AWS required permissions

Views:

Review the permissions required to deploy resources and the permissions granted when connecting AWS accounts to TrendAI Vision One™.

Note

If you specify an IamPermissionsBoundaryArn during stack deployment, the IAM policy associated with the ARN must include the minimum permissions required by the features you enable. The permissions boundary applies to IAM roles created for Cloud Detections for AWS CloudTrail (including Control Tower), Cloud Detections for Amazon Security Lake, and File Security Storage. Refer to the permissions listed below for each feature to ensure your boundary policy includes the required actions.

Review the required permissions for each feature:

AWS required permissions for Core Features
AWS required permissions for Agentless Vulnerability & Threat Detection
AWS required permissions for AI Application Security
AWS required permissions for Cloud Detections for Amazon Security Lake
AWS required permissions for Cloud Detections for AWS CloudTrail
AWS required permissions for Log Collection via Amazon S3
AWS required permissions for Cloud Detections for VPC Flow Logs
AWS required permissions for Cloud Response for AWS
AWS required permissions for Real-Time Posture Monitoring
AWS required permissions for Container Protection for Amazon ECS
AWS required permissions for Data Security Posture
AWS required permissions for File Security Storage
AWS required permissions for Server & Workload Protection

AWS required permissions for Core Features

Core Features

Description	Required permissions
These permissions are required to connect AWS cloud accounts to TrendAI Vision One™.	CloudFormation Operations: `cloudformation:CreateStack` `cloudformation:UpdateStack` `cloudformation:DescribeStacks` `cloudformation:DescribeStackResources` `cloudformation:DeleteStack` `cloudformation:ListStacks` `cloudformation:GetTemplateSummary` `cloudformation:TagResource` `cloudformation:UntagResource` CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation` IAM Role and Policy Management Actions: `iam:CreateRole` `iam:UpdateRole` `iam:DeleteRole` `iam:GetRole` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:DeleteRolePolicy` `iam:GetRolePolicy` `iam:PassRole` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:GetPolicyVersion` `iam:DeletePolicy` `iam:ListPolicyVersions` `iam:CreatePolicyVersion` `iam:DeletePolicyVersion` `iam:SetDefaultPolicyVersion` `iam:ListRoleTags` `iam:ListPolicyTags` IAM OIDC Provider Actions: `iam:CreateOpenIDConnectProvider` `iam:GetOpenIDConnectProvider` `iam:ListOpenIDConnectProviders` `iam:UpdateOpenIDConnectProviderThumbprint` `iam:AddClientIDToOpenIDConnectProvider` `iam:RemoveClientIDFromOpenIDConnectProvider` `iam:TagOpenIDConnectProvider` `iam:UntagOpenIDConnectProvider` `iam:DeleteOpenIDConnectProvider` IAM Simulation Actions: `iam:SimulatePrincipalPolicy` EC2 Actions: `ec2:DescribeRegions` Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:InvokeFunction` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:CreateLogStream` `logs:DeleteLogStream` `logs:PutLogEvents` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource` S3 Actions: `s3:GetObject`

Description

Required permissions

These permissions are required to connect AWS cloud accounts to TrendAI Vision One™.

CloudFormation Operations:

cloudformation:CreateStack
cloudformation:UpdateStack
cloudformation:DescribeStacks
cloudformation:DescribeStackResources
cloudformation:DeleteStack
cloudformation:ListStacks
cloudformation:GetTemplateSummary
cloudformation:TagResource
cloudformation:UntagResource

CloudFormation StackSet Operations:

cloudformation:CreateStackSet
cloudformation:UpdateStackSet
cloudformation:DeleteStackSet
cloudformation:CreateStackInstances
cloudformation:UpdateStackInstances
cloudformation:DeleteStackInstances
cloudformation:DescribeStackSet
cloudformation:DescribeStackSetOperation
cloudformation:DescribeStackInstance
cloudformation:ListStackInstances
cloudformation:ListStackSetOperations
cloudformation:ListStackSetOperationResults
cloudformation:StopStackSetOperation

IAM Role and Policy Management Actions:

iam:CreateRole
iam:UpdateRole
iam:DeleteRole
iam:GetRole
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:DeleteRolePolicy
iam:GetRolePolicy
iam:PassRole
iam:TagRole
iam:UntagRole
iam:CreatePolicy
iam:GetPolicy
iam:GetPolicyVersion
iam:DeletePolicy
iam:ListPolicyVersions
iam:CreatePolicyVersion
iam:DeletePolicyVersion
iam:SetDefaultPolicyVersion
iam:ListRoleTags
iam:ListPolicyTags

IAM OIDC Provider Actions:

iam:CreateOpenIDConnectProvider
iam:GetOpenIDConnectProvider
iam:ListOpenIDConnectProviders
iam:UpdateOpenIDConnectProviderThumbprint
iam:AddClientIDToOpenIDConnectProvider
iam:RemoveClientIDFromOpenIDConnectProvider
iam:TagOpenIDConnectProvider
iam:UntagOpenIDConnectProvider
iam:DeleteOpenIDConnectProvider

