Permissions

Why we need permissions#

To deliver savings, we analyse your AWS usage and apply commitment-based discounts on your behalf. This is done through a cross-account IAM role that you create in your management (payer) account with our CloudFormation template. If you connect your whole AWS Organization, a CloudFormation StackSet creates the same role in each member account. The role follows the principle of least privilege.

We only receive the access strictly necessary to:

1. Read cost and usage data.
2. Detect optimisation opportunities.
3. Manage the lifecycle of our MilkBoxes.

Monitoring (Read-Only)#

These permissions let MilkStraw AI monitor your spend and resources without touching your workloads.

Cost management

ce:Describe*
ce:Get*
ce:List*
pricing:DescribeServices
pricing:GetAttributeValues
pricing:GetProducts
savingsplans:Describe*
savingsplans:List*
cloudwatch:GetMetricData
cloudwatch:GetMetricStatistics
cloudwatch:ListMetrics

Compute & DataStores

application-autoscaling:Describe*
autoscaling:Describe*
ec2:Describe*
ecs:Describe*
ecs:List*
eks:Describe*
eks:List*
elasticache:Describe*
elasticache:List*
es:Describe*
es:List*
memorydb:Describe*
rds:Describe*
rds:List*
redshift:Describe*
redshift:Get*
redshift:List*
sagemaker:Describe*
sagemaker:Get*
sagemaker:List*

We have a deny policy for Redshift, to block access to cluster credentials:

redshift:GetClusterCredentials
redshift:GetClusterCredentialsWithIAM
redshift:DescribeAuthenticationProfiles

Storage & Containers

s3:GetBucket*
s3:GetEncryptionConfiguration
s3:GetLifecycleConfiguration
s3:GetStorageLens*
s3:ListAllMyBuckets
s3:ListBucket*
s3:ListStorageLensConfigurations
ecr:BatchGetImage
ecr:Describe*
ecr:GetLifecyclePolicy
ecr:GetRegistryPolicy
ecr:GetRepositoryPolicy
ecr:List*

We only read bucket and repository metadata (configuration, lifecycle policies, Storage Lens metrics). Never the objects stored inside your buckets.

Networking & Load Balancing

elasticloadbalancing:Describe*
network-firewall:Describe*
network-firewall:List*

Logs

logs:DescribeLogGroups

We only read log group metadata (retention settings, stored bytes). Never the log events themselves.

AWS optimisation tools

These permissions let us read recommendations that AWS itself generates for your account.

compute-optimizer:Describe*
compute-optimizer:Get*
support:DescribeTrustedAdvisor*
support:RefreshTrustedAdvisorCheck
trustedadvisor:Describe*
trustedadvisor:Get*
trustedadvisor:List*

Enabling AWS cost tools#

These actions let us enable AWS Compute Optimizer and S3 Storage Lens for your account, and ask AWS to refresh your Savings Plans recommendations, so their data can feed into our analysis.

compute-optimizer:UpdateEnrollmentStatus
s3:PutStorageLensConfiguration
organizations:EnableAWSServiceAccess
iam:CreateServiceLinkedRole
ce:StartSavingsPlansPurchaseRecommendationGeneration

iam:CreateServiceLinkedRole and organizations:EnableAWSServiceAccess are locked down with IAM conditions so they can only be used for the Compute Optimizer, S3 Storage Lens, and AWS Organizations service-linked roles, nothing else.

Integration management#

These actions are required to integrate MilkBox accounts into your AWS Organization.

organizations:CreateOrganization
organizations:Describe*
organizations:InviteAccountToOrganization
organizations:List*

We use organizations:CreateOrganization when the organization is not already created, this is a one-time operation for small standalone accounts, if you already have an organization, this api cant be executed against your account, then organizations:InviteAccountToOrganization is used to invite MilkBox accounts to your organization.

Cost monitoring and visibility#

These permissions are required to read resource tags for cost allocation and visibility per resource.

Tagging

tag:DescribeReportCreation
tag:Get*
tag:StartReportCreation

Review the full policy#

You can always inspect the exact IAM policy generated by our CloudFormation stack:

View the JSON policy ↗

Feel free to reach out if you have any questions about security or least-privilege access.