[{"data":1,"prerenderedAt":745},["ShallowReactive",2],{"docs-navigation":3,"\u002Fdocs\u002Fsaving\u002Fresources\u002Fpermissions":107},[4],{"title":5,"section":6,"to":7,"groups":8},"MilkStraw Saving","\u002Fdocs\u002Fsaving","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fintroduction",[9,26,45,68,92],{"title":10,"links":11},"Get started",[12,14,18,22],{"title":13,"to":7},"Overview",{"title":15,"to":16,"icon":17},"How MilkStraw AI works","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fhow-milkstraw-ai-works","IconLightBulb",{"title":19,"to":20,"icon":21},"Quickstart","\u002Fdocs\u002Fsaving\u002Fget-started\u002Fquickstart","IconPlugin1",{"title":23,"to":24,"icon":25},"Activate and track savings","\u002Fdocs\u002Fsaving\u002Fget-started\u002Factivate-savings","IconLightningBolt",{"title":27,"links":28},"Use MilkStraw AI",[29,33,37,41],{"title":30,"to":31,"icon":32},"Projects and findings","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fprojects-and-findings","IconSquareChecklist",{"title":34,"to":35,"icon":36},"Spend","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fspend","IconLineChart1",{"title":38,"to":39,"icon":40},"Milkman","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fmilkman","IconChatBubbles",{"title":42,"to":43,"icon":44},"MilkStraw CLI","\u002Fdocs\u002Fsaving\u002Fuse-milkstraw-ai\u002Fcli","IconConsole",{"title":46,"links":47},"Upgrade guides",[48,52,56,60,64],{"title":49,"to":50,"icon":51},"Guides overview","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Foverview","IconBook",{"title":53,"to":54,"icon":55},"Amazon EKS","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-eks-instance-types","IconArrowUpCircle",{"title":57,"to":58,"icon":59},"Amazon EC2 Auto Scaling","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-asg-instance-types","IconBuildingBlocks",{"title":61,"to":62,"icon":63},"Amazon EBS gp2 to gp3","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-ebs-gp2-to-gp3","IconServer1",{"title":65,"to":66,"icon":67},"AWS Elastic Beanstalk","\u002Fdocs\u002Fsaving\u002Fupgrade-guides\u002Fupgrade-elastic-beanstalk-instance-types","IconGrowth",{"title":69,"links":70},"Resources",[71,75,79,82,85,89],{"title":72,"to":73,"icon":74},"Supported services","\u002Fdocs\u002Fsaving\u002Fresources\u002Fsupported-services","IconServer",{"title":76,"to":77,"icon":78},"Security","\u002Fdocs\u002Fsaving\u002Fresources\u002Fsecurity","IconShield",{"title":80,"to":81},"Permissions","\u002Fdocs\u002Fsaving\u002Fresources\u002Fpermissions",{"title":83,"to":84},"Roles","\u002Fdocs\u002Fsaving\u002Fresources\u002Froles",{"title":86,"to":87,"icon":88},"Billing","\u002Fdocs\u002Fsaving\u002Fresources\u002Fbilling","IconBanknote2",{"title":90,"to":91},"Cancellation","\u002Fdocs\u002Fsaving\u002Fresources\u002Fcancellation",{"title":93,"links":94},"Get help",[95,99,103],{"title":96,"to":97,"icon":98},"FAQ","\u002Fdocs\u002Fsaving\u002Fget-help\u002Ffaq","IconCircleQuestionmark",{"title":100,"to":101,"icon":102},"Troubleshooting","\u002Fdocs\u002Fsaving\u002Fget-help\u002Ftroubleshooting","IconHammer",{"title":104,"to":105,"icon":106},"Contact & support","\u002Fdocs\u002Fsaving\u002Fget-help\u002Fcontact","IconSupport",{"path":81,"data":108,"meta":110,"nodes":141},{"title":80,"description":109},"Breakdown of the cross-account IAM role MilkStraw AI uses and the least-privilege permissions it requires.",{"toc":111,"key":133,"source":134,"stem":135,"extension":136,"kind":137,"type":138,"partial":139,"hash":140},{"title":112,"searchDepth":113,"depth":113,"links":114},"",2,[115,118,121,124,127,130],{"id":116,"depth":113,"text":117},"why-we-need-permissions","Why we need permissions",{"id":119,"depth":113,"text":120},"monitoring-read-only","Monitoring (Read-Only)",{"id":122,"depth":113,"text":123},"enabling-aws-cost-tools","Enabling AWS cost tools",{"id":125,"depth":113,"text":126},"integration-management","Integration management",{"id":128,"depth":113,"text":129},"cost-monitoring-and-visibility","Cost monitoring and visibility",{"id":131,"depth":113,"text":132},"review-the-full-policy","Review the full