IAM Simulation Actions:

iam:SimulatePrincipalPolicy

EC2 Actions:

ec2:DescribeRegions

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:InvokeFunction
lambda:ListTags
lambda:TagResource
lambda:UntagResource

CloudWatch Logs Management Actions:

logs:CreateLogGroup
logs:DescribeLogGroups
logs:DeleteLogGroup
logs:CreateLogStream
logs:DeleteLogStream
logs:PutLogEvents
logs:PutRetentionPolicy
logs:DeleteRetentionPolicy
logs:ListTagsForResource
logs:TagResource
logs:UntagResource

S3 Actions:

s3:GetObject

AWS required permissions for Agentless Vulnerability & Threat Detection

Agentless Vulnerability & Threat Detection

Description	Required permissions
Agentless Vulnerability & Threat Detection is a serverless function enabled in your connected cloud accounts. The function scans supported cloud resources for vulnerabilities and malware without impact to other resources or running applications.	SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue`
	S3 Bucket Management Actions: `s3:CreateBucket` `s3:PutBucketPolicy` `s3:PutBucketVersioning` `s3:PutBucketNotification` `s3:GetBucketNotification` `s3:PutEncryptionConfiguration` `s3:GetEncryptionConfiguration` `s3:PutLifecycleConfiguration` `s3:GetLifecycleConfiguration` `s3:GetBucketPolicy` `s3:GetBucketVersioning` `s3:DeleteBucket` `s3:DeleteBucketPolicy` `s3:PutBucketTagging` `s3:GetBucketTagging` `s3:PutBucketPublicAccessBlock` `s3:GetBucketPublicAccessBlock`
	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:InvokeFunction` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource`
	Step Functions Actions: `states:CreateStateMachine` `states:UpdateStateMachine` `states:DescribeStateMachine` `states:DeleteStateMachine` `states:ListTagsForResource` `states:TagResource` `states:UntagResource`
	AppConfig Management Actions: `appconfig:CreateApplication` `appconfig:GetApplication` `appconfig:UpdateApplication` `appconfig:DeleteApplication` `appconfig:CreateEnvironment` `appconfig:GetEnvironment` `appconfig:UpdateEnvironment` `appconfig:DeleteEnvironment` `appconfig:CreateConfigurationProfile` `appconfig:GetConfigurationProfile` `appconfig:UpdateConfigurationProfile` `appconfig:DeleteConfigurationProfile` `appconfig:CreateHostedConfigurationVersion` `appconfig:GetHostedConfigurationVersion` `appconfig:DeleteHostedConfigurationVersion` `appconfig:CreateDeploymentStrategy` `appconfig:GetDeploymentStrategy` `appconfig:UpdateDeploymentStrategy` `appconfig:StartDeployment` `appconfig:GetDeployment` `appconfig:TagResource` `appconfig:UntagResource`
	EventBridge Scheduler Actions: `scheduler:CreateSchedule` `scheduler:UpdateSchedule` `scheduler:DeleteSchedule` `scheduler:GetSchedule` `scheduler:ListSchedules` `scheduler:CreateScheduleGroup` `scheduler:GetScheduleGroup` `scheduler:DeleteScheduleGroup` `scheduler:ListTagsForResource` `scheduler:TagResource` `scheduler:UntagResource`
	EC2 Actions: `ec2:CreateSnapshot` `ec2:DescribeSnapshots` `ec2:DescribeVolumes` `ec2:DescribeInstances` `ec2:DescribeImages` `ec2:DeleteSnapshot` `ec2:CreateTags` `ec2:DeleteTags`
	ECR Repository Actions: `ecr:CreateRepository` `ecr:DescribeRepositories` `ecr:DescribeRegistry` `ecr:DeleteRepository` `ecr:PutLifecyclePolicy` `ecr:GetLifecyclePolicy` `ecr:DeleteLifecyclePolicy` `ecr:SetRepositoryPolicy` `ecr:GetRepositoryPolicy` `ecr:DeleteRepositoryPolicy` `ecr:PutReplicationConfiguration` `ecr:ListTagsForResource` `ecr:TagResource` `ecr:UntagResource`
	CodeBuild Actions: `codebuild:CreateProject` `codebuild:UpdateProject` `codebuild:DeleteProject` `codebuild:BatchGetProjects` `codebuild:ListBuildsForProject`
	SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource`
	IAM Instance Profile Actions: `iam:CreateInstanceProfile` `iam:DeleteInstanceProfile` `iam:GetInstanceProfile` `iam:AddRoleToInstanceProfile` `iam:RemoveRoleFromInstanceProfile` `iam:ListInstanceProfileTags` `iam:TagInstanceProfile` `iam:UntagInstanceProfile`
	Secrets Manager Actions: `secretsmanager:CreateSecret` `secretsmanager:PutSecretValue` `secretsmanager:GetSecretValue` `secretsmanager:DescribeSecret` `secretsmanager:UpdateSecret` `secretsmanager:DeleteSecret` `secretsmanager:RotateSecret` `secretsmanager:CancelRotateSecret` `secretsmanager:ListSecretVersionIds` `secretsmanager:GetResourcePolicy` `secretsmanager:TagResource` `secretsmanager:UntagResource`
	EventBridge Rule Management Actions: `events:PutRule` `events:DescribeRule` `events:DeleteRule` `events:PutTargets` `events:ListTargetsByRule` `events:RemoveTargets` `events:ListTagsForResource` `events:TagResource` `events:UntagResource`
	IAM Role and Policy Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` `iam:CreatePolicyVersion` `iam:GetPolicyVersion` `iam:DeletePolicyVersion` `iam:ListPolicyVersions` `iam:SetDefaultPolicyVersion` `iam:ListPolicyTags`
	CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource`
	CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation`

