# IAM permissions for cloud-aws plugin?

**URL:** <https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815>\
**Category:** Elasticsearch\
**Created:** [May 22, 2012, 11:13pm UTC](https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815 "2012-05-22T23:13:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eric_jain/32/834_2.png) [@Eric\_Jain](https://discuss.elastic.co/u/Eric_Jain)\
**Post date:** [May 22, 2012, 11:13pm UTC](https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815/1 "2012-05-22T23:13:32Z")

</div>

Does anyone know the minimum set of permissions the cloud-aws plugin  
requires to work? I'm trying to restrict from EC2:All + S3:All...

[S3]  
AbortMultipartUpload  
CopyObject  
CreateBucket  
DeleteBucket  
DeleteObject  
DeleteObjectVersion  
GetBucketAccessControlPolicy  
GetBucketAcl  
GetBucketLocation  
GetBucketLogging  
GetBucketNotification  
GetBucketPolicy  
GetBucketRequestPayment  
GetBucketVersioning  
GetLifecycleConfiguration  
GetObject  
GetObjectAccessControlPolicy  
GetObjectAcl  
GetObjectExtended  
GetObjectVersion  
GetObjectVersionAcl  
ListAllMyBuckets  
ListBucket  
ListBucketMultipartUploads  
ListBucketVersions  
ListMultipartUploadParts  
PutBucketAcl  
PutBucketLogging  
PutBucketNotification  
PutBucketPolicy  
PutBucketRequestPayment  
PutBucketVersioning  
PutLifecycleConfiguration  
PutObject  
PutObjectAcl  
PutObjectInline  
PutObjectVersionAcl  
SetBucketAccessControlPolicy  
SetObjectAccessControlPolicy

[EC2]  
ActivateLicense  
AllocateAddress  
AssociateAddress  
AssociateDhcpOptions  
AssociateRouteTable  
AttachInternetGateway  
AttachNetworkInterface  
AttachVolume  
AttachVpnGateway  
AuthorizeSecurityGroupEgress  
AuthorizeSecurityGroupIngress  
BundleInstance  
CancelBundleTask  
CancelConversionTask  
CancelSpotInstanceRequests  
ConfirmProductInstance  
CreateCustomerGateway  
CreateDhcpOptions  
CreateImage  
CreateInternetGateway  
CreateKeyPair  
CreateNetworkAcl  
CreateNetworkAclEntry  
CreateNetworkInterface  
CreatePlacementGroup  
CreateRoute  
CreateRouteTable  
CreateSecurityGroup  
CreateSnapshot  
CreateSpotDatafeedSubscription  
CreateSubnet  
CreateTags  
CreateVolume  
CreateVpc  
CreateVpnConnection  
CreateVpnGateway  
DeactivateLicense  
DeleteCustomerGateway  
DeleteDhcpOptions  
DeleteInternetGateway  
DeleteKeyPair  
DeleteNetworkAcl  
DeleteNetworkAclEntry  
DeleteNetworkInterface  
DeletePlacementGroup  
DeleteRoute  
DeleteRouteTable  
DeleteSecurityGroup  
DeleteSnapshot  
DeleteSpotDatafeedSubscription  
DeleteSubnet  
DeleteTags  
DeleteVolume  
DeleteVpc  
DeleteVpnConnection  
DeleteVpnGateway  
DeregisterImage  
DescribeAddresses  
DescribeAvailabilityZones  
DescribeBundleTasks  
DescribeConversionTasks  
DescribeCustomerGateways  
DescribeDhcpOptions  
DescribeImageAttribute  
DescribeImages  
DescribeInstanceAttribute  
DescribeInstanceStatus  
DescribeInstances  
DescribeInternetGateways  
DescribeKeyPairs  
DescribeLicenses  
DescribeNetworkAcls  
DescribeNetworkInterfaceAttribute  
DescribeNetworkInterfaces  
DescribePlacementGroups  
DescribeRegions  
DescribeReservedInstances  
DescribeReservedInstancesOfferings  
DescribeRouteTables  
DescribeSecurityGroups  
DescribeSnapshotAttribute  
DescribeSnapshots  
DescribeSpotDatafeedSubscription  
DescribeSpotInstanceRequests  
DescribeSpotPriceHistory  
DescribeSubnets  
DescribeTags  
DescribeVolumes  
DescribeVpcs  
DescribeVpnConnections  
DescribeVpnGateways  
DetachInternetGateway  
DetachNetworkInterface  
DetachVolume  
DetachVpnGateway  
DisassociateAddress  
DisassociateRouteTable  
GetConsoleOutput  
GetPasswordData  
ImportInstance  
ImportKeyPair  
ImportVolume  
ModifyImageAttribute  
ModifyInstanceAttribute  
ModifyNetworkInterfaceAttribute  
ModifySnapshotAttribute  
MonitorInstances  
PurchaseReservedInstancesOffering  
RebootInstances  
RegisterImage  
ReleaseAddress  
ReplaceNetworkAclAssociation  
ReplaceNetworkAclEntry  
ReplaceRoute  
ReplaceRouteTableAssociation  
ReportInstanceStatus  
RequestSpotInstances  
ResetImageAttribute  
ResetInstanceAttribute  
ResetNetworkInterfaceAttribute  
ResetSnapshotAttribute  
RevokeSecurityGroupEgress  
RevokeSecurityGroupIngress  
RunInstances  
StartInstances  
StopInstances  
TerminateInstances  
UnmonitorInstances