policy","docs\u002F2.saving\u002F4.resources\u002F3.permissions.md","docs","2.saving\u002F4.resources\u002F3.permissions",".md","document","text\u002Fmarkdown",false,"fdd15079de32afb4",[142,145,158,161,182,185,187,190,195,264,269,380,405,410,509,512,517,536,541,550,553,558,561,600,602,604,607,640,648,657,659,661,664,688,697,699,701,704,709,728,730,732,735,742],[143,144,117],"h2",{"id":116},[146,147,148,149,153,154,157],"p",{},"To deliver savings, we analyse your AWS usage and apply commitment-based discounts on your behalf. This is done through a ",[150,151,152],"strong",{},"cross-account IAM role"," that you create in your management (payer) account with our CloudFormation template. If you connect your whole AWS Organization, a CloudFormation StackSet creates the same role in each member account. The role follows the ",[150,155,156],{},"principle of least privilege",".",[146,159,160],{},"We only receive the access strictly necessary to:",[162,163,164,168,171],"ol",{},[165,166,167],"li",{},"Read cost and usage data.",[165,169,170],{},"Detect optimisation opportunities.",[165,172,173,174,157],{},"Manage the lifecycle of our ",[175,176,181],"abbr",{"$":177,"title":180},{"html":178,"block":179},1,0,"Standard AWS accounts that contain Commitment-based discounts","MilkBoxes",[183,184],"hr",{},[143,186,120],{"id":119},[146,188,189],{},"These permissions let MilkStraw AI monitor your spend and resources without touching your workloads.",[146,191,192],{},[150,193,194],{},"Cost management",[196,197,200],"pre",{"language":198,"class":199},"json","shiki shiki-themes github-light-default github-dark-default dark:github-dark-default",[201,202,204,213,214,213,219,213,224,213,229,213,234,213,239,213,244,213,249,213,254,213,259],"code",{"class":203},"language-json",[205,206,209],"span",{"class":207,"style":208},"line","display: inline",[205,210,212],{"style":211},"color:#1F2328;--shiki-dark:#E6EDF3","ce:Describe*","\n",[205,215,216],{"class":207,"style":208},[205,217,218],{"style":211},"ce:Get*",[205,220,221],{"class":207,"style":208},[205,222,223],{"style":211},"ce:List*",[205,225,226],{"class":207,"style":208},[205,227,228],{"style":211},"pricing:DescribeServices",[205,230,231],{"class":207,"style":208},[205,232,233],{"style":211},"pricing:GetAttributeValues",[205,235,236],{"class":207,"style":208},[205,237,238],{"style":211},"pricing:GetProducts",[205,240,241],{"class":207,"style":208},[205,242,243],{"style":211},"savingsplans:Describe*",[205,245,246],{"class":207,"style":208},[205,247,248],{"style":211},"savingsplans:List*",[205,250,251],{"class":207,"style":208},[205,252,253],{"style":211},"cloudwatch:GetMetricData",[205,255,256],{"class":207,"style":208},[205,257,258],{"style":211},"cloudwatch:GetMetricStatistics",[205,260,261],{"class":207,"style":208},[205,262,263],{"style":211},"cloudwatch:ListMetrics",[146,265,266],{},[150,267,268],{},"Compute & DataStores",[196,270,271],{"language":198,"class":199},[201,272,273,213,278,213,283,213,295,213,300,213,305,213,310,213,315,213,320,213,325,213,330,213,335,213,340,213,345,213,350,213,355,213,360,213,365,213,370,213,375],{"class":203},[205,274,275],{"class":207,"style":208},[205,276,277],{"style":211},"application-autoscaling:Describe*",[205,279,280],{"class":207,"style":208},[205,281,282],{"style":211},"autoscaling:Describe*",[205,284,285,288,292],{"class":207,"style":208},[205,286,287],{"style":211},"ec",[205,289,291],{"style":290},"color:#0550AE;--shiki-dark:#79C0FF","2",[205,293,294],{"style":211},":Describe*",[205,296,297],{"class":207,"style":208},[205,298,299],{"style":211},"ecs:Describe*",[205,301,302],{"class":207,"style":208},[205,303,304],{"style":211},"ecs:List*",[205,306,307],{"class":207,"style":208},[205,308,309],{"style":211},"eks:Describe*",[205,311,312],{"class":207,"style":208},[205,313,314],{"style":211},"eks:List*",[205,316,317],{"class":207,"style":208},[205,318,319],{"style":211},"elasticache:Describe*",[205,321,322],{"class":207,"style":208},[205,323,324],{"style":211},"elasticache:List*",[205,326,327],{"class":207,"style":208},[205,328,329],{"style":211},"es:Describe*",[205,331,332],{"class":207,"style":208},[205,333,334],{"style":211},"es:List*",[205,336,337],{"class":207,"style":208},[205,338,339],{"style":211},"memorydb:Describe*",[205,341,342],{"class":207,"style":208},[205,343,344],{"style