> For the complete documentation index, see [llms.txt](https://docs.noros.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.noros.ai/getting-started/permissions-required/required-aws-permissions.md). # Required AWS Permissions Noros follows the principle of least privilege. We request only the minimum permissions necessary to provide cost visibility and cloud spending insights for your AWS environment. ### What Noros Cannot Do Noros **cannot**: * Read sensitive workload data * Edit network rules or security groups * Create, stop, or terminate instances * Change, copy, or delete your data The Noros roles can make one kind of change to your AWS account: `NorthCostAndUsageRolePremium` can enroll your organization in AWS Compute Optimizer. To remove that permission, see [Removing Write Permissions from the Premium Role](#removing-write-permissions-from-the-premium-role). ### Permissions During onboarding, you deploy the Noros CloudFormation stack, `north-all-features.yaml`, in your AWS management account. The stack creates these resources: * **`NorthCostAndUsageRole`.** Reads cost, billing, and reservation data. * **`NorthCostAndUsageRolePremium`.** Reads Compute Optimizer recommendations, resource inventory, and CloudWatch statistics. It can also enroll your organization in Compute Optimizer. * **`NorthCloudWatchCrossAccountAccessRole`.** Reads your Cost and Usage Report files, and assumes the sharing role in each account to read CloudWatch metrics. * **`NorthCloudWatchCrossAccountSharingRole`.** Grants `cloudwatch:GetMetricData` only. The stack creates it in your management account, and a StackSet creates it in every account in the organizational unit you select. * **A Cost and Usage Report bucket.** The bucket is `north-cur-bucket-`, with SSE-S3 encryption. When you deploy the stack in `us-east-1`, it also creates the Cost and Usage Report that AWS delivers to this bucket. #### Cost & Billing Data `NorthCostAndUsageRole` carries these permissions: | Permission | Purpose | | ---------------------------------------------------------------- | ----------------------------------------------- | | `ce:Get*`, `ce:Describe*`, `ce:List*` | Cost Explorer read access | | `ce:Start*` | Generate Savings Plans purchase recommendations | | `cur:Get*`, `cur:Validate*` | Cost and Usage Report access | | `billing:Get*` | Billing data access | | `payments:List*`, `payments:Get*` | Payment information | | `tax:List*`, `tax:Get*` | Tax information | | `consolidatedbilling:Get*`, `consolidatedbilling:List*` | Consolidated billing information | | `invoicing:List*`, `invoicing:Get*` | Invoice information | | `freetier:Get*` | Free Tier usage | | `account:GetAccountInformation` | Account metadata | | `ec2:DescribeCapacity*` | EC2 capacity reservation information | | `ec2:DescribeReservedInstances*` | Reserved Instance information | | `ec2:DescribeSpot*` | Spot Instance information | | `rds:DescribeReserved*` | RDS Reserved Instance information | | `rds:DescribeDBRecommendations`, `rds:DescribeAccountAttributes` | RDS recommendations and account quotas | | `ecs:DescribeCapacityProviders` | ECS and Fargate capacity providers | | `es:DescribeReserved*` | OpenSearch reserved instance information | #### CUR Data Access For advanced data querying, Noros needs access to your Cost and Usage Report files. `NorthCloudWatchCrossAccountAccessRole` carries these permissions: | Permission | Purpose | | ---------------------- | ------------------------- | | `s3:GetObject` | CUR report file access | | `s3:ListBucket` | CUR report bucket listing | | `s3:GetBucketLocation` | CUR report bucket region | #### Compute Optimizer and Resource Data `NorthCostAndUsageRolePremium` carries these permissions: | Permission | Purpose | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- | | `compute-optimizer:*` | Read Compute Optimizer recommendations, and enroll your organization in Compute Optimizer | | `iam:CreateServiceLinkedRole`, `iam:PutRolePolicy` | Let AWS create the service-linked role that Compute Optimizer requires | | `organizations:EnableAWSServiceAccess` | Turn on trusted access for Compute Optimizer in AWS Organizations | | `organizations:ListAccounts` | List the accounts in your organization | | `ec2:DescribeInstances`, `ec2:DescribeVolumes`, `ecs:List*`, `autoscaling:DescribeAutoScalingGroups`, `lambda:ListFunctions`, `lambda:ListProvisionedConcurrencyConfigs` | Resource inventory | | `cloudwatch:GetMetricStatistics` | Aggregated CloudWatch metrics | | `rds:DescribeDBRecommendations`, `rds:DescribeReservedDBInstances*` | RDS