Permissions

This page lists all the permissions in the managed policy DoiTMspEvidenceReadOnly-v1 that is used to collect AWS evidence for MSP assessment, when connecting AWS accounts to the MSP Workspace.

Backup depth

Permission	Description
backup:ListBackupPlans	Lists the active backup plans for the account.
backup:ListBackupVaults	Returns a list of recovery point storage containers along with information about them.
backup:ListBackupJobs	Returns a list of existing backup jobs for an authenticated account for the last 30 days.
backup:ListRestoreJobs	Returns a list of jobs that AWS Backup initiated to restore a saved resource, including details about the recovery process.
backup:GetBackupPlan	Returns the body of a backup plan, including copy-action destinations.
backup:ListRecoveryPointsByBackupVault	Returns the recovery points stored in one backup vault.
backup:ListRecoveryPointsByResource	Returns the recovery points saved for a protected resource.

Support plan probe

Permission	Description
support:DescribeSeverityLevels	Returns the list of severity levels that you can assign to a support case.
support:DescribeTrustedAdvisorChecks	Returns information about all available AWS Trusted Advisor checks, including the name, ID, category, description, and metadata.
support:DescribeTrustedAdvisorCheckResult	Returns the results of the AWS Trusted Advisor check that has the specified check ID.
support:DescribeTrustedAdvisorCheckSummaries	Returns the results for the AWS Trusted Advisor check summaries for the check IDs that you specified.

Well-Architected Tool

Permission	Description
wellarchitected:ListWorkloads	Returns a paginated list of workloads.
wellarchitected:GetWorkload	Retrieves an existing workload.
wellarchitected:ListAnswers	Lists answers for a particular workload and lens.

Cost visibility

Permission	Description
ce:GetCostAndUsage	Retrieves cost and usage metrics for your account.
ce:GetRightsizingRecommendation	Creates recommendations that help you save cost by identifying idle and underutilized Amazon EC2 instances.
ce:GetSavingsPlansPurchaseRecommendation	Retrieves the Savings Plans recommendations for your account.
ce:GetCostForecast	Retrieves a forecast for cost and usage over a specified time period.
ce:GetAnomalies	Retrieves cost anomalies for a specified time period.
ce:GetAnomalyMonitors	Retrieves the cost anomaly monitors created for the account.
ce:GetAnomalySubscriptions	Retrieves the alert subscriptions associated with cost anomaly monitors.
ce:GetSavingsPlansUtilization	Retrieves Savings Plans utilization for a specified time period.

DevOps Guru

Permission	Description
devops-guru:DescribeAccountHealth	Returns the number of open insights, analyzed resources, and analyzed metrics in the account.
devops-guru:DescribeAccountOverview	Returns a summary of reactive and proactive insights for the account.
devops-guru:DescribeAnomaly	Returns details about a specific anomaly.
devops-guru:DescribeInsight	Returns details about a specific insight.
devops-guru:DescribeResourceCollectionHealth	Returns the health of the resources in the configured resource collections.
devops-guru:DescribeServiceIntegration	Returns the integration status of services that are integrated with DevOps Guru.
devops-guru:GetResourceCollection	Returns the resource collection configuration used by DevOps Guru.
devops-guru:ListAnomaliesForInsight	Returns the anomalies associated with an insight.
devops-guru:ListAnomalousLogGroups	Returns the log groups containing log anomalies for an insight.
devops-guru:ListEvents	Returns the events analyzed by DevOps Guru for an insight.
devops-guru:ListInsights	Returns a list of insights in your AWS account.
devops-guru:ListMonitoredResources	Returns the resources that DevOps Guru monitors in the account.
devops-guru:ListNotificationChannels	Returns the notification channels configured for DevOps Guru.
devops-guru:ListRecommendations	Returns the recommendations associated with an insight.

Pipeline history

Permission	Description
codepipeline:GetPipeline	Returns the metadata, structure, stages, and actions of a pipeline.
codepipeline:GetPipelineExecution	Returns information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline.
codepipeline:ListPipelines	Gets a summary of all of the pipelines associated with your account.
codepipeline:ListPipelineExecutions	Gets a summary of the most recent executions for a pipeline.
codebuild:ListProjects	Gets a list of build project names, with each build project name representing a single build project.
codebuild:BatchGetProjects	Gets information about one or more build projects.
codebuild:ListBuilds	Gets a list of build IDs, with each build ID representing a single build.
codebuild:ListBuildsForProject	Gets a list of build identifiers for the specified build project, with each build identifier representing a single build.
codebuild:BatchGetBuilds	Gets information about one or more builds.

Budgets

Permission	Description
budgets:ViewBudget	Allows read access to budgets, their notifications, and configured notification subscribers.

Cost and Usage Reports

Permission	Description
cur:DescribeReportDefinitions	Returns the Cost and Usage Report definitions configured for the account.

Amazon Bedrock inventory

Permission	Description
bedrock:GetModelInvocationLoggingConfiguration	Returns the model invocation logging configuration for the account.
bedrock:ListFoundationModels	Returns the foundation models available in Amazon Bedrock.
bedrock:ListGuardrails	Returns the guardrails configured in the account.
bedrock:GetGuardrail	Returns details about a specific guardrail.

Amazon Bedrock metrics

Permission	Description
cloudwatch:GetMetricData	Retrieves CloudWatch metric data for the AWS/Bedrock namespace.