permissions · aws

AWS permissions

434

IAM actions total

248

read-only actions

186

write actions

services touched

What access does ZopNight need on AWS?

ZopNight needs 281 read-only IAM permissions to discover an AWS account, read CloudWatch metrics and pull Cost Explorer or CUR 2.0 billing data. Write access is a separate CloudFormation stack you can decline: 128 permissions for scheduling, tagging and remediation, including deletes. ZopNight uses the read grant for metadata, metrics and billing.

Filter actions

acm 2 read · 1 write

IAM actions ZopNight requests in the acm service on AWS: 2 read, 1 write.
Action	Access	Purpose
acm:DescribeCertificate	read	discovery
acm:ListCertificates	read	discovery
acm:RequestCertificate	write	provisioning

apigateway 0 read · 1 write

IAM actions ZopNight requests in the apigateway service on AWS: 0 read, 1 write.
Action	Access	Purpose
apigateway:DELETE	write	remediation

application-autoscaling 3 read · 6 write

IAM actions ZopNight requests in the application-autoscaling service on AWS: 3 read, 6 write.
Action	Access	Purpose
application-autoscaling:DescribeScalableTargets	read	scheduling
application-autoscaling:DescribeScalingPolicies	read	scheduling
application-autoscaling:DescribeScheduledActions	read	scheduling
application-autoscaling:DeleteScalingPolicy	write	scheduling
application-autoscaling:DeleteScheduledAction	write	scheduling
application-autoscaling:DeregisterScalableTarget	write	scheduling
application-autoscaling:PutScalingPolicy	write	scheduling
application-autoscaling:PutScheduledAction	write	scheduling
application-autoscaling:RegisterScalableTarget	write	scheduling

apprunner 0 read · 2 write

IAM actions ZopNight requests in the apprunner service on AWS: 0 read, 2 write.
Action	Access	Purpose
apprunner:PauseService	write	scheduling
apprunner:ResumeService	write	scheduling

appstream 1 read · 0 write

IAM actions ZopNight requests in the appstream service on AWS: 1 read, 0 write.
Action	Access	Purpose
appstream:DescribeFleets	read	discovery

autoscaling 3 read · 8 write

IAM actions ZopNight requests in the autoscaling service on AWS: 3 read, 8 write.
Action	Access	Purpose
autoscaling:DescribeAutoScalingGroups	read	discovery
autoscaling:DescribePolicies	read	discovery
autoscaling:DescribeScheduledActions	read	discovery
autoscaling:AttachLoadBalancerTargetGroups	write	provisioning
autoscaling:CreateAutoScalingGroup	write	scheduling; provisioning
autoscaling:DeleteAutoScalingGroup	write	provisioning
autoscaling:DeletePolicy	write	scheduling
autoscaling:DeleteScheduledAction	write	scheduling
autoscaling:PutScalingPolicy	write	scheduling
autoscaling:PutScheduledUpdateGroupAction	write	scheduling
autoscaling:UpdateAutoScalingGroup	write	scheduling

backup 2 read · 0 write

IAM actions ZopNight requests in the backup service on AWS: 2 read, 0 write.
Action	Access	Purpose
backup:ListBackupVaults	read	discovery
backup:ListRecoveryPointsByBackupVault	read	discovery

bedrock 32 read · 7 write

IAM actions ZopNight requests in the bedrock service on AWS: 32 read, 7 write.
Action	Access	Purpose
bedrock:GetAgent	read	discovery
bedrock:GetCustomModel	read	discovery
bedrock:GetEvaluationJob	read	discovery
bedrock:GetGuardrail	read	discovery
bedrock:GetKnowledgeBase	read	discovery
bedrock:GetMarketplaceModelEndpoint	read	discovery
bedrock:GetModelInvocationLoggingConfiguration	read	discovery
bedrock:GetProvisionedModelThroughput	read	discovery
bedrock:ListAgentActionGroups	read	discovery
bedrock:ListAgentAliases	read	discovery
bedrock:ListAgents	read	discovery
bedrock:ListAgentVersions	read	discovery
bedrock:ListCustomModelDeployments	read	discovery
bedrock:ListCustomModels	read	discovery
bedrock:ListDataAutomationProjects	read	discovery
bedrock:ListDataSources	read	discovery
bedrock:ListEvaluationJobs	read	discovery
bedrock:ListFlowAliases	read	discovery
bedrock:ListFlows	read	discovery
bedrock:ListFlowVersions	read	discovery
bedrock:ListFoundationModels	read	discovery
bedrock:ListGuardrails	read	discovery
bedrock:ListImportedModels	read	discovery
bedrock:ListInferenceProfiles	read	discovery
bedrock:ListKnowledgeBases	read	discovery
bedrock:ListMarketplaceModelEndpoints	read	discovery
bedrock:ListModelCopyJobs	read	discovery
bedrock:ListModelCustomizationJobs	read	discovery
bedrock:ListModelInvocationJobs	read	discovery
bedrock:ListPrompts	read	discovery
bedrock:ListProvisionedModelThroughputs	read	discovery
bedrock:ListTagsForResource	read	discovery
bedrock:DeleteAgent	write	remediation
bedrock:DeleteCustomModel	write	remediation
bedrock:DeleteGuardrail	write	remediation
bedrock:DeleteImportedModel	write	remediation
bedrock:DeleteKnowledgeBase	write	remediation
bedrock:DeleteProvisionedModelThroughput	write	remediation
bedrock:InvokeModel	write	ai-gateway

