AWS Access
What the role can read
The assessment role grants eighteen read-only API calls, each traceable to a line of collector source and asserted by an automated test.
The role you create grants two AWS managed policies — SecurityAudit and ViewOnlyAccess — plus exactly the API calls the collectors make. Nothing else.
The calls, by collector
| Collector | Calls |
|---|---|
| Account metadata | sts:GetCallerIdentity, iam:ListAccountAliases, organizations:DescribeOrganization |
| Security Hub posture | securityhub:DescribeHub, securityhub:GetAdministratorAccount, securityhub:ListFindingAggregators, securityhub:GetFindings |
| Cost telemetry | ce:GetCostAndUsage, ec2:DescribeVolumes, ec2:DescribeAddresses, ec2:DescribeSnapshots, ec2:DescribeRegions |
| Resilience posture | rds:DescribeDBInstances, autoscaling:DescribeAutoScalingGroups, elasticloadbalancing:DescribeLoadBalancers, s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetBucketVersioning |
Every entry is configuration, not description. A machine-readable manifest names each call and the source file that makes it, and an automated test fails if the role grants something no collector calls, or if a collector calls something the role does not grant.
What these calls return
Configuration and metadata. Whether a bucket has versioning enabled — not what is in the bucket. Whether a database is Multi-AZ — not what is in the database.
Verifying this yourself
The role is in your account. Open it in the IAM console and read the attached policy: the grants above are the whole of it, and the denials are attached to the same role.