AWS required permissions for AI Application Security

AI Application Security

Description	Required permissions
These permissions are required to enable deployment and operation of the AI Scanner and AI Guard capabilities. AI Scanner uses AWS Bedrock for serverless model invocation. AI Guard deploys a real-time detection engine using graphics processing unit (GPU)-accelerated Amazon Elastic Compute Cloud (EC2) instances running in AWS Elastic Container Service (ECS) clusters with autoscaling, load balancing, and virtual private cloud (VPC) networking.	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:InvokeFunction` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue` S3 Bucket Management Actions: `s3:CreateBucket` `s3:PutBucketPolicy` `s3:PutEncryptionConfiguration` `s3:GetBucketPolicy` `s3:GetEncryptionConfiguration` `s3:DeleteBucket` `s3:DeleteBucketPolicy` `s3:PutBucketTagging` `s3:GetBucketTagging` `s3:PutBucketPublicAccessBlock` `s3:GetBucketPublicAccessBlock` AppConfig Management Actions: `appconfig:CreateApplication` `appconfig:GetApplication` `appconfig:UpdateApplication` `appconfig:DeleteApplication` `appconfig:CreateEnvironment` `appconfig:GetEnvironment` `appconfig:UpdateEnvironment` `appconfig:DeleteEnvironment` `appconfig:CreateConfigurationProfile` `appconfig:GetConfigurationProfile` `appconfig:UpdateConfigurationProfile` `appconfig:DeleteConfigurationProfile` `appconfig:CreateHostedConfigurationVersion` `appconfig:GetHostedConfigurationVersion` `appconfig:DeleteHostedConfigurationVersion` `appconfig:CreateDeploymentStrategy` `appconfig:GetDeploymentStrategy` `appconfig:UpdateDeploymentStrategy` `appconfig:StartDeployment` `appconfig:GetDeployment` `appconfig:TagResource` `appconfig:UntagResource` Secrets Manager Actions: `secretsmanager:CreateSecret` `secretsmanager:PutSecretValue` `secretsmanager:GetSecretValue` `secretsmanager:DescribeSecret` `secretsmanager:UpdateSecret` `secretsmanager:DeleteSecret` `secretsmanager:RotateSecret` `secretsmanager:CancelRotateSecret` `secretsmanager:ListSecretVersionIds` `secretsmanager:GetResourcePolicy` `secretsmanager:TagResource` `secretsmanager:UntagResource` IAM Instance Profile Actions: `iam:CreateInstanceProfile` `iam:DeleteInstanceProfile` `iam:GetInstanceProfile` `iam:AddRoleToInstanceProfile` `iam:RemoveRoleFromInstanceProfile` `iam:ListInstanceProfileTags` `iam:TagInstanceProfile` `iam:UntagInstanceProfile` SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource` IAM Role and Policy Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` `iam:CreatePolicyVersion` `iam:GetPolicyVersion` `iam:DeletePolicyVersion` `iam:ListPolicyVersions` `iam:SetDefaultPolicyVersion` `iam:ListPolicyTags` CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource` CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation`

Description

Required permissions

These permissions are required to enable deployment and operation of the AI Scanner and AI Guard capabilities.

AI Scanner uses AWS Bedrock for serverless model invocation.
AI Guard deploys a real-time detection engine using graphics processing unit (GPU)-accelerated Amazon Elastic Compute Cloud (EC2) instances running in AWS Elastic Container Service (ECS) clusters with autoscaling, load balancing, and virtual private cloud (VPC) networking.

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:InvokeFunction
lambda:ListTags
lambda:TagResource
lambda:UntagResource

SQS Queue Management Actions:

sqs:CreateQueue
sqs:SetQueueAttributes
sqs:GetQueueAttributes
sqs:GetQueueUrl
sqs:ListQueueTags
sqs:DeleteQueue
sqs:TagQueue
sqs:UntagQueue

S3 Bucket Management Actions:

s3:CreateBucket
s3:PutBucketPolicy
s3:PutEncryptionConfiguration
s3:GetBucketPolicy
s3:GetEncryptionConfiguration
s3:DeleteBucket
s3:DeleteBucketPolicy
s3:PutBucketTagging
s3:GetBucketTagging
s3:PutBucketPublicAccessBlock
s3:GetBucketPublicAccessBlock