ce 2 read · 0 write

IAM actions ZopNight requests in the ce service on AWS: 2 read, 0 write.
Action	Access	Purpose
ce:GetCostAndUsage	read	cost
ce:GetCostAndUsageWithResources	read	cost

cloudfront 2 read · 3 write

IAM actions ZopNight requests in the cloudfront service on AWS: 2 read, 3 write.
Action	Access	Purpose
cloudfront:GetDistribution	read	discovery
cloudfront:ListDistributions	read	discovery
cloudfront:DeleteDistribution	write	remediation
cloudfront:GetDistributionConfig	write	remediation
cloudfront:UpdateDistribution	write	remediation

cloudtrail 3 read · 0 write

IAM actions ZopNight requests in the cloudtrail service on AWS: 3 read, 0 write.
Action	Access	Purpose
cloudtrail:DescribeTrails	read	discovery
cloudtrail:GetTrailStatus	read	discovery
cloudtrail:LookupEvents	read	recommendations

cloudwatch 6 read · 2 write

IAM actions ZopNight requests in the cloudwatch service on AWS: 6 read, 2 write.
Action	Access	Purpose
cloudwatch:DescribeAlarms	read	discovery
cloudwatch:GetMetricData	read	recommendations
cloudwatch:GetMetricStatistics	read	recommendations
cloudwatch:ListDashboards	read	discovery
cloudwatch:ListMetrics	read	recommendations
cloudwatch:ListMetricStreams	read	discovery
cloudwatch:DeleteAlarms	write	remediation
cloudwatch:DeleteDashboards	write	remediation

codebuild 3 read · 1 write

IAM actions ZopNight requests in the codebuild service on AWS: 3 read, 1 write.
Action	Access	Purpose
codebuild:BatchGetProjects	read	discovery
codebuild:ListBuildsForProject	read	discovery
codebuild:ListProjects	read	discovery
codebuild:DeleteProject	write	remediation

codecommit 0 read · 1 write

IAM actions ZopNight requests in the codecommit service on AWS: 0 read, 1 write.
Action	Access	Purpose
codecommit:DeleteRepository	write	remediation

config 4 read · 0 write

IAM actions ZopNight requests in the config service on AWS: 4 read, 0 write.
Action	Access	Purpose
config:DescribeConfigRuleEvaluationStatus	read	discovery
config:DescribeConfigRules	read	discovery
config:DescribeConfigurationRecorders	read	discovery
config:DescribeConfigurationRecorderStatus	read	discovery

dax 1 read · 0 write

IAM actions ZopNight requests in the dax service on AWS: 1 read, 0 write.
Action	Access	Purpose
dax:DescribeClusters	read	discovery

dms 1 read · 0 write

IAM actions ZopNight requests in the dms service on AWS: 1 read, 0 write.
Action	Access	Purpose
dms:DescribeReplicationInstances	read	discovery

dynamodb 3 read · 0 write

IAM actions ZopNight requests in the dynamodb service on AWS: 3 read, 0 write.
Action	Access	Purpose
dynamodb:DescribeContinuousBackups	read	discovery
dynamodb:DescribeTable	read	discovery
dynamodb:ListTables	read	discovery