":211},"rds:Describe*",[205,346,347],{"class":207,"style":208},[205,348,349],{"style":211},"rds:List*",[205,351,352],{"class":207,"style":208},[205,353,354],{"style":211},"redshift:Describe*",[205,356,357],{"class":207,"style":208},[205,358,359],{"style":211},"redshift:Get*",[205,361,362],{"class":207,"style":208},[205,363,364],{"style":211},"redshift:List*",[205,366,367],{"class":207,"style":208},[205,368,369],{"style":211},"sagemaker:Describe*",[205,371,372],{"class":207,"style":208},[205,373,374],{"style":211},"sagemaker:Get*",[205,376,377],{"class":207,"style":208},[205,378,379],{"style":211},"sagemaker:List*",[381,382,383,386],"blockquote",{},[146,384,385],{},"We have a deny policy for Redshift, to block access to cluster credentials:",[196,387,388],{"language":198,"class":199},[201,389,390,213,395,213,400],{"class":203},[205,391,392],{"class":207,"style":208},[205,393,394],{"style":211},"redshift:GetClusterCredentials",[205,396,397],{"class":207,"style":208},[205,398,399],{"style":211},"redshift:GetClusterCredentialsWithIAM",[205,401,402],{"class":207,"style":208},[205,403,404],{"style":211},"redshift:DescribeAuthenticationProfiles",[146,406,407],{},[150,408,409],{},"Storage & Containers",[196,411,412],{"language":198,"class":199},[201,413,414,213,425,213,434,213,443,213,452,213,461,213,470,213,479,213,484,213,489,213,494,213,499,213,504],{"class":203},[205,415,416,419,422],{"class":207,"style":208},[205,417,418],{"style":211},"s",[205,420,421],{"style":290},"3",[205,423,424],{"style":211},":GetBucket*",[205,426,427,429,431],{"class":207,"style":208},[205,428,418],{"style":211},[205,430,421],{"style":290},[205,432,433],{"style":211},":GetEncryptionConfiguration",[205,435,436,438,440],{"class":207,"style":208},[205,437,418],{"style":211},[205,439,421],{"style":290},[205,441,442],{"style":211},":GetLifecycleConfiguration",[205,444,445,447,449],{"class":207,"style":208},[205,446,418],{"style":211},[205,448,421],{"style":290},[205,450,451],{"style":211},":GetStorageLens*",[205,453,454,456,458],{"class":207,"style":208},[205,455,418],{"style":211},[205,457,421],{"style":290},[205,459,460],{"style":211},":ListAllMyBuckets",[205,462,463,465,467],{"class":207,"style":208},[205,464,418],{"style":211},[205,466,421],{"style":290},[205,468,469],{"style":211},":ListBucket*",[205,471,472,474,476],{"class":207,"style":208},[205,473,418],{"style":211},[205,475,421],{"style":290},[205,477,478],{"style":211},":ListStorageLensConfigurations",[205,480,481],{"class":207,"style":208},[205,482,483],{"style":211},"ecr:BatchGetImage",[205,485,486],{"class":207,"style":208},[205,487,488],{"style":211},"ecr:Describe*",[205,490,491],{"class":207,"style":208},[205,492,493],{"style":211},"ecr:GetLifecyclePolicy",[205,495,496],{"class":207,"style":208},[205,497,498],{"style":211},"ecr:GetRegistryPolicy",[205,500,501],{"class":207,"style":208},[205,502,503],{"style":211},"ecr:GetRepositoryPolicy",[205,505,506],{"class":207,"style":208},[205,507,508],{"style":211},"ecr:List*",[381,510,511],{},"We only read bucket and repository metadata (configuration, lifecycle policies, Storage Lens metrics). Never the objects stored inside your buckets.",[146,513,514],{},[150,515,516],{},"Networking & Load Balancing",[196,518,519],{"language":198,"class":199},[201,520,521,213,526,213,531],{"class":203},[205,522,523],{"class":207,"style":208},[205,524,525],{"style":211},"elasticloadbalancing:Describe*",[205,527,528],{"class":207,"style":208},[205,529,530],{"style":211},"network-firewall:Describe*",[205,532,533],{"class":207,"style":208},[205,534,535],{"style":211},"network-firewall:List*",[146,537,538],{},[150,539,540],{},"Logs",[196,542,543],{"language":198,"class":199},[201,544,545],{"class":203},[205,546,547],{"class":207,"style":208},[205,548,549],{"style":211},"logs:DescribeLogGroups",[381,551,552],{},"We only read log group metadata (retention settings, stored bytes). Never the log events themselves.",[146,554,555],{},[150,556,557],{},"AWS optimisation tools",[146,559,560],{},"These permissions let us read recommendations that AWS itself generates for your