AppConfig Management Actions:

appconfig:CreateApplication
appconfig:GetApplication
appconfig:UpdateApplication
appconfig:DeleteApplication
appconfig:CreateEnvironment
appconfig:GetEnvironment
appconfig:UpdateEnvironment
appconfig:DeleteEnvironment
appconfig:CreateConfigurationProfile
appconfig:GetConfigurationProfile
appconfig:UpdateConfigurationProfile
appconfig:DeleteConfigurationProfile
appconfig:CreateHostedConfigurationVersion
appconfig:GetHostedConfigurationVersion
appconfig:DeleteHostedConfigurationVersion
appconfig:CreateDeploymentStrategy
appconfig:GetDeploymentStrategy
appconfig:UpdateDeploymentStrategy
appconfig:StartDeployment
appconfig:GetDeployment
appconfig:TagResource
appconfig:UntagResource

Secrets Manager Actions:

secretsmanager:CreateSecret
secretsmanager:PutSecretValue
secretsmanager:GetSecretValue
secretsmanager:DescribeSecret
secretsmanager:UpdateSecret
secretsmanager:DeleteSecret
secretsmanager:RotateSecret
secretsmanager:CancelRotateSecret
secretsmanager:ListSecretVersionIds
secretsmanager:GetResourcePolicy
secretsmanager:TagResource
secretsmanager:UntagResource

IAM Instance Profile Actions:

iam:CreateInstanceProfile
iam:DeleteInstanceProfile
iam:GetInstanceProfile
iam:AddRoleToInstanceProfile
iam:RemoveRoleFromInstanceProfile
iam:ListInstanceProfileTags
iam:TagInstanceProfile
iam:UntagInstanceProfile

SSM Parameter Actions:

ssm:PutParameter
ssm:GetParameter
ssm:GetParameters
ssm:DeleteParameter
ssm:AddTagsToResource
ssm:RemoveTagsFromResource
ssm:ListTagsForResource

IAM Role and Policy Management Actions:

iam:CreateRole
iam:GetRole
iam:UpdateRole
iam:DeleteRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:GetRolePolicy
iam:DeleteRolePolicy
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:ListRoleTags
iam:TagRole
iam:UntagRole
iam:CreatePolicy
iam:GetPolicy
iam:DeletePolicy
iam:CreatePolicyVersion
iam:GetPolicyVersion
iam:DeletePolicyVersion
iam:ListPolicyVersions
iam:SetDefaultPolicyVersion
iam:ListPolicyTags

CloudWatch Logs Management Actions:

logs:CreateLogGroup
logs:DescribeLogGroups
logs:DeleteLogGroup
logs:PutRetentionPolicy
logs:DeleteRetentionPolicy
logs:ListTagsForResource
logs:TagResource
logs:UntagResource

CloudFormation StackSet Operations:

cloudformation:CreateStackSet
cloudformation:UpdateStackSet
cloudformation:DeleteStackSet
cloudformation:CreateStackInstances
cloudformation:UpdateStackInstances
cloudformation:DeleteStackInstances
cloudformation:DescribeStackSet
cloudformation:DescribeStackSetOperation
cloudformation:DescribeStackInstance
cloudformation:ListStackInstances
cloudformation:ListStackSetOperations
cloudformation:ListStackSetOperationResults
cloudformation:StopStackSetOperation

AWS required permissions for Cloud Detections for Amazon Security Lake

Cloud Detections for Amazon Security Lake

Description	Required permissions
These permissions enable Security Lake to forward and analyze logs, providing insights into user actions and resource activities in the AWS account.	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:PutFunctionConcurrency` `lambda:GetFunctionConcurrency` `lambda:DeleteFunctionConcurrency` `lambda:CreateEventSourceMapping` `lambda:UpdateEventSourceMapping` `lambda:DeleteEventSourceMapping` `lambda:GetEventSourceMapping` `lambda:GetFunctionConfiguration` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation` SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue` IAM Role Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole`

Description

Required permissions

These permissions enable Security Lake to forward and analyze logs, providing insights into user actions and resource activities in the AWS account.

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:PutFunctionConcurrency
lambda:GetFunctionConcurrency
lambda:DeleteFunctionConcurrency
lambda:CreateEventSourceMapping
lambda:UpdateEventSourceMapping
lambda:DeleteEventSourceMapping
lambda:GetEventSourceMapping
lambda:GetFunctionConfiguration
lambda:ListTags
lambda:TagResource
lambda:UntagResource

CloudFormation StackSet Operations:

cloudformation:CreateStackSet
cloudformation:UpdateStackSet
cloudformation:DeleteStackSet
cloudformation:CreateStackInstances
cloudformation:UpdateStackInstances
cloudformation:DeleteStackInstances
cloudformation:DescribeStackSet
cloudformation:DescribeStackSetOperation
cloudformation:DescribeStackInstance
cloudformation:ListStackInstances
cloudformation:ListStackSetOperations
cloudformation:ListStackSetOperationResults
cloudformation:StopStackSetOperation

SQS Queue Management Actions:

sqs:CreateQueue
sqs:SetQueueAttributes
sqs:GetQueueAttributes
sqs:GetQueueUrl
sqs:ListQueueTags
sqs:DeleteQueue
sqs:TagQueue
sqs:UntagQueue

IAM Role Management Actions:

iam:CreateRole
iam:GetRole
iam:UpdateRole
iam:DeleteRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:GetRolePolicy
iam:DeleteRolePolicy
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:ListRoleTags
iam:TagRole
iam:UntagRole