ec2 22 read · 46 write

IAM actions ZopNight requests in the ec2 service on AWS: 22 read, 46 write.
Action	Access	Purpose
ec2:DescribeAddresses	read	discovery
ec2:DescribeAvailabilityZones	read	discovery
ec2:DescribeFlowLogs	read	discovery
ec2:DescribeImages	read	discovery
ec2:DescribeInstances	read	discovery; provisioning
ec2:DescribeLaunchTemplates	read	discovery
ec2:DescribeNatGateways	read	discovery
ec2:DescribeNetworkInterfaces	read	discovery
ec2:DescribeRegions	read	discovery
ec2:DescribeRouteTables	read	discovery
ec2:DescribeSecurityGroupRules	read	discovery
ec2:DescribeSecurityGroups	read	discovery
ec2:DescribeSnapshots	read	discovery
ec2:DescribeSubnets	read	discovery
ec2:DescribeTags	read	discovery
ec2:DescribeTransitGatewayPeeringAttachments	read	discovery
ec2:DescribeTransitGateways	read	discovery
ec2:DescribeVolumes	read	discovery; provisioning
ec2:DescribeVpcEndpoints	read	discovery
ec2:DescribeVpcPeeringConnections	read	discovery
ec2:DescribeVpcs	read	discovery
ec2:DescribeVpnConnections	read	discovery
ec2:AcceptVpcPeeringConnection	write	provisioning
ec2:AllocateAddress	write	provisioning
ec2:AssociateRouteTable	write	provisioning
ec2:AttachInternetGateway	write	provisioning
ec2:AuthorizeSecurityGroupEgress	write	provisioning
ec2:AuthorizeSecurityGroupIngress	write	provisioning
ec2:CreateInternetGateway	write	provisioning
ec2:CreateLaunchTemplate	write	scheduling
ec2:CreateNatGateway	write	provisioning
ec2:CreateRoute	write	provisioning
ec2:CreateRouteTable	write	provisioning
ec2:CreateSecurityGroup	write	provisioning
ec2:CreateSubnet	write	provisioning
ec2:CreateVpc	write	provisioning
ec2:CreateVpcPeeringConnection	write	provisioning
ec2:DeleteInternetGateway	write	remediation; provisioning
ec2:DeleteLaunchTemplate	write	scheduling
ec2:DeleteNatGateway	write	provisioning
ec2:DeleteNetworkInterface	write	provisioning
ec2:DeleteRoute	write	provisioning
ec2:DeleteRouteTable	write	provisioning
ec2:DeleteSecurityGroup	write	provisioning
ec2:DeleteSnapshot	write	remediation
ec2:DeleteSubnet	write	provisioning
ec2:DeleteTransitGateway	write	remediation
ec2:DeleteVolume	write	remediation
ec2:DeleteVpc	write	provisioning
ec2:DeleteVpcEndpoints	write	remediation
ec2:DeleteVpcPeeringConnection	write	remediation; provisioning
ec2:DetachInternetGateway	write	provisioning
ec2:DetachNetworkInterface	write	provisioning
ec2:DisassociateAddress	write	remediation
ec2:DisassociateRouteTable	write	provisioning
ec2:ModifyInstanceAttribute	write	remediation; provisioning
ec2:ModifySnapshotTier	write	remediation
ec2:ModifyVolume	write	remediation; provisioning
ec2:ModifyVpcAttribute	write	provisioning
ec2:ModifyVpcPeeringConnectionOptions	write	provisioning
ec2:ReleaseAddress	write	remediation; provisioning
ec2:RestoreSnapshotTier	write	remediation
ec2:RevokeSecurityGroupEgress	write	provisioning
ec2:RevokeSecurityGroupIngress	write	provisioning
ec2:RunInstances	write	provisioning
ec2:StartInstances	write	scheduling; provisioning
ec2:StopInstances	write	scheduling; provisioning
ec2:TerminateInstances	write	provisioning

ecr 6 read · 2 write

IAM actions ZopNight requests in the ecr service on AWS: 6 read, 2 write.
Action	Access	Purpose
ecr:DescribeImages	read	discovery
ecr:DescribeRepositories	read	discovery
ecr:GetAuthorizationToken	read	discovery
ecr:GetLifecyclePolicy	read	discovery
ecr:GetRepositoryPolicy	read	discovery
ecr:ListTagsForResource	read	discovery
ecr:CreateRepository	write	deployments
ecr:DeleteRepository	write	deployments

