AWSCost · the permissions
Everything AWSCost can read, before you connect anything.
Connecting deploys one CloudFormation stack in your account. It creates one IAM role, which AWSCost assumes to read your bill and your resources. That role grants 60 permissions across 20 services. Here they all are.
Not a promise that it is read-only - the list. It is generated from the same template your stack deploys, and a test fails if the two ever disagree.
There is no write action anywhere in the role. AWSCost cannot change, delete, restart or move anything you own - not in a bug, not if I wanted to.
Your bill
Last full month's spend by service, and your free-tier usage. This sets the price band for the report, decides which checks are worth running, and stops a finding being priced at list rate for something AWS is not charging you for yet.
- ce:GetCostAndUsage
- ce:GetReservationUtilization
- ce:GetSavingsPlansCoverage
- ce:GetSavingsPlansUtilization
- ce:GetSavingsPlansPurchaseRecommendation
- freetier:GetFreeTierUsage
Which regions you have switched on
So the scan sweeps the regions your account actually uses instead of all thirty-odd.
- account:ListRegions
Servers, disks and networking
Instances, volumes, snapshots, images, Elastic IPs, NAT gateways, VPC endpoints, VPNs, Transit Gateway attachments and network interfaces - the things that bill by the hour whether anything uses them or not.
- autoscaling:DescribeAutoScalingGroups
- autoscaling:DescribeLaunchConfigurations
- ec2:DescribeInstances
- ec2:DescribeVolumes
- ec2:DescribeSnapshots
- ec2:DescribeImages
- ec2:DescribeLaunchTemplateVersions
- ec2:DescribeAddresses
- ec2:DescribeNatGateways
- ec2:DescribeNetworkInterfaces
- ec2:DescribeVpcEndpoints
- ec2:DescribeVpcEndpointServices
- ec2:DescribeClientVpnEndpoints
- ec2:DescribeClientVpnTargetNetworks
- ec2:DescribeTransitGatewayAttachments
- ec2:DescribeVpnConnections
Load balancers
Which ones exist, what they point at, and whether anything behind them is healthy. A load balancer with no healthy target still bills.
- elasticloadbalancing:DescribeLoadBalancers
- elasticloadbalancing:DescribeTargetGroups
- elasticloadbalancing:DescribeTargetHealth
Databases and caches
Sizes, engines, snapshots and cluster settings for RDS, Aurora, ElastiCache, DynamoDB and OpenSearch. Configuration only - no query runs and no row is read.
- elasticache:DescribeCacheClusters
- elasticache:DescribeReplicationGroups
- es:DescribeDomains
- es:ListDomainNames
- rds:DescribeDBInstances
- rds:DescribeDBSnapshots
- rds:DescribeDBClusters
- dynamodb:ListTables
- dynamodb:DescribeTable
Containers
Clusters, services, task definitions, node groups and image repositories across ECS, EKS and ECR.
- ecr:DescribeRepositories
- ecr:DescribeImages
- ecr:BatchGetImage
- ecs:ListClusters
- ecs:ListServices
- ecs:DescribeServices
- ecs:DescribeTaskDefinition
- eks:ListClusters
- eks:DescribeCluster
- eks:ListNodegroups
- eks:ListFargateProfiles
Storage
Which buckets exist and how each is set up - versioning, lifecycle rules, tiering, unfinished uploads - plus EFS file systems.
- elasticfilesystem:DescribeFileSystems
- s3:ListAllMyBuckets
- s3:GetBucketLocation
- s3:GetBucketVersioning
- s3:GetLifecycleConfiguration
- s3:ListBucketMultipartUploads
- s3:ListMultipartUploadParts
- s3:GetIntelligentTieringConfiguration
Functions, notebooks and resolvers
Lambda functions, SageMaker notebook instances and Route 53 Resolver endpoints. Three more things that charge while idle.
- lambda:ListFunctions
- route53resolver:ListResolverEndpoints
- sagemaker:ListNotebookInstances
- sagemaker:DescribeNotebookInstance
Usage graphs
CloudWatch metrics and log group settings. This is how a resource is shown to be idle rather than merely present, and it is what keeps a finding from being a guess.
- cloudwatch:GetMetricData
- logs:DescribeLogGroups
Why the role covers every resource
Each of those actions is granted on every resource in the account, not a named list. That is not laziness. A scanner cannot be handed a list of the things nobody remembers owning - a bucket left behind two years ago is exactly the one you want it to notice.
The limit is in the verbs, not the targets. Read-only on everything is still read-only.
The ones that read more than settings
Most of the list reads configuration - a size, a state, a retention setting. Four read more than that:
- ce:GetCostAndUsage - your spend, by service, for the last full month. The report is priced off it.
- s3:ListBucketMultipartUploads and s3:ListMultipartUploadParts - the keys and sizes of uploads that were started and never finished. You pay storage on those parts forever, and nothing in the console shows them.
- ecr:BatchGetImage - the manifest listing a container image’s layers and their sizes. Not the image contents.
What is not in the role
If an action is not on the list above, the role cannot make the call. The ones people ask about: it cannot read an object out of a bucket, a row out of a database, a secret, a parameter, an environment variable, an IAM user or an access key. It cannot read CloudTrail, and it cannot see anything in another AWS account.
Taking it back
Delete the CloudFormation stack in your account. The role goes with it and AWSCost loses access that second - no email, no cancellation, nothing to ask me for.
Until you do, the role can only be assumed by AWSCost’s own account, and only with an external ID generated for you. It is not open to the internet.
Sign in and the connect page links the exact template file your stack deploys, so you can read it in full before you launch it.
Frequently asked questions
What permissions does AWSCost need on my AWS account?+
60 of them, across 20 AWS services, and every one is listed on this page. They are read on the page straight from the CloudFormation template your stack deploys, so the list cannot drift from what you actually grant.
Can AWSCost change anything in my account?+
No. There is no write action anywhere in the role - it cannot change, delete, restart or move anything you own. Read-only is enforced by the policy itself, not by a promise about how the software behaves.
Can it read my files, database rows or secrets?+
No. It cannot read an object out of a bucket, a row out of a database, a secret, a parameter, an environment variable, an IAM user or an access key. If an action is not on the list, the role cannot make the call.
Why does the role apply to every resource rather than named ones?+
Because a scanner cannot be handed a list of the resources nobody remembers owning - those are the ones costing you money. The limit is in what it may do, not what it may look at: read-only on everything is still read-only.
How do I revoke access?+
Delete the CloudFormation stack in your account. The role goes with it and AWSCost loses access that second - no email, no cancellation, nothing to ask us for.
That is the whole ask. Connect read-only and see what your account is wasting, in real dollars, before you pay anything.