---

<div class="post-metadata">

**Author:** ![Alex\_Lambert\_2](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@Alex\_Lambert\_2](https://discuss.elastic.co/u/Alex_Lambert_2)\
**Post date:** [May 23, 2012, 3:58am UTC](https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815/2 "2012-05-23T03:58:29Z")

</div>

We are using this policy:

{

> "Statement": [  
> {  
> "Action": [  
> "s3:_"  
> ],  
> "Effect": "Allow",  
> "Resource": [  
> "arn:aws:s3:::BUCKETNAME",  
> "arn:aws:s3:::BUCKETNAME/_"  
> ]  
> }  
> ],  
> "Statement": [  
> {  
> "Effect": "Allow",  
> "Action": "EC2:Describe\*",  
> "Resource": "\*"  
> }  
> ]  
> }

Cheers,  
Alex

On Tuesday, May 22, 2012 7:13:32 PM UTC-4, Eric Jain wrote:

> Does anyone know the minimum set of permissions the cloud-aws plugin  
> requires to work? I'm trying to restrict from EC2:All + S3:All...
> 
> [S3]  
> AbortMultipartUpload  
> CopyObject  
> CreateBucket  
> DeleteBucket  
> DeleteObject  
> DeleteObjectVersion  
> GetBucketAccessControlPolicy  
> GetBucketAcl  
> GetBucketLocation  
> GetBucketLogging  
> GetBucketNotification  
> GetBucketPolicy  
> GetBucketRequestPayment  
> GetBucketVersioning  
> GetLifecycleConfiguration  
> GetObject  
> GetObjectAccessControlPolicy  
> GetObjectAcl  
> GetObjectExtended  
> GetObjectVersion  
> GetObjectVersionAcl  
> ListAllMyBuckets  
> ListBucket  
> ListBucketMultipartUploads  
> ListBucketVersions  
> ListMultipartUploadParts  
> PutBucketAcl  
> PutBucketLogging  
> PutBucketNotification  
> PutBucketPolicy  
> PutBucketRequestPayment  
> PutBucketVersioning  
> PutLifecycleConfiguration  
> PutObject  
> PutObjectAcl  
> PutObjectInline  
> PutObjectVersionAcl  
> SetBucketAccessControlPolicy  
> SetObjectAccessControlPolicy
> 
> [EC2]  
> ActivateLicense  
> AllocateAddress  
> AssociateAddress  
> AssociateDhcpOptions  
> AssociateRouteTable  
> AttachInternetGateway  
> AttachNetworkInterface  
> AttachVolume  
> AttachVpnGateway  
> AuthorizeSecurityGroupEgress  
> AuthorizeSecurityGroupIngress  
> BundleInstance  
> CancelBundleTask  
> CancelConversionTask  
> CancelSpotInstanceRequests  
> ConfirmProductInstance  
> CreateCustomerGateway  
> CreateDhcpOptions  
> CreateImage  
> CreateInternetGateway  
> CreateKeyPair  
> CreateNetworkAcl  
> CreateNetworkAclEntry  
> CreateNetworkInterface  
> CreatePlacementGroup  
> CreateRoute  
> CreateRouteTable  
> CreateSecurityGroup  
> CreateSnapshot  
> CreateSpotDatafeedSubscription  
> CreateSubnet  
> CreateTags  
> CreateVolume  
> CreateVpc  
> CreateVpnConnection  
> CreateVpnGateway  
> DeactivateLicense  
> DeleteCustomerGateway  
> DeleteDhcpOptions  
> DeleteInternetGateway  
> DeleteKeyPair  
> DeleteNetworkAcl  
> DeleteNetworkAclEntry  
> DeleteNetworkInterface  
> DeletePlacementGroup  
> DeleteRoute  
> DeleteRouteTable  
> DeleteSecurityGroup  
> DeleteSnapshot  
> DeleteSpotDatafeedSubscription  