ecs 7 read · 5 write

IAM actions ZopNight requests in the ecs service on AWS: 7 read, 5 write.
Action	Access	Purpose
ecs:DescribeClusters	read	discovery
ecs:DescribeServices	read	discovery
ecs:DescribeTaskDefinition	read	discovery
ecs:DescribeTasks	read	discovery
ecs:ListClusters	read	discovery
ecs:ListServices	read	discovery
ecs:ListTasks	read	discovery
ecs:DeleteCluster	write	remediation
ecs:DeleteService	write	remediation
ecs:DeregisterTaskDefinition	write	remediation
ecs:RegisterTaskDefinition	write	remediation
ecs:UpdateService	write	scheduling

eks 8 read · 7 write

IAM actions ZopNight requests in the eks service on AWS: 8 read, 7 write.
Action	Access	Purpose
eks:DescribeAddon	read	discovery
eks:DescribeCluster	read	discovery
eks:DescribeNodegroup	read	discovery
eks:DescribeUpdate	read	discovery
eks:ListAccessEntries	read	discovery
eks:ListClusters	read	discovery
eks:ListFargateProfiles	read	discovery
eks:ListNodegroups	read	discovery
eks:CreateCluster	write	provisioning
eks:CreateNodegroup	write	provisioning
eks:DeleteCluster	write	provisioning
eks:DeleteNodegroup	write	remediation; provisioning
eks:TagResource	write	scheduling
eks:UpdateClusterConfig	write	provisioning
eks:UpdateNodegroupConfig	write	scheduling

elasticache 4 read · 8 write

IAM actions ZopNight requests in the elasticache service on AWS: 4 read, 8 write.
Action	Access	Purpose
elasticache:DescribeCacheClusters	read	discovery
elasticache:DescribeCacheSubnetGroups	read	discovery
elasticache:DescribeGlobalReplicationGroups	read	discovery
elasticache:DescribeReplicationGroups	read	discovery
elasticache:CreateCacheCluster	write	provisioning
elasticache:CreateCacheSubnetGroup	write	provisioning
elasticache:CreateReplicationGroup	write	provisioning
elasticache:DeleteCacheCluster	write	provisioning
elasticache:DeleteCacheSubnetGroup	write	provisioning
elasticache:DeleteReplicationGroup	write	provisioning
elasticache:ModifyCacheCluster	write	provisioning
elasticache:ModifyReplicationGroup	write	provisioning

elasticbeanstalk 2 read · 1 write

IAM actions ZopNight requests in the elasticbeanstalk service on AWS: 2 read, 1 write.
Action	Access	Purpose
elasticbeanstalk:DescribeConfigurationSettings	read	scheduling
elasticbeanstalk:DescribeEnvironments	read	scheduling
elasticbeanstalk:UpdateEnvironment	write	scheduling

elasticfilesystem 3 read · 2 write

IAM actions ZopNight requests in the elasticfilesystem service on AWS: 3 read, 2 write.
Action	Access	Purpose
elasticfilesystem:DescribeFileSystems	read	discovery
elasticfilesystem:DescribeMountTargets	read	discovery
elasticfilesystem:DescribeReplicationConfigurations	read	discovery
elasticfilesystem:DeleteFileSystem	write	remediation
elasticfilesystem:DeleteMountTarget	write	remediation

elasticloadbalancing 4 read · 9 write

IAM actions ZopNight requests in the elasticloadbalancing service on AWS: 4 read, 9 write.
Action	Access	Purpose
elasticloadbalancing:DescribeLoadBalancers	read	discovery
elasticloadbalancing:DescribeTags	read	discovery
elasticloadbalancing:DescribeTargetGroups	read	discovery
elasticloadbalancing:DescribeTargetHealth	read	discovery
elasticloadbalancing:CreateListener	write	provisioning
elasticloadbalancing:CreateLoadBalancer	write	provisioning
elasticloadbalancing:CreateTargetGroup	write	provisioning
elasticloadbalancing:DeleteLoadBalancer	write	provisioning
elasticloadbalancing:DeleteTargetGroup	write	provisioning
elasticloadbalancing:DeregisterTargets	write	provisioning
elasticloadbalancing:DescribeLoadBalancerAttributes	write	remediation
elasticloadbalancing:ModifyLoadBalancerAttributes	write	remediation; provisioning
elasticloadbalancing:RegisterTargets	write	provisioning

elasticmapreduce 4 read · 0 write

IAM actions ZopNight requests in the elasticmapreduce service on AWS: 4 read, 0 write.
Action	Access	Purpose
elasticmapreduce:DescribeCluster	read	discovery
elasticmapreduce:ListClusters	read	discovery
elasticmapreduce:ListInstanceFleets	read	discovery
elasticmapreduce:ListInstanceGroups	read	discovery

