeWorkspacesPools |
| Sagemaker Models | sagemaker:DescribeModel sagemaker:ListModels |
| Workspace Directories | workspaces:DescribeWorkspaceDirectories |
| KMS | kms:ListKeys kms:GetKeyPolicy kms:GetKeyRotationStatus |
| IAM Password Policy | iam:GetAccountPasswordPolicy |
| Elasticache Replication Group | elasticache:DescribeReplicationGroups |
| Document DB Snapshots | rds:DescribeDBClusterSnapshots |
| Amazon Open Search Domain | es:ListDomainNames es:DescribeElasticsearchDomain |
| RDS Cluster Snapshot | rds:DescribeDBClusterSnapshots |
| MSK Clusters | kafka:ListClusters |
| Launch Configuration | autoscaling:DescribeLaunchConfigurations |
| Identity Pool | cognito-identity:ListIdentityPools cognito-identity:DescribeIdentityPool |
| DMS Replication | dms:DescribeReplicationInstances |
| VPC Peering Connections | ec2:DescribeVpcPeeringConnections |
| Direct Connect Connections | directconnect:DescribeConnections |
| Document DB Clusters | rds:DescribeDBClusters |
| RDS Cluster | rds:DescribeDBClusters |