> DeleteSubnet  
> DeleteTags  
> DeleteVolume  
> DeleteVpc  
> DeleteVpnConnection  
> DeleteVpnGateway  
> DeregisterImage  
> DescribeAddresses  
> DescribeAvailabilityZones  
> DescribeBundleTasks  
> DescribeConversionTasks  
> DescribeCustomerGateways  
> DescribeDhcpOptions  
> DescribeImageAttribute  
> DescribeImages  
> DescribeInstanceAttribute  
> DescribeInstanceStatus  
> DescribeInstances  
> DescribeInternetGateways  
> DescribeKeyPairs  
> DescribeLicenses  
> DescribeNetworkAcls  
> DescribeNetworkInterfaceAttribute  
> DescribeNetworkInterfaces  
> DescribePlacementGroups  
> DescribeRegions  
> DescribeReservedInstances  
> DescribeReservedInstancesOfferings  
> DescribeRouteTables  
> DescribeSecurityGroups  
> DescribeSnapshotAttribute  
> DescribeSnapshots  
> DescribeSpotDatafeedSubscription  
> DescribeSpotInstanceRequests  
> DescribeSpotPriceHistory  
> DescribeSubnets  
> DescribeTags  
> DescribeVolumes  
> DescribeVpcs  
> DescribeVpnConnections  
> DescribeVpnGateways  
> DetachInternetGateway  
> DetachNetworkInterface  
> DetachVolume  
> DetachVpnGateway  
> DisassociateAddress  
> DisassociateRouteTable  
> GetConsoleOutput  
> GetPasswordData  
> ImportInstance  
> ImportKeyPair  
> ImportVolume  
> ModifyImageAttribute  
> ModifyInstanceAttribute  
> ModifyNetworkInterfaceAttribute  
> ModifySnapshotAttribute  
> MonitorInstances  
> PurchaseReservedInstancesOffering  
> RebootInstances  
> RegisterImage  
> ReleaseAddress  
> ReplaceNetworkAclAssociation  
> ReplaceNetworkAclEntry  
> ReplaceRoute  
> ReplaceRouteTableAssociation  
> ReportInstanceStatus  
> RequestSpotInstances  
> ResetImageAttribute  
> ResetInstanceAttribute  
> ResetNetworkInterfaceAttribute  
> ResetSnapshotAttribute  
> RevokeSecurityGroupEgress  
> RevokeSecurityGroupIngress  
> RunInstances  
> StartInstances  
> StopInstances  
> TerminateInstances  
> UnmonitorInstances

---

<div class="post-metadata">

**Author:** ![Eric\_Jain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eric_jain/32/834_2.png) [@Eric\_Jain](https://discuss.elastic.co/u/Eric_Jain)\
**Post date:** [May 23, 2012, 6:19pm UTC](https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815/3 "2012-05-23T18:19:52Z")

</div>

Thanks--just what I was looking for.

On Tue, May 22, 2012 at 8:58 PM, Alex Lambert [alex@spindle.com](mailto:alex@spindle.com) wrote:

> We are using this policy:
> 
> > {  
> > "Statement": [  
> > {  
> > "Action": [  
> > "s3:_"  
> > ],  
> > "Effect": "Allow",  
> > "Resource": [  
> > "arn:aws:s3:::BUCKETNAME",  
> > "arn:aws:s3:::BUCKETNAME/_"  
> > ]  
> > }  
> > ],  
> > "Statement": [  
> > {  
> > "Effect": "Allow",  
> > "Action": "EC2:Describe\*",  
> > "Resource": "\*"  
> > }  
> > ]  
> > }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 3:27am UTC](https://discuss.elastic.co/t/iam-permissions-for-cloud-aws-plugin/7815/4 "2017-07-06T03:27:30Z")

</div>