account.",[196,562,563],{"language":198,"class":199},[201,564,565,213,570,213,575,213,580,213,585,213,590,213,595],{"class":203},[205,566,567],{"class":207,"style":208},[205,568,569],{"style":211},"compute-optimizer:Describe*",[205,571,572],{"class":207,"style":208},[205,573,574],{"style":211},"compute-optimizer:Get*",[205,576,577],{"class":207,"style":208},[205,578,579],{"style":211},"support:DescribeTrustedAdvisor*",[205,581,582],{"class":207,"style":208},[205,583,584],{"style":211},"support:RefreshTrustedAdvisorCheck",[205,586,587],{"class":207,"style":208},[205,588,589],{"style":211},"trustedadvisor:Describe*",[205,591,592],{"class":207,"style":208},[205,593,594],{"style":211},"trustedadvisor:Get*",[205,596,597],{"class":207,"style":208},[205,598,599],{"style":211},"trustedadvisor:List*",[183,601],{},[143,603,123],{"id":122},[146,605,606],{},"These actions let us enable AWS Compute Optimizer and S3 Storage Lens for your account, and ask AWS to refresh your Savings Plans recommendations, so their data can feed into our analysis.",[196,608,609],{"language":198,"class":199},[201,610,611,213,616,213,625,213,630,213,635],{"class":203},[205,612,613],{"class":207,"style":208},[205,614,615],{"style":211},"compute-optimizer:UpdateEnrollmentStatus",[205,617,618,620,622],{"class":207,"style":208},[205,619,418],{"style":211},[205,621,421],{"style":290},[205,623,624],{"style":211},":PutStorageLensConfiguration",[205,626,627],{"class":207,"style":208},[205,628,629],{"style":211},"organizations:EnableAWSServiceAccess",[205,631,632],{"class":207,"style":208},[205,633,634],{"style":211},"iam:CreateServiceLinkedRole",[205,636,637],{"class":207,"style":208},[205,638,639],{"style":211},"ce:StartSavingsPlansPurchaseRecommendationGeneration",[381,641,642,644,645,647],{},[201,643,634],{}," and ",[201,646,629],{}," are locked down with IAM conditions so they can only be used for the Compute Optimizer, S3 Storage Lens, and AWS Organizations service-linked roles, nothing else.",[649,650,652,653,656],"callout",{"type":651},"note","When you connect, MilkStraw AI creates a free S3 Storage Lens dashboard named ",[150,654,655],{},"milkstraw-org-dashboard",". It exports daily bucket-level metrics to an S3 bucket that MilkStraw AI owns. If you delete your MilkStraw AI organization, the export stops, but the dashboard stays in your account.",[183,658],{},[143,660,126],{"id":125},[146,662,663],{},"These actions are required to integrate MilkBox accounts into your AWS Organization.",[196,665,666],{"language":198,"class":199},[201,667,668,213,673,213,678,213,683],{"class":203},[205,669,670],{"class":207,"style":208},[205,671,672],{"style":211},"organizations:CreateOrganization",[205,674,675],{"class":207,"style":208},[205,676,677],{"style":211},"organizations:Describe*",[205,679,680],{"class":207,"style":208},[205,681,682],{"style":211},"organizations:InviteAccountToOrganization",[205,684,685],{"class":207,"style":208},[205,686,687],{"style":211},"organizations:List*",[381,689,690,691,693,694,696],{},"We use ",[201,692,672],{}," when the organization is not already created, this is a one-time operation for small standalone accounts, if you already have an organization, this api cant be executed against your account, then ",[201,695,682],{}," is used to invite MilkBox accounts to your organization.",[183,698],{},[143,700,129],{"id":128},[146,702,703],{},"These permissions are required to read resource tags for cost allocation and visibility per resource.",[146,705,706],{},[150,707,708],{},"Tagging",[196,710,711],{"language":198,"class":199},[201,712,713,213,718,213,723],{"class":203},[205,714,715],{"class":207,"style":208},[205,716,717],{"style":211},"tag:DescribeReportCreation",[205,719,720],{"class":207,"style":208},[205,721,722],{"style":211},"tag:Get*",[205,724,725],{"class":207,"style":208},[205,726,727],{"style":211},"tag:StartReportCreation",[183,729],{},[143,731,132],{"id":131},[146,733,734],{},"You can always inspect the exact IAM policy generated by our CloudFormation stack:",[146,736,737],{},[738,739,741],"a",{"href":740},"https:\u002F\u002Fs3.eu-west-1.amazonaws.com\u002Fstatics.milkstraw.ai\u002Fcloudformation_templates\u002Fcross_account_role.json","View the JSON policy ↗",[146,743,744],{},"Feel free to reach out if you have any questions about security or least-privilege access.",1792482912295]