Read-only. Always.

We analyze your account through a role you deploy and can revoke. This page is generated from the exact CloudFormation template we ask you to install — it can't claim a permission the role doesn't have.

What we never request

• Object contents (s3:GetObject) — we read bucket names and settings, never your data.
• Secret values (secretsmanager:GetSecretValue) — names only.
• Any write, delete or permission-management action.

Every permission we ask for

Grouped by statement, straight from the template, with why each exists.

See the complete list of API calls, by access path

• CostExplorerRead

  Cost Explorer — commitment coverage / spend (rule COMMIT-C001).

  • ce:GetCostAndUsage
  • ce:GetReservationUtilization
  • ce:GetReservationCoverage
  • ce:GetSavingsPlansUtilization
  • ce:GetSavingsPlansCoverage

• EC2Read

  EC2 inventory — idle instances, orphan volumes, snapshots, EIPs, NAT. DescribeRegions lets us scan every enabled region, not just one.

  • ec2:DescribeRegions
  • ec2:DescribeInstances
  • ec2:DescribeVolumes
  • ec2:DescribeAddresses
  • ec2:DescribeSnapshots
  • ec2:DescribeNatGateways
  • ec2:DescribeRouteTables

• RDSRead

  RDS inventory — idle databases, snapshots, reservations.

  • rds:DescribeDBInstances
  • rds:DescribeDBSnapshots
  • rds:DescribeReservedDBInstances

• S3Read

  S3 — bucket list + lifecycle config only (never object contents).

  • s3:ListAllMyBuckets
  • s3:ListBucket
  • s3:GetLifecycleConfiguration
  • s3:ListBucketMultipartUploads
  • s3:ListMultipartUploadParts

• CloudWatchRead

  CloudWatch — utilization metrics for "idle resource" rules.

  • cloudwatch:GetMetricData
  • cloudwatch:GetMetricStatistics

• LambdaRead

  Lambda — function inventory.

  • lambda:ListFunctions

• CloudFrontRead

  CloudFront — cross-check before recommending an S3 bucket removal (never suggest deleting a bucket that serves a live distribution).

  • cloudfront:ListDistributions

• ELBRead

  Load balancers — detect idle ALB/NLB with no healthy targets.

  • elasticloadbalancing:DescribeLoadBalancers
  • elasticloadbalancing:DescribeTargetGroups
  • elasticloadbalancing:DescribeTargetHealth

• LogsRead

  CloudWatch Logs — log groups with no retention accumulate forever.

  • logs:DescribeLogGroups

• DynamoDBRead

  DynamoDB — provisioned tables sitting idle versus their capacity.

  • dynamodb:ListTables
  • dynamodb:DescribeTable

• Route53Read

  Route 53 — hosted zones billing a flat fee while hosting nothing.

  • route53:ListHostedZones

• SelfPolicySimulation

  Self-diagnosis of a missing permission, scoped to this role only.

  • iam:SimulatePrincipalPolicy