recommendations and reservations | The two `iam:` permissions apply only to the Compute Optimizer service-linked role. `organizations:EnableAWSServiceAccess` applies only to Compute Optimizer. #### CloudWatch Metrics `NorthCloudWatchCrossAccountAccessRole` and `NorthCloudWatchCrossAccountSharingRole` carry these permissions: | Permission | Purpose | | ------------------------------------------------------------ | -------------------------------------- | | `sts:AssumeRole` on `NorthCloudWatchCrossAccountSharingRole` | Reach the sharing role in each account | | `cloudwatch:GetMetricData` | Read CloudWatch metrics | ### Optional: External ID During onboarding, you can configure an **External ID** for the cross-account IAM role. This is an AWS security best practice that adds an additional layer of protection against confused deputy attacks. To get an External ID, contact . The External ID on your role must match the value Noros holds for your account. If the two values differ, the daily verification check fails, and your cost data pauses until they match. ### Supported Customizations Some organizations change the roles in `north-all-features.yaml` to meet their own security policies. The table lists the changes Noros supports. For any other change, contact before you deploy it. | Change | Supported | What to know | | ------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Remove the `cloudwatch-crossaccount.amazonaws.com` trust statement from `NorthCloudWatchCrossAccountAccessRole` | Yes | Keep the statement that trusts `NorthCURReadOnly`. Noros uses that statement to read your Cost and Usage Reports. | | Add an `aws:ResourceOrgID` condition so that `NorthCloudWatchCrossAccountAccessRole` can assume sharing roles only in your organization | Yes | - | | Remove the `:root` principal from the `NorthCloudWatchCrossAccountSharingRole` trust policy, in your management account and in the StackSet | Yes | Keep `NorthCloudWatchCrossAccountAccessRole` as the trusted principal. Noros assumes the sharing roles only through that role. | | Remove the write permissions from `NorthCostAndUsageRolePremium` | Yes | Enroll in Compute Optimizer first. See [Removing Write Permissions from the Premium Role](#removing-write-permissions-from-the-premium-role). | | Use a different name for the Cost and Usage Report bucket | Yes | Send the bucket name to , and Noros configures your account with it. The default name, `north-cur-bucket-`, is preferred. | | Encrypt the Cost and Usage Report bucket with your own KMS key | No | Keep the default SSE-S3 encryption (`AES256`). If Noros cannot decrypt your reports, your cost data stops arriving. | | Trust named roles in account `480850768557` instead of the account root, in `NorthCostAndUsageRole` and `NorthCostAndUsageRolePremium` | No | Keep the account root as the principal, with an External ID if you use one. The roles in that account that assume these roles change as new features are released. | | Deploy `NorthCostAndUsageRolePremium` in a member account, such as a Compute Optimizer delegated administrator | No | Deploy it in your management account, with the rest of the stack. | #### Removing Write Permissions from the Premium Role `NorthCostAndUsageRolePremium` includes permissions that enroll your organization in Compute Optimizer. After your organization is enrolled, you can remove them and keep a read-only role. Do these steps in this order. If you remove the permissions before you enroll, the enrollment does not happen, and Compute Optimizer data covers your management account only. 1. Enroll your organization in Compute Optimizer, with member accounts included. 2. Turn on trusted access for Compute Optimizer in AWS Organizations. 3. Remove `iam:CreateServiceLinkedRole`, `iam:PutRolePolicy`, and `organizations:EnableAWSServiceAccess` from the role. 4. Replace `compute-optimizer:*` with `compute-optimizer:Get*`. Keep the read-only `Describe` and `List` actions and `organizations:ListAccounts` in the role. AWS enrolls member accounts that you add to your organization later. ### Transparency Noros is committed to transparency in the permissions it uses. This page lists every permission in the Noros stack and the one change those permissions can make in your account. If you have specific security requirements or need customized permissions, contact . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.noros.ai/getting-started/permissions-required/required-aws-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.