IAM Onboarding

Customer IAM role

FinOps Dash needs a read-only IAM role in each connected AWS account, assumed via sts:AssumeRole. The permission list below is computed live from every active collector's declared permissions — never hand-maintained, so it can't drift from what the code actually calls.

Read-only IAM actions

AWS services

Download role template

Deploy as-is, then paste the resulting RoleArn output into the "Assume Role ARN" field.

CloudFormation Terraform

Required permissions

Grouped by AWS service. Read-only actions only — no create, modify, or delete.

60 actions

Service	IAM actions
CloudwatchReadOnly	`cloudwatch:GetMetricStatistics`
DynamodbReadOnly	`dynamodb:DescribeTable` `dynamodb:ListTables` `dynamodb:ListTagsOfResource`
Ec2ReadOnly	`ec2:DescribeAddresses` `ec2:DescribeInstances` `ec2:DescribeInternetGateways` `ec2:DescribeNatGateways` `ec2:DescribeReservedInstances` `ec2:DescribeSecurityGroups` `ec2:DescribeSnapshots` `ec2:DescribeSubnets` `ec2:DescribeVolumes` `ec2:DescribeVpcEndpoints` `ec2:DescribeVpcs`
ElasticacheReadOnly	`elasticache:DescribeCacheClusters` `elasticache:DescribeReplicationGroups` `elasticache:DescribeReservedCacheNodes` `elasticache:ListTagsForResource`
ElasticfilesystemReadOnly	`elasticfilesystem:DescribeFileSystems` `elasticfilesystem:DescribeLifecycleConfiguration` `elasticfilesystem:DescribeTags`
ElasticloadbalancingReadOnly	`elasticloadbalancing:DescribeLoadBalancers` `elasticloadbalancing:DescribeTags` `elasticloadbalancing:DescribeTargetGroups`
EsReadOnly	`es:DescribeDomains` `es:DescribeReservedInstances` `es:ListDomainNames` `es:ListTags`
KmsReadOnly	`kms:DescribeKey` `kms:GetKeyRotationStatus` `kms:ListAliases` `kms:ListKeys` `kms:ListResourceTags`
LambdaReadOnly	`lambda:GetFunctionConfiguration` `lambda:ListFunctions` `lambda:ListTags`
LogsReadOnly	`logs:DescribeLogGroups` `logs:ListTagsForResource` `logs:ListTagsLogGroup`
RdsReadOnly	`rds:DescribeDBClusters` `rds:DescribeDBInstances` `rds:DescribeReservedDBInstances` `rds:ListTagsForResource`
Route53ReadOnly	`route53:ListHostedZones` `route53:ListResourceRecordSets` `route53:ListTagsForResource`
S3ReadOnly	`s3:GetBucketLocation` `s3:GetBucketTagging` `s3:GetObject` `s3:ListAllMyBuckets` `s3:ListBucket`
SavingsplansReadOnly	`savingsplans:DescribeSavingsPlans`
SecretsmanagerReadOnly	`secretsmanager:ListSecrets`
SnsReadOnly	`sns:GetTopicAttributes` `sns:ListTagsForResource` `sns:ListTopics`
SqsReadOnly	`sqs:GetQueueAttributes` `sqs:ListQueueTags` `sqs:ListQueues`