CloudFix IAM Roles

Overview

This document outlines the IAM roles used by CloudFix, organized by their primary functions. Each role has specific permissions that enable CloudFix's cost optimization features.

Role Categories

1. Core Functionality Roles - Handle basic CloudFix operations

2. Finder Roles - Discover and analyze resources

3. Fixer Roles - Execute cost optimization changes

4. Helper Roles - Support auxiliary functions

5. Cleanup Roles - Manage resource deletion

Security Notes

1. All roles follow least-privilege principles

2. Account and resource-level permissions are used where possible (demo account number 12341231234 is used throughout this document).

3. Actions are limited to specific service areas

4. Changes require approval through defined workflows

Core Functionality Roles

1. cloudfix-athena-query-execution-role

Primary role for cost analysis and reporting.

Key Capabilities:

• Queries AWS Cost and Usage Reports via Athena

• Manages AWS Organizations data

• Controls CloudFormation stacks

• Handles Glue operations for data processing

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Action": "s3:*",

            "Resource": [

                "arn:aws:s3:::cloudfix-cur-123412341234",

                "arn:aws:s3:::cloudfix-cur-123412341234/*"

            ],

            "Effect": "Allow"

        },

        {

            "Action": [

                "cloudformation:DescribeStacks",

                "organizations:DescribeAccount",

                "organizations:DescribeOrganization",

                "organizations:ListAccounts",

                "organizations:ListAccountsForParent",

                "organizations:ListRoots",

                "organizations:DescribeOrganizationalUnit",

                "organizations:ListChildren"

            ],

            "Resource": "*",

            "Effect": "Allow"

        },

        {

            "Action": [

                "athena:StartQueryExecution",

                "athena:GetQueryExecution",

                "athena:GetQueryResults"

            ],

            "Resource": "arn:aws:athena:*:123412341234:workgroup/CloudFixWorkspace",

            "Effect": "Allow"

        },

        {

            "Action": [

                "cloudformation:CreateStackInstances",

                "cloudformation:DescribeStackSetOperation"

            ],

            "Resource": [

                "arn:aws:cloudformation:*:123412341234:stackset-target/*CloudFixOrgStackSet*",

                "arn:aws:cloudformation:*:123412341234:stackset/*CloudFixOrgStackSet*"

            ],

            "Effect": "Allow"

        },

        {

            "Action": [

                "cloudformation:CreateStackInstances"

            ],

            "Resource": [

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Role",

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Group",

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Policy",

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-CloudFormation-CustomResource",

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-S3-Bucket",

                "arn:aws:cloudformation:us-east-1::type/resource/AWS-Lambda-Function"

            ],

            "Effect": "Allow"

        },

        {

            "Action": "glue:*",

            "Resource": [

                "arn:aws:glue:us-east-1:123412341234:catalog",

                "arn:aws:glue:us-east-1:123412341234:database/cloudfixdb",

                "arn:aws:glue:us-east-1:123412341234:table/cloudfixdb/*",

                "arn:aws:glue:us-east-1:123412341234:userDefinedFunction/cloudfixdb/*"

            ],

            "Effect": "Allow"

        },

        {

            "Action": "ce:UpdateCostAllocationTagsStatus",

            "Resource": "*",

            "Effect": "Allow"

        }

    ]

}

2. CloudFix-prod-CURStack-CURLambdaExecutor

Manages Cost and Usage Report processing.

Key Functions:

• CloudWatch logging

• S3 bucket notifications

• Cost allocation tagging

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "logs:CreateLogGroup",

                "logs:CreateLogStream",

                "logs:PutLogEvents"

            ],

            "Resource": "*"

        },

        {

            "Effect": "Allow",

            "Action": [

                "s3:PutBucketNotification"

            ],

            "Resource": "arn:aws:s3:::cloudfix-cur-123412341234"

        },

        {

            "Effect": "Allow",

            "Action": [

                "ce:UpdateCostAllocationTagsStatus",

                "support:CreateCase"

            ],

            "Resource": "*"

        }

    ]

}

3. CloudFix-prod-CURStack-AWSCURCrawlerLambdaExecut

Controls Glue crawler operations for CUR data.