emr-serverless 2 read · 2 write

IAM actions ZopNight requests in the emr-serverless service on AWS: 2 read, 2 write.
Action	Access	Purpose
emr-serverless:GetApplication	read	scheduling
emr-serverless:ListApplications	read	discovery
emr-serverless:StartApplication	write	scheduling
emr-serverless:StopApplication	write	scheduling

es 3 read · 1 write

IAM actions ZopNight requests in the es service on AWS: 3 read, 1 write.
Action	Access	Purpose
es:DescribeDomains	read	discovery
es:DescribeOutboundConnections	read	discovery
es:ListDomainNames	read	discovery
es:DeleteDomain	write	remediation

fsx 1 read · 0 write

IAM actions ZopNight requests in the fsx service on AWS: 1 read, 0 write.
Action	Access	Purpose
fsx:DescribeFileSystems	read	discovery

glue 2 read · 1 write

IAM actions ZopNight requests in the glue service on AWS: 2 read, 1 write.
Action	Access	Purpose
glue:GetJob	read	discovery,remediation
glue:GetJobs	read	discovery
glue:UpdateJob	write	remediation

guardduty 2 read · 0 write

IAM actions ZopNight requests in the guardduty service on AWS: 2 read, 0 write.
Action	Access	Purpose
guardduty:GetDetector	read	discovery
guardduty:ListDetectors	read	discovery

iam 22 read · 14 write

IAM actions ZopNight requests in the iam service on AWS: 22 read, 14 write.
Action	Access	Purpose
iam:GenerateCredentialReport	read	discovery
iam:GetAccountPasswordPolicy	read	discovery
iam:GetAccountSummary	read	discovery
iam:GetCredentialReport	read	discovery
iam:GetGroup	read	discovery
iam:GetInstanceProfile	read	discovery
iam:GetLoginProfile	read	discovery
iam:GetOpenIDConnectProvider	read	discovery
iam:GetRole	read	discovery
iam:ListAccessKeys	read	discovery
iam:ListAttachedRolePolicies	read	discovery
iam:ListGroupPolicies	read	discovery
iam:ListGroups	read	discovery
iam:ListGroupsForUser	read	discovery
iam:ListMFADevices	read	discovery
iam:ListOpenIDConnectProviders	read	discovery
iam:ListRolePolicies	read	discovery
iam:ListRoles	read	discovery
iam:ListUserPolicies	read	discovery
iam:ListUsers	read	discovery
iam:ListUserTags	read	discovery
iam:SimulatePrincipalPolicy	read	probe
iam:AddRoleToInstanceProfile	write	provisioning
iam:AttachRolePolicy	write	provisioning
iam:CreateInstanceProfile	write	provisioning
iam:CreateOpenIDConnectProvider	write	provisioning
iam:CreateRole	write	provisioning
iam:CreateServiceLinkedRole	write	provisioning
iam:DeleteInstanceProfile	write	provisioning
iam:DeleteRole	write	provisioning
iam:DeleteRolePolicy	write	provisioning
iam:DetachRolePolicy	write	provisioning
iam:PutRolePolicy	write	provisioning
iam:RemoveRoleFromInstanceProfile	write	provisioning
iam:TagRole	write	provisioning
iam:UpdateAssumeRolePolicy	write	provisioning

identitystore 1 read · 0 write

IAM actions ZopNight requests in the identitystore service on AWS: 1 read, 0 write.
Action	Access	Purpose
identitystore:ListUsers	read	discovery

inspector2 1 read · 0 write

IAM actions ZopNight requests in the inspector2 service on AWS: 1 read, 0 write.
Action	Access	Purpose
inspector2:BatchGetAccountStatus	read	discovery

kafka 1 read · 0 write

IAM actions ZopNight requests in the kafka service on AWS: 1 read, 0 write.
Action	Access	Purpose
kafka:ListClustersV2	read	discovery

kinesis 3 read · 1 write

IAM actions ZopNight requests in the kinesis service on AWS: 3 read, 1 write.
Action	Access	Purpose
kinesis:DescribeStream	read	discovery
kinesis:DescribeStreamSummary	read	discovery
kinesis:ListStreams	read	discovery
kinesis:DeleteStream	write	remediation

kms 2 read · 1 write

IAM actions ZopNight requests in the kms service on AWS: 2 read, 1 write.
Action	Access	Purpose
kms:DescribeKey	read	discovery
kms:ListKeys	read	discovery
kms:ScheduleKeyDeletion	write	remediation

