Somente leitura. Sempre.

Analisamos sua conta por uma role que você implanta e pode revogar. Esta página é gerada a partir do próprio template CloudFormation que pedimos para instalar — ela não consegue afirmar uma permissão que a role não tem.

O que nunca pedimos

• Conteúdo de objetos (s3:GetObject) — lemos nomes e configurações de bucket, nunca seus dados.
• Valores de segredos (secretsmanager:GetSecretValue) — apenas nomes.
• Qualquer ação de escrita, exclusão ou gestão de permissões.

Cada permissão que pedimos

Agrupadas por statement, direto do template, com o porquê de cada uma existir.

• CostExplorerRead

  Cost Explorer — commitment coverage / spend (rule COMMIT-C001).

  • ce:GetCostAndUsage
  • ce:GetReservationUtilization
  • ce:GetReservationCoverage
  • ce:GetSavingsPlansUtilization
  • ce:GetSavingsPlansCoverage

• EC2Read

  EC2 inventory — idle instances, orphan volumes, snapshots, EIPs, NAT. DescribeRegions lets us scan every enabled region, not just one.

  • ec2:DescribeRegions
  • ec2:DescribeInstances
  • ec2:DescribeVolumes
  • ec2:DescribeAddresses
  • ec2:DescribeSnapshots
  • ec2:DescribeNatGateways
  • ec2:DescribeRouteTables

• RDSRead

  RDS inventory — idle databases, snapshots, reservations.

  • rds:DescribeDBInstances
  • rds:DescribeDBSnapshots
  • rds:DescribeReservedDBInstances

• S3Read

  S3 — bucket list + lifecycle config only (never object contents).

  • s3:ListAllMyBuckets
  • s3:ListBucket
  • s3:GetLifecycleConfiguration
  • s3:ListBucketMultipartUploads
  • s3:ListMultipartUploadParts

• CloudWatchRead

  CloudWatch — utilization metrics for "idle resource" rules.

  • cloudwatch:GetMetricData
  • cloudwatch:GetMetricStatistics

• LambdaRead

  Lambda — function inventory.

  • lambda:ListFunctions

• CloudFrontRead

  CloudFront — cross-check before recommending an S3 bucket removal (never suggest deleting a bucket that serves a live distribution).

  • cloudfront:ListDistributions

• ELBRead

  Load balancers — detect idle ALB/NLB with no healthy targets.

  • elasticloadbalancing:DescribeLoadBalancers
  • elasticloadbalancing:DescribeTargetGroups
  • elasticloadbalancing:DescribeTargetHealth

• LogsRead

  CloudWatch Logs — log groups with no retention accumulate forever.

  • logs:DescribeLogGroups

• DynamoDBRead

  DynamoDB — provisioned tables sitting idle versus their capacity.

  • dynamodb:ListTables
  • dynamodb:DescribeTable

• Route53Read

  Route 53 — hosted zones billing a flat fee while hosting nothing.

  • route53:ListHostedZones

• SelfPolicySimulation

  Self-diagnosis of a missing permission, scoped to this role only.

  • iam:SimulatePrincipalPolicy