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "glue:StartCrawler"

            ],

            "Resource": "arn:aws:glue:us-east-1:123412341234:crawler/AWSCURCrawler-CloudFix-CUR"

        },

        {

            "Effect": "Allow",

            "Action": [

                "logs:CreateLogGroup",

                "logs:CreateLogStream",

                "logs:PutLogEvents"

            ],

            "Resource": "*"

        }

    ]

}

4. CloudFix-prod-CURStack-1S-AWSCURCrawlerComponentFun

Handles Glue processing of CUR data.

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "s3:GetObject",

                "s3:PutObject"

            ],

            "Resource": "arn:aws:s3:::cloudfix-cur-123412341234/cloudfix/CloudFix-CUR/CloudFix-CUR*"

        },

        {

            "Effect": "Allow",

            "Action": [

                "glue:*"

            ],

            "Resource": [

                "arn:aws:glue:us-east-1:123412341234:database/cloudfixdb",

                "arn:aws:glue:us-east-1:123412341234:table/cloudfixdb*",

                "arn:aws:glue:us-east-1:123412341234:catalog"

            ]

        },

        {

            "Effect": "Allow",

            "Action": [

                "s3:ListBucket",

                "s3:GetBucketAcl",

                "s3:GetBucketLocation"

            ],

            "Resource": "arn:aws:s3:::cloudfix-cur-123412341234"

        },

        {

            "Effect": "Allow",

            "Action": [

                "logs:CreateLogGroup",

                "logs:CreateLogStream",

                "logs:PutLogEvents"

            ],

            "Resource": "arn:aws:logs:*:*:/aws-glue/*"

        }

    ]

}

Finder Roles

cloudfix-finder-role

Discovers optimization opportunities across AWS services.

Key Capabilities:

• Resource metadata collection

• Configuration analysis

• Usage metrics gathering

• Cost optimization identification

{

    "Effect": "Allow",

    "Action": [

        "application-autoscaling:DescribeScalableTargets",

        "autoscaling:DescribeAutoScalingGroups",

        "ce:GetReservationPurchaseRecommendation",

        "cloudfront:GetCachePolicy",

        "cloudfront:GetDistributionConfig",

        "cloudfront:ListTagsForResource",

        "cloudtrail:DescribeTrails",

        "cloudtrail:GetEventSelectors",

        "cloudtrail:GetInsightSelectors",

        "cloudtrail:GetTrailStatus",

        "cloudtrail:listTags",

        "cloudtrail:ListTrails",

        "cloudtrail:LookupEvents",

        "cloudwatch:GetMetricData",

        "cloudwatch:GetMetricStatistics",

        "cloudwatch:ListMetrics",

        "compute-optimizer:GetAutoScalingGroupRecommendations",

        "compute-optimizer:GetEC2InstanceRecommendations",

        "compute-optimizer:GetEC2RecommendationProjectedMetrics",

        "compute-optimizer:GetECSServiceRecommendations",

        "compute-optimizer:GetEnrollmentStatus",

        "compute-optimizer:GetLicenseRecommendations",

        "compute-optimizer:GetRDSRecommendationProjectedMetrics",

        "dms:DescribeReplicationInstances",

        "dms:DescribeReplicationTasks",

        "dms:ListTagsForResource",

        "dynamodb:DescribeTable",

        "dynamodb:ListTagsOfResource",

        "ebs:ListChangedBlocks",

        "ebs:ListSnapshotBlocks",

        "ec2:CreateTags",

        "ec2:DeleteTags",

        "ec2:DescribeAddresses",

        "ec2:DescribeAddressesAttribute",

        "ec2:DescribeFastSnapshotRestores",

        "ec2:DescribeImages",

        "ec2:DescribeInstanceAttribute",

        "ec2:DescribeInstances",

        "ec2:DescribeInstanceStatus",

        "ec2:DescribeInstanceTypes",

        "ec2:DescribeNatGateWays",

        "ec2:DescribeNatGateways",

        "ec2:DescribeRegions",

        "ec2:DescribeReservedInstances",

        "ec2:DescribeRouteTables",

        "ec2:DescribeSnapshotAttribute",

        "ec2:DescribeSnapshots",

        "ec2:DescribeSpotPriceHistory",

        "ec2:DescribeSubnets",

        "ec2:DescribeTags",

        "ec2:DescribeVolumes",

        "ec2:DescribeVpcAttribute",

        "ec2:DescribeVpcEndpoints",

        "ec2:DescribeVpcs",

        "ec2:GetLaunchTemplateData",

        "ecs:DescribeCapacityProviders",

        "ecs:DescribeClusters",

        "ecs:DescribeServices",

        "ecs:DescribeTaskDefinition",

        "ecs:DescribeTasks",

        "ecs:ListClusters",

        "ecs:ListContainerInstances",

        "ecs:ListServices",

        "ecs:ListTagsForResource",

        "ecs:ListTasks",

        "eks:DescribeCluster",

        "eks:ListClusters",

        "eks:ListTagsForResource",

        "elasticache:DescribeCacheClusters",

        "elasticache:ListTagsForResource",

        "elasticfilesystem:DescribeFileSystems",

        "elasticfilesystem:DescribeLifecycleConfiguration",

        "elasticfilesystem:ListTagsForResource",

        "elasticloadbalancing:DescribeLoadBalancers",

        "elasticloadbalancing:DescribeTags",

        "elasticmapreduce:DescribeCluster",

        "elasticmapreduce:GetManagedScalingPolicy",

        "elasticmapreduce:ListClusters",

        "elasticmapreduce:ListInstanceGroups",

        "elasticmapreduce:ListInstances",

        "emr:DescribeCluster",

        "es:DescribeDomain",

        "es:DescribeDomainChangeProgress",

        "es:DescribeDomains",

        "es:ListTags",

        "iam:GetInstanceProfile",

        "iam:ListAttachedRolePolicies",

        "iam:ListInstanceProfilesForRole",

        "kendra:DescribeDataSource",

        "kendra:DescribeIndex",

        "kendra:ListDataSources",

        "kendra:ListTagsForResource",

        "lambda:GetFunction",

        "logs:DescribeLogGroups",

        "logs:GetQueryResults",

        "logs:ListTagsForResource",

        "logs:StartQuery",

        "pricing:GetProducts",

        "quicksight:ListTagsForResource",

        "quicksight:ListUsers",

        "quicksight:SearchAnalyses",

        "quicksight:SearchDashboards",

        "quicksight:SearchDataSets",

        "quicksight:SearchDataSources",

        "rds:DescribeDBClusters",

        "rds:DescribeDBInstances",

        "rds:DescribeOrderableDBInstanceOptions",

        "rds:ListTagsForResource",

        "route53:ListHostedZones",

        "route53:ListResourceRecordSets",

        "s3:GetBucketTagging",

        "s3:GetLifecycleConfiguration",

        "s3:ListAllMyBuckets",

        "sagemaker:DescribeEndpoint",

        "sagemaker:DescribeEndpointConfig",

        "sagemaker:DescribeTransformJob",

        "sagemaker:ListApps",

        "sagemaker:ListEndpointConfigs",

        "sagemaker:ListEndpoints",

        "sagemaker:ListModels",

        "sagemaker:ListNotebookInstances",

        "sagemaker:ListProcessingJobs",

        "sagemaker:ListTrainingJobs",

        "sagemaker:ListTransformJobs",

        "servicequotas:GetServiceQuota",

        "ssm:DescribeAssociation",

        "ssm:ListAssociations",

        "ssm:ListTagsForResource",

        "tag:TagResources"

    ],

    "Resource": "*"

}

Fixer Roles

CloudFix fixer roles execute cost optimization changes. All fixers can be enabled or disabled centrally through the CloudFix control panel.

Global Safeguards

• Central Control: Each fixer can be individually enabled/disabled

• Approval Required: All changes need explicit approval before execution

• Rollback Plans: Each fixer includes rollback procedures

• Change Windows: Fixes only run during approved maintenance windows

• Resource Locking: Prevents concurrent modifications to resources

• Audit Trails: All actions are logged and traceable

1. cloudfix-ssm-update-role

Executes approved optimization tasks.