lambda 6 read · 5 write

IAM actions ZopNight requests in the lambda service on AWS: 6 read, 5 write.
Action	Access	Purpose
lambda:GetFunction	read	discovery
lambda:GetFunctionConcurrency	read	discovery
lambda:GetFunctionConfiguration	read	discovery
lambda:ListEventSourceMappings	read	discovery
lambda:ListFunctions	read	discovery
lambda:ListTags	read	discovery
lambda:DeleteFunction	write	remediation
lambda:DeleteFunctionConcurrency	write	scheduling
lambda:PutFunctionConcurrency	write	scheduling
lambda:TagResource	write	scheduling
lambda:UpdateFunctionConfiguration	write	remediation

lightsail 1 read · 2 write

IAM actions ZopNight requests in the lightsail service on AWS: 1 read, 2 write.
Action	Access	Purpose
lightsail:GetInstances	read	discovery
lightsail:StartInstance	write	scheduling
lightsail:StopInstance	write	scheduling

logs 5 read · 2 write

IAM actions ZopNight requests in the logs service on AWS: 5 read, 2 write.
Action	Access	Purpose
logs:DescribeLogGroups	read	discovery
logs:DescribeMetricFilters	read	discovery
logs:DescribeSubscriptionFilters	read	discovery
logs:GetQueryResults	read	recommendations
logs:StartQuery	read	recommendations
logs:DeleteRetentionPolicy	write	remediation
logs:PutRetentionPolicy	write	remediation

memorydb 1 read · 0 write

IAM actions ZopNight requests in the memorydb service on AWS: 1 read, 0 write.
Action	Access	Purpose
memorydb:DescribeClusters	read	discovery

mq 2 read · 0 write

IAM actions ZopNight requests in the mq service on AWS: 2 read, 0 write.
Action	Access	Purpose
mq:DescribeBroker	read	discovery
mq:ListBrokers	read	discovery

rds 8 read · 10 write

IAM actions ZopNight requests in the rds service on AWS: 8 read, 10 write.
Action	Access	Purpose
rds:DescribeDBClusters	read	discovery
rds:DescribeDBInstances	read	discovery
rds:DescribeDBProxies	read	discovery
rds:DescribeDBProxyTargets	read	discovery
rds:DescribeDBSnapshots	read	discovery
rds:DescribeDBSubnetGroups	read	discovery
rds:DescribeGlobalClusters	read	discovery
rds:ListTagsForResource	read	discovery
rds:CreateDBInstance	write	provisioning
rds:CreateDBSubnetGroup	write	provisioning
rds:DeleteDBInstance	write	provisioning
rds:DeleteDBProxy	write	remediation
rds:DeleteDBSubnetGroup	write	provisioning
rds:ModifyDBInstance	write	remediation; provisioning
rds:StartDBCluster	write	scheduling
rds:StartDBInstance	write	scheduling
rds:StopDBCluster	write	scheduling
rds:StopDBInstance	write	scheduling

redshift 1 read · 2 write

IAM actions ZopNight requests in the redshift service on AWS: 1 read, 2 write.
Action	Access	Purpose
redshift:DescribeClusters	read	discovery
redshift:PauseCluster	write	scheduling
redshift:ResumeCluster	write	scheduling

resource-explorer-2 1 read · 0 write

IAM actions ZopNight requests in the resource-explorer-2 service on AWS: 1 read, 0 write.
Action	Access	Purpose
resource-explorer-2:Search	read	discovery

route53 6 read · 4 write

IAM actions ZopNight requests in the route53 service on AWS: 6 read, 4 write.
Action	Access	Purpose
route53:GetChange	read	discovery
route53:GetHealthCheckStatus	read	discovery
route53:GetHostedZone	read	discovery
route53:ListHealthChecks	read	discovery
route53:ListHostedZones	read	discovery
route53:ListResourceRecordSets	read	discovery
route53:ChangeResourceRecordSets	write	provisioning
route53:CreateHostedZone	write	provisioning
route53:DeleteHealthCheck	write	remediation
route53:DeleteHostedZone	write	provisioning