AWS required permissions for Cloud Detections for AWS CloudTrail

Cloud Detections for AWS CloudTrail

Description	Required permissions
Collect CloudTrail files in an S3 bucket and forward them to gain insights into user actions and resource activities within this AWS account.	SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue` Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` `lambda:CreateEventSourceMapping` `lambda:UpdateEventSourceMapping` `lambda:DeleteEventSourceMapping` `lambda:GetEventSourceMapping` EventBridge Rule Management Actions: `events:PutRule` `events:DescribeRule` `events:DeleteRule` `events:PutTargets` `events:ListTargetsByRule` `events:RemoveTargets` `events:ListTagsForResource` `events:TagResource` `events:UntagResource` Secrets Manager Actions: `secretsmanager:CreateSecret` `secretsmanager:PutSecretValue` `secretsmanager:GetSecretValue` `secretsmanager:DescribeSecret` `secretsmanager:UpdateSecret` `secretsmanager:DeleteSecret` `secretsmanager:ListSecretVersionIds` `secretsmanager:GetResourcePolicy` `secretsmanager:TagResource` `secretsmanager:UntagResource` SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource` IAM Role Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource`

Description

Required permissions

Collect CloudTrail files in an S3 bucket and forward them to gain insights into user actions and resource activities within this AWS account.

SQS Queue Management Actions:

sqs:CreateQueue
sqs:SetQueueAttributes
sqs:GetQueueAttributes
sqs:GetQueueUrl
sqs:ListQueueTags
sqs:DeleteQueue
sqs:TagQueue
sqs:UntagQueue

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:ListTags
lambda:TagResource
lambda:UntagResource
lambda:CreateEventSourceMapping
lambda:UpdateEventSourceMapping
lambda:DeleteEventSourceMapping
lambda:GetEventSourceMapping

EventBridge Rule Management Actions:

events:PutRule
events:DescribeRule
events:DeleteRule
events:PutTargets
events:ListTargetsByRule
events:RemoveTargets
events:ListTagsForResource
events:TagResource
events:UntagResource

Secrets Manager Actions:

secretsmanager:CreateSecret
secretsmanager:PutSecretValue
secretsmanager:GetSecretValue
secretsmanager:DescribeSecret
secretsmanager:UpdateSecret
secretsmanager:DeleteSecret
secretsmanager:ListSecretVersionIds
secretsmanager:GetResourcePolicy
secretsmanager:TagResource
secretsmanager:UntagResource

SSM Parameter Actions:

ssm:PutParameter
ssm:GetParameter
ssm:GetParameters
ssm:DeleteParameter
ssm:AddTagsToResource
ssm:RemoveTagsFromResource
ssm:ListTagsForResource

IAM Role Management Actions:

iam:CreateRole
iam:GetRole
iam:UpdateRole
iam:DeleteRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:GetRolePolicy
iam:DeleteRolePolicy
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:ListRoleTags
iam:TagRole
iam:UntagRole
iam:CreatePolicy
iam:GetPolicy
iam:DeletePolicy

CloudWatch Logs Management Actions:

logs:CreateLogGroup
logs:DescribeLogGroups
logs:DeleteLogGroup
logs:PutRetentionPolicy
logs:DeleteRetentionPolicy
logs:ListTagsForResource
logs:TagResource
logs:UntagResource

AWS required permissions for Cloud Detections for VPC Flow Logs

Cloud Detections for VPC Flow Logs

Description	Required permissions
AWS VPC Flow Logs integration allows TrendAI Vision One™ to access and monitor your AWS VPC Flow Logs to detected potential threats.	S3 Bucket Management Actions: `s3:CreateBucket` `s3:PutBucketPolicy` `s3:PutBucketVersioning` `s3:PutEncryptionConfiguration` `s3:GetEncryptionConfiguration` `s3:PutLifecycleConfiguration` `s3:GetLifecycleConfiguration` `s3:GetBucketPolicy` `s3:GetBucketVersioning` `s3:DeleteBucket` `s3:DeleteBucketPolicy` `s3:PutBucketTagging` `s3:GetBucketTagging` `s3:PutBucketPublicAccessBlock` `s3:GetBucketPublicAccessBlock`
	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:InvokeFunction` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource`
	SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue`
	EventBridge Scheduler Actions: `scheduler:CreateSchedule` `scheduler:UpdateSchedule` `scheduler:DeleteSchedule` `scheduler:GetSchedule` `scheduler:ListSchedules` `scheduler:CreateScheduleGroup` `scheduler:GetScheduleGroup` `scheduler:DeleteScheduleGroup` `scheduler:ListTagsForResource` `scheduler:TagResource` `scheduler:UntagResource`
	EventBridge Rule Management Actions: `events:PutRule` `events:DescribeRule` `events:DeleteRule` `events:PutTargets` `events:ListTargetsByRule` `events:RemoveTargets` `events:ListTagsForResource` `events:TagResource` `events:UntagResource`
	SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource`
	IAM Instance Profile Actions: `iam:CreateInstanceProfile` `iam:DeleteInstanceProfile` `iam:GetInstanceProfile` `iam:AddRoleToInstanceProfile` `iam:RemoveRoleFromInstanceProfile` `iam:ListInstanceProfileTags` `iam:TagInstanceProfile` `iam:UntagInstanceProfile`
	Secrets Manager Actions: `secretsmanager:CreateSecret` `secretsmanager:PutSecretValue` `secretsmanager:GetSecretValue` `secretsmanager:DescribeSecret` `secretsmanager:UpdateSecret` `secretsmanager:DeleteSecret` `secretsmanager:RotateSecret` `secretsmanager:CancelRotateSecret` `secretsmanager:ListSecretVersionIds` `secretsmanager:GetResourcePolicy` `secretsmanager:TagResource` `secretsmanager:UntagResource`
	IAM Role and Policy Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` `iam:CreatePolicyVersion` `iam:GetPolicyVersion` `iam:DeletePolicyVersion` `iam:ListPolicyVersions` `iam:SetDefaultPolicyVersion` `iam:ListPolicyTags`
	CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource`
	CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation`