Key Functions:

• Manages SSM automation

• Controls resource tagging

• Handles SNS notifications

• Executes approved runbooks

Safety Features:

• Validates resource state before changes

• Checks dependencies

• Confirms resource availability

• Verifies permissions before execution

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": "iam:PassRole",

            "Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"

        },

        {

            "Effect": "Allow",

            "Action": [

                "ssm:CreateDocument",

                "ssm:GetDocument",

                "ssm:UpdateDocument",

                "ssm:UpdateDocumentMetadata",

                "ssm:DescribeDocument",

                "ssm:ListDocumentVersions",

                "ssm:StartChangeRequestExecution",

                "ssm:DeleteDocument",

                "ssm:ListDocuments",

                "ssm:UpdateDocumentDefaultVersion",

                "ssm:GetAutomationExecution",

                "ssm:GetOpsItem",

                "ssm:DescribeOpsItems",

                "ssm:ListOpsItemEvents",

                "ssm:UpdateOpsItem",

                "ssm:StartAutomationExecution",

                "ssm:StopAutomationExecution",

                "ssm:SendAutomationSignal",

                "ssm:DescribeAutomationStepExecutions",

                "ssm:DescribeAutomationExecutions",

                "ssm:AddTagsToResource",

                "iam:ListRoles",

                "iam:ListUsers",

                "iam:ListGroups",

                "iam:GetGroup",

                "iam:CreateServiceLinkedRole",

                "ssm:GetOpsSummary",

                "ssm:GetOpsMetadata",

                "sns:CreateTopic",

                "sns:ConfirmSubscription",

                "ssm:UpdateServiceSetting",

                "ssm:GetServiceSetting",

                "autoscaling:CreateOrUpdateTags",

                "backup:TagResource",

                "cloudfront:TagResource",

                "dlm:TagResource",

                "dynamodb:TagResource",

                "ec2:CreateTags",

                "elasticfilesystem:CreateTags",

                "rds:AddTagsToResource",

                "elasticfilesystem:TagResource",

                "es:AddTags",

                "s3:PutBucketTagging",

                "tag:TagResources"

            ],

            "Resource": "*"

        },

        {

            "Effect": "Allow",

            "Action": "s3:GetObject",

            "Resource": "arn:aws:s3:::cloudfix-runbook-bucket-zip/*"

        }

    ]

}

2. cloudfix-ssm-assumed-role

Performs actual resource modifications through Systems Manager.

Security Features:

• Requires runbook approval from authorized approvers

• Validates customer subscriptions and entitlements

• Limited to authorized changes within scope

• Respects resource tagging policies

• Enforces rate limiting on changes

• Maintains detailed audit logs

Operational Controls:

• Checks resource health before changes

• Validates backup existence where needed

• Tests rollback procedures

• Monitors service quotas

• Respects maintenance windows

• Enforces cool-down periods between changes

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": "sts:AssumeRole",

            "Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"

        },

        {

            "Effect": "Allow",

            "Action": "iam:PassRole",

            "Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"