s3 10 read · 6 write

IAM actions ZopNight requests in the s3 service on AWS: 10 read, 6 write.
Action	Access	Purpose
s3:GetBucketAccelerateConfiguration	read	discovery
s3:GetBucketPolicy	read	discovery
s3:GetBucketPolicyStatus	read	discovery
s3:GetBucketReplication	read	discovery
s3:GetBucketRequestPayment	read	discovery
s3:GetObject	read	cost
s3:ListAllMyBuckets	read	discovery
s3:ListBucket	read	cost
s3:ListBucketMultipartUploads	read	discovery
s3:ListBucketVersions	read	discovery
s3:GetAccelerateConfiguration	write	remediation
s3:GetIntelligentTieringConfiguration	write	remediation
s3:GetLifecycleConfiguration	write	remediation
s3:PutAccelerateConfiguration	write	remediation
s3:PutIntelligentTieringConfiguration	write	remediation
s3:PutLifecycleConfiguration	write	remediation

sagemaker 30 read · 8 write

IAM actions ZopNight requests in the sagemaker service on AWS: 30 read, 8 write.
Action	Access	Purpose
sagemaker:DescribeApp	read	discovery
sagemaker:DescribeAutoMLJobV2	read	discovery
sagemaker:DescribeCluster	read	discovery
sagemaker:DescribeCompilationJob	read	discovery
sagemaker:DescribeEndpoint	read	discovery
sagemaker:DescribeEndpointConfig	read	discovery
sagemaker:DescribeFeatureGroup	read	discovery
sagemaker:DescribeHyperParameterTuningJob	read	discovery
sagemaker:DescribeInferenceComponent	read	discovery
sagemaker:DescribeLabelingJob	read	discovery
sagemaker:DescribeNotebookInstance	read	discovery
sagemaker:DescribeProcessingJob	read	discovery
sagemaker:DescribeSpace	read	discovery
sagemaker:DescribeTrainingJob	read	discovery
sagemaker:DescribeTransformJob	read	discovery
sagemaker:ListApps	read	discovery
sagemaker:ListAutoMLJobs	read	discovery
sagemaker:ListClusters	read	discovery
sagemaker:ListCompilationJobs	read	discovery
sagemaker:ListEndpoints	read	discovery
sagemaker:ListFeatureGroups	read	discovery
sagemaker:ListHyperParameterTuningJobs	read	discovery
sagemaker:ListInferenceComponents	read	discovery
sagemaker:ListLabelingJobs	read	discovery
sagemaker:ListNotebookInstances	read	discovery
sagemaker:ListProcessingJobs	read	discovery
sagemaker:ListSpaces	read	discovery
sagemaker:ListTags	read	discovery
sagemaker:ListTrainingJobs	read	discovery
sagemaker:ListTransformJobs	read	discovery
sagemaker:CreateEndpoint	write	scheduling
sagemaker:CreateEndpointConfig	write	remediation
sagemaker:DeleteEndpoint	write	remediation
sagemaker:DeleteNotebookInstance	write	remediation
sagemaker:StartNotebookInstance	write	scheduling
sagemaker:StopNotebookInstance	write	scheduling
sagemaker:UpdateCluster	write	scheduling
sagemaker:UpdateEndpoint	write	remediation

secretsmanager 1 read · 4 write

IAM actions ZopNight requests in the secretsmanager service on AWS: 1 read, 4 write.
Action	Access	Purpose
secretsmanager:ListSecrets	read	discovery
secretsmanager:CreateSecret	write	deployments
secretsmanager:DeleteSecret	write	remediation; deployments
secretsmanager:GetSecretValue	write	deployments
secretsmanager:PutSecretValue	write	deployments

ses 1 read · 1 write

IAM actions ZopNight requests in the ses service on AWS: 1 read, 1 write.
Action	Access	Purpose
ses:ListEmailIdentities	read	discovery
ses:DeleteEmailIdentity	write	remediation

sns 0 read · 1 write

IAM actions ZopNight requests in the sns service on AWS: 0 read, 1 write.
Action	Access	Purpose
sns:DeleteTopic	write	remediation

sqs 0 read · 1 write

IAM actions ZopNight requests in the sqs service on AWS: 0 read, 1 write.
Action	Access	Purpose
sqs:DeleteQueue	write	remediation

ssm 1 read · 3 write

IAM actions ZopNight requests in the ssm service on AWS: 1 read, 3 write.
Action	Access	Purpose
ssm:DescribeInstanceInformation	read	discovery
ssm:GetCommandInvocation	write	deployments
ssm:GetParameter	write	deployments
ssm:SendCommand	write	deployments

sso 1 read · 0 write

IAM actions ZopNight requests in the sso service on AWS: 1 read, 0 write.
Action	Access	Purpose
sso:ListInstances	read	discovery