AWS required permissions for Cloud Response for AWS

Cloud Response for AWS

Description

Required permissions

Cloud Response for AWS these permissions to take response actions to contain incidents within your cloud account, such as revoking access for suspicious IAM users.

Note

These permissions are also required by Core Features.

iam:GetPolicy
iam:AttachGroupPolicy
iam:AttachUserPolicy
iam:AttachRolePolicy
iam:CreatePolicy

AWS required permissions for Container Protection for Amazon ECS

Container Protection for Amazon ECS

Description	Required permissions
These permissions are required by Container Security to deploy and configure Container Protection for Amazon ECS, including the ECS clusters, services, and container repositories it depends on. For information on the runtime and response permissions granted to the Container Security integration once deployed, see Container response actions (Isolate/Resume, Terminate).	S3 Bucket Management Actions: `s3:CreateBucket` `s3:PutBucketPolicy` `s3:PutBucketVersioning` `s3:PutEncryptionConfiguration` `s3:PutBucketPublicAccessBlock` `s3:GetBucketPolicy` `s3:GetBucketVersioning` `s3:GetEncryptionConfiguration` `s3:GetBucketPublicAccessBlock` `s3:PutLifecycleConfiguration` `s3:GetLifecycleConfiguration` `s3:PutBucketTagging` `s3:GetBucketTagging` `s3:DeleteBucket` `s3:DeleteBucketPolicy`
	ECS Cluster and Service Actions: `ecs:CreateCluster` `ecs:UpdateCluster` `ecs:DeleteCluster` `ecs:DescribeClusters` `ecs:RegisterTaskDefinition` `ecs:DeregisterTaskDefinition` `ecs:DescribeTaskDefinition` `ecs:CreateService` `ecs:UpdateService` `ecs:DeleteService` `ecs:DescribeServices` `ecs:TagResource` `ecs:UntagResource`
	SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue`
	ECR Repository Actions: `ecr:CreateRepository` `ecr:DescribeRepositories` `ecr:DescribeRegistry` `ecr:DeleteRepository` `ecr:PutLifecyclePolicy` `ecr:GetLifecyclePolicy` `ecr:DeleteLifecyclePolicy` `ecr:SetRepositoryPolicy` `ecr:GetRepositoryPolicy` `ecr:DeleteRepositoryPolicy` `ecr:PutReplicationConfiguration` `ecr:ListTagsForResource` `ecr:TagResource` `ecr:UntagResource`
	IAM Role and Policy Management Actions: `iam:CreateRole` `iam:UpdateRole` `iam:DeleteRole` `iam:GetRole` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:DeleteRolePolicy` `iam:GetRolePolicy` `iam:PassRole` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` `iam:CreatePolicyVersion` `iam:GetPolicyVersion` `iam:DeletePolicyVersion` `iam:ListPolicyVersions` `iam:SetDefaultPolicyVersion` `iam:ListPolicyTags`
	CloudWatch Logs Management Actions: `logs:CreateLogGroup` `logs:DescribeLogGroups` `logs:DeleteLogGroup` `logs:PutRetentionPolicy` `logs:DeleteRetentionPolicy` `logs:ListTagsForResource` `logs:TagResource` `logs:UntagResource`
	CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation`
	SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource`
	CodeBuild Actions: `codebuild:CreateProject` `codebuild:UpdateProject` `codebuild:DeleteProject` `codebuild:BatchGetProjects` `codebuild:ListBuildsForProject`
	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:InvokeFunction` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource`
	Secrets Manager Actions: `secretsmanager:CreateSecret` `secretsmanager:PutSecretValue` `secretsmanager:GetSecretValue` `secretsmanager:DescribeSecret` `secretsmanager:UpdateSecret` `secretsmanager:DeleteSecret` `secretsmanager:RotateSecret` `secretsmanager:CancelRotateSecret` `secretsmanager:ListSecretVersionIds` `secretsmanager:GetResourcePolicy` `secretsmanager:TagResource` `secretsmanager:UntagResource`