        },

        {

            "Effect": "Allow",

            "Action": [

                "cloudfront:CreateCachePolicy",

                "cloudfront:GetCachePolicy",

                "cloudfront:GetCachePolicyConfig",

                "cloudfront:GetDistributionConfig",

                "cloudfront:ListCachePolicies",

                "cloudfront:TagResource",

                "cloudfront:UpdateCachePolicy",

                "cloudfront:UpdateDistribution",

                "cloudtrail:GetEventSelectors",

                "cloudtrail:GetTrailStatus",

                "cloudtrail:LookupEvents",

                "cloudtrail:StopLogging",

                "cloudwatch:DeleteAlarms",

                "cloudwatch:DescribeAlarms",

                "cloudwatch:PutMetricAlarm",

                "compute-optimizer:GetRDSRecommendationProjectedMetrics",

                "compute-optimizer:UpdateEnrollmentStatus",

                "dms:CreateReplicationInstance",

                "dms:CreateReplicationTask",

                "dms:DeleteReplicationInstance",

                "dms:DeleteReplicationTask",

                "dms:DescribeReplicationInstances",

                "dynamodb:DescribeTable",

                "dynamodb:TagResource",

                "dynamodb:UpdateTable",

                "ec2:AssociateIamInstanceProfile",

                "ec2:CreateLaunchTemplate",

                "ec2:CreateNetworkInterface",

                "ec2:CreateSnapshot",

                "ec2:CreateSnapshots",

                "ec2:CreateTags",

                "ec2:CreateVpcEndpoint",

                "ec2:DeleteNatGateway",

                "ec2:DeleteNetworkInterface",

                "ec2:DeleteSnapshot",

                "ec2:DeleteVolume",

                "ec2:DeleteVpcEndpointServiceConfigurations",

                "ec2:DescribeAddresses",

                "ec2:DescribeIamInstanceProfileAssociations",

                "ec2:DescribeInstances",

                "ec2:DescribeInstanceStatus",

                "ec2:DescribeLaunchTemplates",

                "ec2:DescribeNatGateways",

                "ec2:DescribeNetworkInterfaces",

                "ec2:DescribeRouteTables",

                "ec2:DescribeSecurityGroups",

                "ec2:DescribeSnapshots",

                "ec2:DescribeSubnets",

                "ec2:DescribeVolumes",

                "ec2:DescribeVolumesModifications",

                "ec2:DescribeVpcAttribute",

                "ec2:DescribeVpcEndpointServiceConfigurations",

                "ec2:DescribeVpcs",

                "ec2:DetachVolume",

                "ec2:ModifyInstanceAttribute",

                "ec2:ModifySnapshotTier",

                "ec2:ModifyVolume",

                "ec2:ModifyVpcAttribute",

                "ec2:MonitorInstances",

                "ec2:ReleaseAddress",

                "ec2:RunInstances",

                "ec2:StartInstances",

                "ec2:StopInstances",

                "ecs:DeregisterTaskDefinition",

                "ecs:DescribeClusters",

                "ecs:DescribeServices",

                "ecs:DescribeTaskDefinition",

                "ecs:DescribeTasks",

                "ecs:ListServices",

                "ecs:ListTasks",

                "ecs:RegisterTaskDefinition",

                "ecs:TagResource",

                "ecs:UntagResource",

                "ecs:UpdateService",

                "elasticache:AddTagsToResource",

                "elasticache:CreateReplicationGroup",

                "elasticache:DeleteCacheCluster",

                "elasticache:DeleteReplicationGroup",

                "elasticache:DescribeCacheClusters",

                "elasticache:DescribeReplicationGroups",

                "elasticache:DescribeSnapshots",

                "elasticache:ModifyReplicationGroup",

                "elasticfilesystem:CreateTags",

                "elasticfilesystem:DescribeFileSystems",

                "elasticfilesystem:DescribeLifecycleConfiguration",

                "elasticfilesystem:PutLifecycleConfiguration",

                "elasticfilesystem:TagResource",

                "elasticfilesystem:UpdateFileSystem",

                "elasticloadbalancing:DeleteListener",

                "elasticloadbalancing:DeleteLoadBalancer",

                "elasticloadbalancing:DeleteTargetGroup",

                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",

                "elasticloadbalancing:DescribeListeners",

                "elasticloadbalancing:DescribeTargetGroups",

                "elasticloadbalancing:ModifyLoadBalancerAttributes",

                "es:AddTags",

                "es:DescribeDomain",

                "es:DescribeDomainChangeProgress",

                "es:ListTags",

                "es:UpdateDomainConfig",

                "iam:AddRoleToInstanceProfile",

                "iam:AttachRolePolicy",

                "iam:CreateInstanceProfile",

                "iam:CreateRole",

                "iam:CreateServiceLinkedRole",

                "iam:GetInstanceProfile",

                "iam:GetRole",

                "iam:ListInstanceProfilesForRole",

                "iam:PassRole",

                "iam:PutRolePolicy",

                "kendra:CreateDataSource",

                "kendra:CreateIndex",

                "kendra:DeleteIndex",

                "kms:DescribeKey",

                "logs:PutRetentionPolicy",

                "quicksight:DeleteUserByPrincipalId",