states 1 read · 2 write

IAM actions ZopNight requests in the states service on AWS: 1 read, 2 write.
Action	Access	Purpose
states:ListExecutions	read	scheduling
states:DeleteStateMachine	write	remediation
states:StopExecution	write	scheduling

sts 1 read · 0 write

IAM actions ZopNight requests in the sts service on AWS: 1 read, 0 write.
Action	Access	Purpose
sts:GetCallerIdentity	read	probe

wafv2 1 read · 1 write

IAM actions ZopNight requests in the wafv2 service on AWS: 1 read, 1 write.
Action	Access	Purpose
wafv2:GetWebACL	read	remediation
wafv2:DeleteWebACL	write	remediation

workspaces 1 read · 2 write

IAM actions ZopNight requests in the workspaces service on AWS: 1 read, 2 write.
Action	Access	Purpose
workspaces:DescribeWorkspaces	read	discovery
workspaces:StartWorkspaces	write	scheduling
workspaces:StopWorkspaces	write	scheduling

xray 1 read · 0 write

IAM actions ZopNight requests in the xray service on AWS: 1 read, 0 write.
Action	Access	Purpose
xray:GetSamplingRules	read	recommendations

Two separate IAM grants, read then write

ZopNight asks for two grants, and they are separate on purpose. The first is read-only: 281 permissions that let it discover your estate, read CloudWatch metrics and pull cost data. It cannot start, stop, resize or delete anything with that grant. Most teams run on it indefinitely and never issue the second.

The second grant adds 128 write permissions and only matters if you want ZopNight to act: schedules that stop instances at night, tagging, or remediation. It ships as its own CloudFormation stack, so declining it is the default rather than an exception.

Which connection method should I use?

Three are supported. Prefer the first.

Assume role: a cross-account IAM role ZopNight assumes via STS. No secret is ever stored on our side. Created by a one-click CloudFormation stack, and the only method that supports the one-click billing upgrade.
Static access keys: a long-lived key pair. Works everywhere, but you own rotation, and the secret sits at rest in our credential store.
Temporary credentials: short-lived STS credentials. Most restrictive, but they expire, so something has to refresh them.

You can switch between all three in place on an existing account.

What the read-only role is used for

Purpose	What it reads
`discovery`	Resource inventory across every region, on a 6-hour cycle
`cost`	Cost Explorer or CUR 2.0, for per-resource spend
`recommendations`	The signals rules evaluate: utilisation, attachment state, configuration
`probe`	A permission self-check, so the UI can tell you what is missing before you hit an error

What the write role can do, and what it can never do

Write permissions cover scheduling, tagging and remediation: start and stop instances, scale groups to zero, pause databases, tag resources, and modify or delete resources a recommendation identified. They are grouped under scheduling, tagging and remediation, plus one ai-gateway action.

ZopNight does not read secret values. The read grant includes s3:GetObject so ZopNight can read CUR 2.0 billing files, and the role also attaches the AWS-managed ReadOnlyAccess policy, which can read more than ZopNight uses. ZopNight reads metadata, metrics and billing, not your data.

How do I check what a credential can actually do?

The probe permissions exist for this. After connecting, ZopNight runs a per-action check and shows a verdict for each capability, so you find out that a policy is missing ec2:StopInstances before a schedule fails silently at 8pm rather than after.

faq · aws

AWS permissions: common questions

What IAM permissions does ZopNight need on AWS?

281 read-only permissions to discover the account, read CloudWatch metrics and pull Cost Explorer or CUR 2.0 data. Write is a second, separate CloudFormation stack of 128 permissions covering scheduling, tagging and remediation, including deletes. Most teams run on the read grant indefinitely and never install the second.

Can ZopNight read my S3 objects or database rows?

ZopNight reads metadata, metrics and billing, not your data, and it does not read secret values. The read grant does include `s3:GetObject` for CUR 2.0 billing files, and the role attaches the AWS-managed `ReadOnlyAccess` policy, which can read more than ZopNight uses. With write installed it can also start, stop, scale, tag and delete resources for remediation.

How do I check what a credential can actually do?

The probe permissions exist for that. After you connect, ZopNight runs a per-action check and shows a verdict per capability, so a policy missing ec2:StopInstances surfaces before a schedule fails silently at 8pm rather than after.

AWS permissions

Two separate IAM grants, read then write

Which connection method should I use?

What the read-only role is used for

What the write role can do, and what it can never do

How do I check what a credential can actually do?

See it fire on your bill.