AWS required permissions for Data Security Posture

Data Security Posture

Description	Required permissions
These permissions are required by Data Security Posture to monitor your AWS cloud assets for sensitive data.	CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation` Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` S3 Bucket Management Actions: `s3:CreateBucket` `s3:PutBucketPolicy` `s3:PutBucketVersioning` `s3:PutEncryptionConfiguration` `s3:GetEncryptionConfiguration` `s3:GetBucketPolicy` `s3:GetBucketVersioning` `s3:DeleteBucket` `s3:DeleteBucketPolicy` `s3:PutBucketTagging` `s3:GetBucketTagging` `s3:PutBucketPublicAccessBlock` `s3:GetBucketPublicAccessBlock` SSM Parameter Actions: `ssm:PutParameter` `ssm:GetParameter` `ssm:GetParameters` `ssm:DeleteParameter` `ssm:AddTagsToResource` `ssm:RemoveTagsFromResource` `ssm:ListTagsForResource` Step Functions Actions: `states:CreateStateMachine` `states:UpdateStateMachine` `states:DescribeStateMachine` `states:DeleteStateMachine` `states:ListTagsForResource` `states:TagResource` `states:UntagResource` EventBridge Rule Management Actions: `events:PutRule` `events:DescribeRule` `events:DeleteRule` `events:PutTargets` `events:ListTargetsByRule` `events:RemoveTargets` `events:ListTagsForResource` `events:TagResource` `events:UntagResource` IAM Role Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole`

Description

Required permissions

These permissions are required by Data Security Posture to monitor your AWS cloud assets for sensitive data.

CloudFormation StackSet Operations:

cloudformation:CreateStackSet
cloudformation:UpdateStackSet
cloudformation:DeleteStackSet
cloudformation:CreateStackInstances
cloudformation:UpdateStackInstances
cloudformation:DeleteStackInstances
cloudformation:DescribeStackSet
cloudformation:DescribeStackSetOperation
cloudformation:DescribeStackInstance
cloudformation:ListStackInstances
cloudformation:ListStackSetOperations
cloudformation:ListStackSetOperationResults
cloudformation:StopStackSetOperation

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:ListTags
lambda:TagResource
lambda:UntagResource

S3 Bucket Management Actions:

s3:CreateBucket
s3:PutBucketPolicy
s3:PutBucketVersioning
s3:PutEncryptionConfiguration
s3:GetEncryptionConfiguration
s3:GetBucketPolicy
s3:GetBucketVersioning
s3:DeleteBucket
s3:DeleteBucketPolicy
s3:PutBucketTagging
s3:GetBucketTagging
s3:PutBucketPublicAccessBlock
s3:GetBucketPublicAccessBlock

SSM Parameter Actions:

ssm:PutParameter
ssm:GetParameter
ssm:GetParameters
ssm:DeleteParameter
ssm:AddTagsToResource
ssm:RemoveTagsFromResource
ssm:ListTagsForResource

Step Functions Actions:

states:CreateStateMachine
states:UpdateStateMachine
states:DescribeStateMachine
states:DeleteStateMachine
states:ListTagsForResource
states:TagResource
states:UntagResource

EventBridge Rule Management Actions:

events:PutRule
events:DescribeRule
events:DeleteRule
events:PutTargets
events:ListTargetsByRule
events:RemoveTargets
events:ListTagsForResource
events:TagResource
events:UntagResource

IAM Role Management Actions:

iam:CreateRole
iam:GetRole
iam:UpdateRole
iam:DeleteRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:GetRolePolicy
iam:DeleteRolePolicy
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:ListRoleTags
iam:TagRole
iam:UntagRole

AWS required permissions for File Security Storage

File Security Storage

Description

Required permissions

These permissions are required for File Security Storage to perform anti-malware scanning on files in cloud storage services.

When a user or program uploads a file to a designated cloud storage container, File Security Storage performs a scan.

Note

The scan is performed only on the added file, not on existing resources in the storage container.

S3 Bucket Management Actions:

s3:CreateBucket
s3:DeleteBucket
s3:GetObject
s3:PutBucketObjectLockConfiguration
s3:PutBucketTagging
s3:PutBucketVersioning
s3:PutEncryptionConfiguration

EC2 Actions (only when the scanner is deployed inside a VPC):

ec2:DescribeVpcs
ec2:DescribeSubnets
ec2:DescribeSecurityGroups

AWS required permissions for Log Collection via Amazon S3

Log Collection via Amazon S3

Description	Required permissions
Enable log collection from your Amazon S3 buckets to ingest third-party security logs into TrendAI Vision One™.	Lambda Function Management Actions: `lambda:CreateFunction` `lambda:UpdateFunctionCode` `lambda:UpdateFunctionConfiguration` `lambda:AddPermission` `lambda:RemovePermission` `lambda:DeleteFunction` `lambda:GetFunction` `lambda:GetFunctionConfiguration` `lambda:ListTags` `lambda:TagResource` `lambda:UntagResource` SQS Queue Management Actions: `sqs:CreateQueue` `sqs:SetQueueAttributes` `sqs:GetQueueAttributes` `sqs:GetQueueUrl` `sqs:ListQueueTags` `sqs:DeleteQueue` `sqs:TagQueue` `sqs:UntagQueue` S3 Bucket Actions: `s3:GetBucketNotification` `s3:PutBucketNotification` `s3:GetBucketPolicy` `s3:PutBucketPolicy`

Description

Required permissions

Enable log collection from your Amazon S3 buckets to ingest third-party security logs into TrendAI Vision One™.