                "quicksight:UpdateAnalysisPermissions",

                "quicksight:UpdateDashboardPermissions",

                "quicksight:UpdateDataSetPermissions",

                "quicksight:UpdateDataSourcePermissions",

                "rds:AddTagsToResource",

                "rds:CreateDBInstance",

                "rds:CreateDBSnapshot",

                "rds:DeleteDBCluster",

                "rds:DeleteDBInstance",

                "rds:DescribeDBClusters",

                "rds:DescribeDBClusterSnapshots",

                "rds:DescribeDBInstances",

                "rds:DescribeDBSnapshots",

                "rds:FailoverDBCluster",

                "rds:ListTagsForResource",

                "rds:ModifyDBCluster",

                "rds:ModifyDBInstance",

                "rds:RemoveTagsFromResource",

                "rds:RestoreDBClusterFromSnapshot",

                "s3:CreateBucket",

                "s3:GetBucketTagging",

                "s3:GetLifecycleConfiguration",

                "s3:ListBucket",

                "s3:PutBucketTagging",

                "s3:PutLifecycleConfiguration",

                "s3:PutObject",

                "sagemaker:AddTags",

                "sagemaker:CreateNotebookInstanceLifecycleConfig",

                "sagemaker:DescribeNotebookInstance",

                "sagemaker:ListNotebookInstanceLifecycleConfigs",

                "sagemaker:StartNotebookInstance",

                "sagemaker:StopNotebookInstance",

                "sagemaker:UpdateNotebookInstance",

                "sns:Publish",

                "ssm:CreateAssociation",

                "ssm:DeleteAssociation",

                "ssm:GetAutomationExecution",

                "ssm:PutParameter",

                "ssm:StartAutomationExecution",

                "ssm:UpdateAssociation"

            ],

            "Resource": "*"

        }

    ]

}

3. cloudfix-fixer-approver-role

Controls automation workflow approvals and oversees fix execution.

Core Functions:

• Reviews and approves runbook execution

• Monitors fix progress

• Controls automation workflows

• Manages approval chains

• Enforces approval policies

Safety Controls:

• Validates approver permissions

• Ensures multi-party review where needed

• Tracks approval history

• Enforces separation of duties

• Manages emergency approval processes

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "ssm:SendAutomationSignal",

                "ssm:GetOpsItem",

                "ssm:GetDocument",

                "ssm:GetServiceSetting",

                "ssm:ListDocuments",

                "ssm:ListDocumentVersions",

                "ssm:DescribeDocument",

                "ssm:UpdateDocumentMetadata"

            ],

            "Resource": "*"

        }

    ]

}

Helper Roles

cloudfix-backup-job-role

Manages backup operations. As well as the core poolicy below, the role uses the AWS managed policies AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForRestores

Key Functions:

• Creates and manages backups

• Handles restoration tasks

• Controls backup vault access

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Action": [

                "backup:DescribeBackupVault",

                "backup:CopyIntoBackupVault",

                "backup:CopyFromBackupVault",

                "elasticfilesystem:Backup",

                "elasticfilesystem:DescribeTags"

            ],

            "Resource": "*",

            "Effect": "Allow"

        },

        {

            "Action": [

                "ec2:CreateSnapshot",

                "ec2:DeleteSnapshot",

                "ec2:DescribeVolumes"

            ],

            "Resource": [

                "arn:aws:ec2:*::snapshot/*",

                "arn:aws:ec2:*:*:volume/*"

            ],

            "Effect": "Allow"

        },

        {

            "Action": [

                "ec2:DescribeSnapshots",

                "ec2:DescribeTags"

            ],

            "Resource": "*",

            "Effect": "Allow"

        },

        {

            "Action": [

                "ec2:CopySnapshot",

                "ec2:CreateTags",

                "ec2:DeleteSnapshot"

            ],

            "Resource": "arn:aws:ec2:*::snapshot/*",

            "Effect": "Allow"

        },

        {

            "Condition": {

                "Null": {

                    "aws:ResourceTag/aws:backup:source-resource": "false"

                }

            },

            "Action": "ec2:ModifySnapshotAttribute",

            "Resource": "*",

            "Effect": "Allow"

        }

    ]

}

Cleanup Roles

CloudFix-prod-CURStack-1S-cleanupBucketOnDeleteLamb

Manages resource cleanup.

Key Functions:

• Removes S3 objects

• Deletes buckets

• Handles CUR stack cleanup

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Allow",

            "Action": [

                "logs:CreateLogGroup",

                "logs:CreateLogStream",

                "logs:PutLogEvents"

            ],

            "Resource": "*"

        },

        {

            "Effect": "Allow",

            "Action": [

                "s3:PutBucketNotification"

            ],

            "Resource": "arn:aws:s3:::cloudfix-cur-123412341234"

        },

        {

            "Effect": "Allow",

            "Action": [

                "ce:UpdateCostAllocationTagsStatus",

                "support:CreateCase"

            ],

            "Resource": "*"

        }

    ]

}