Lambda Function Management Actions:

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:AddPermission
lambda:RemovePermission
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:ListTags
lambda:TagResource
lambda:UntagResource

SQS Queue Management Actions:

sqs:CreateQueue
sqs:SetQueueAttributes
sqs:GetQueueAttributes
sqs:GetQueueUrl
sqs:ListQueueTags
sqs:DeleteQueue
sqs:TagQueue
sqs:UntagQueue

S3 Bucket Actions:

s3:GetBucketNotification
s3:PutBucketNotification
s3:GetBucketPolicy
s3:PutBucketPolicy

AWS required permissions for Real-Time Posture Monitoring

Real-Time Posture Monitoring

Description	Required permissions
Monitors your AWS account for security-relevant configuration and IAM changes in real time, so new misconfigurations and compliance risks are surfaced as soon as they occur, helping you catch and respond to risky changes as they happen.	CloudFormation StackSet Operations: `cloudformation:CreateStackSet` `cloudformation:UpdateStackSet` `cloudformation:DeleteStackSet` `cloudformation:CreateStackInstances` `cloudformation:UpdateStackInstances` `cloudformation:DeleteStackInstances` `cloudformation:DescribeStackSet` `cloudformation:DescribeStackSetOperation` `cloudformation:DescribeStackInstance` `cloudformation:ListStackInstances` `cloudformation:ListStackSetOperations` `cloudformation:ListStackSetOperationResults` `cloudformation:StopStackSetOperation` EventBridge Rule Management Actions: `events:PutRule` `events:DescribeRule` `events:DeleteRule` `events:PutTargets` `events:ListTargetsByRule` `events:RemoveTargets` `events:ListTagsForResource` `events:TagResource` `events:UntagResource` IAM Role and Policy Management Actions: `iam:CreateRole` `iam:GetRole` `iam:UpdateRole` `iam:DeleteRole` `iam:PassRole` `iam:AttachRolePolicy` `iam:DetachRolePolicy` `iam:PutRolePolicy` `iam:GetRolePolicy` `iam:DeleteRolePolicy` `iam:ListAttachedRolePolicies` `iam:ListRolePolicies` `iam:ListRoleTags` `iam:TagRole` `iam:UntagRole` `iam:CreatePolicy` `iam:GetPolicy` `iam:DeletePolicy` `iam:CreatePolicyVersion` `iam:GetPolicyVersion` `iam:DeletePolicyVersion` `iam:ListPolicyVersions` `iam:SetDefaultPolicyVersion` `iam:ListPolicyTags`

Description

Required permissions

Monitors your AWS account for security-relevant configuration and IAM changes in real time, so new misconfigurations and compliance risks are surfaced as soon as they occur, helping you catch and respond to risky changes as they happen.

CloudFormation StackSet Operations:

cloudformation:CreateStackSet
cloudformation:UpdateStackSet
cloudformation:DeleteStackSet
cloudformation:CreateStackInstances
cloudformation:UpdateStackInstances
cloudformation:DeleteStackInstances
cloudformation:DescribeStackSet
cloudformation:DescribeStackSetOperation
cloudformation:DescribeStackInstance
cloudformation:ListStackInstances
cloudformation:ListStackSetOperations
cloudformation:ListStackSetOperationResults
cloudformation:StopStackSetOperation

EventBridge Rule Management Actions:

events:PutRule
events:DescribeRule
events:DeleteRule
events:PutTargets
events:ListTargetsByRule
events:RemoveTargets
events:ListTagsForResource
events:TagResource
events:UntagResource

IAM Role and Policy Management Actions:

iam:CreateRole
iam:GetRole
iam:UpdateRole
iam:DeleteRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:GetRolePolicy
iam:DeleteRolePolicy
iam:ListAttachedRolePolicies
iam:ListRolePolicies
iam:ListRoleTags
iam:TagRole
iam:UntagRole
iam:CreatePolicy
iam:GetPolicy
iam:DeletePolicy
iam:CreatePolicyVersion
iam:GetPolicyVersion
iam:DeletePolicyVersion
iam:ListPolicyVersions
iam:SetDefaultPolicyVersion
iam:ListPolicyTags

AWS required permissions for Server & Workload Protection

Server & Workload Protection

Description	Required permissions
These permissions are required to view Amazon AWS EC2 and Workspace instances in Server & Workload Protection. For more information, see Server & Workload Protection.	`ec2:DescribeImages` `ec2:DescribeInstances` `ec2:DescribeRegions` `ec2:DescribeSubnets` `ec2:DescribeTags` `ec2:DescribeVpcs` `ec2:DescribeAvailabilityZones` `ec2:DescribeSecurityGroups` `workspaces:DescribeWorkspaces` `workspaces:DescribeWorkspaceDirectories` `workspaces:DescribeWorkspaceBundles` `workspaces:DescribeTags` `iam:ListAccountAliases` `iam:GetRole` `iam:GetRolePolicy`

Comments (0)