Required AWS Permissions

Noros follows the principle of least privilege. We request only the minimum permissions necessary to provide cost visibility and cloud spending insights for your AWS environment.

What Noros Cannot Do

Noros cannot:

• Read sensitive workload data
• Edit network rules or security groups
• Create, stop, or terminate instances
• Change, copy, or delete your data

The Noros roles can make one kind of change to your AWS account: NorthCostAndUsageRolePremium can enroll your organization in AWS Compute Optimizer. To remove that permission, see Removing Write Permissions from the Premium Role.

Permissions

During onboarding, you deploy the Noros CloudFormation stack, north-all-features.yaml, in your AWS management account. The stack creates these resources:

• NorthCostAndUsageRole. Reads cost, billing, and reservation data.
• NorthCostAndUsageRolePremium. Reads Compute Optimizer recommendations, resource inventory, and CloudWatch statistics. It can also enroll your organization in Compute Optimizer.
• NorthCloudWatchCrossAccountAccessRole. Reads your Cost and Usage Report files, and assumes the sharing role in each account to read CloudWatch metrics.
• NorthCloudWatchCrossAccountSharingRole. Grants cloudwatch:GetMetricData only. The stack creates it in your management account, and a StackSet creates it in every account in the organizational unit you select.
• A Cost and Usage Report bucket. The bucket is north-cur-bucket-<account-id>, with SSE-S3 encryption. When you deploy the stack in us-east-1, it also creates the Cost and Usage Report that AWS delivers to this bucket.

Cost & Billing Data

NorthCostAndUsageRole carries these permissions:

Permission	Purpose
ce:Get*, ce:Describe*, ce:List*	Cost Explorer read access
ce:Start*	Generate Savings Plans purchase recommendations
cur:Get*, cur:Validate*	Cost and Usage Report access
billing:Get*	Billing data access
payments:List*, payments:Get*	Payment information
tax:List*, tax:Get*	Tax information
consolidatedbilling:Get*, consolidatedbilling:List*	Consolidated billing information
invoicing:List*, invoicing:Get*	Invoice information
freetier:Get*	Free Tier usage
account:GetAccountInformation	Account metadata
ec2:DescribeCapacity*	EC2 capacity reservation information
ec2:DescribeReservedInstances*	Reserved Instance information
ec2:DescribeSpot*	Spot Instance information
rds:DescribeReserved*	RDS Reserved Instance information
rds:DescribeDBRecommendations, rds:DescribeAccountAttributes	RDS recommendations and account quotas
ecs:DescribeCapacityProviders	ECS and Fargate capacity providers
es:DescribeReserved*	OpenSearch reserved instance information

CUR Data Access

For advanced data querying, Noros needs access to your Cost and Usage Report files. NorthCloudWatchCrossAccountAccessRole carries these permissions:

Permission	Purpose
s3:GetObject	CUR report file access
s3:ListBucket	CUR report bucket listing
s3:GetBucketLocation	CUR report bucket region

Compute Optimizer and Resource Data

NorthCostAndUsageRolePremium carries these permissions:

Permission	Purpose
compute-optimizer:*	Read Compute Optimizer recommendations, and enroll your organization in Compute Optimizer
iam:CreateServiceLinkedRole, iam:PutRolePolicy	Let AWS create the service-linked role that Compute Optimizer requires
organizations:EnableAWSServiceAccess	Turn on trusted access for Compute Optimizer in AWS Organizations
organizations:ListAccounts	List the accounts in your organization
ec2:DescribeInstances, ec2:DescribeVolumes, ecs:List*, autoscaling:DescribeAutoScalingGroups, lambda:ListFunctions, lambda:ListProvisionedConcurrencyConfigs	Resource inventory
cloudwatch:GetMetricStatistics	Aggregated CloudWatch metrics
rds:DescribeDBRecommendations, rds:DescribeReservedDBInstances*	RDS recommendations and reservations

The two iam: permissions apply only to the Compute Optimizer service-linked role. organizations:EnableAWSServiceAccess applies only to Compute Optimizer.

CloudWatch Metrics

NorthCloudWatchCrossAccountAccessRole and NorthCloudWatchCrossAccountSharingRole carry these permissions:

Permission	Purpose
sts:AssumeRole on NorthCloudWatchCrossAccountSharingRole	Reach the sharing role in each account
cloudwatch:GetMetricData	Read CloudWatch metrics

Optional: External ID

During onboarding, you can configure an External ID for the cross-account IAM role. This is an AWS security best practice that adds an additional layer of protection against confused deputy attacks.

To get an External ID, contact [e-mail]. The External ID on your role must match the value Noros holds for your account. If the two values differ, the daily verification check fails, and your cost data pauses until they match.

Supported Customizations

Some organizations change the roles in north-all-features.yaml to meet their own security policies. The table lists the changes Noros supports. For any other change, contact [e-mail] before you deploy it.

Change	Supported	What to know
Remove the cloudwatch-crossaccount.amazonaws.com trust statement from NorthCloudWatchCrossAccountAccessRole	Yes	Keep the statement that trusts NorthCURReadOnly. Noros uses that statement to read your Cost and Usage Reports.
Add an aws:ResourceOrgID condition so that NorthCloudWatchCrossAccountAccessRole can assume sharing roles only in your organization	Yes	-
Remove the :root principal from the NorthCloudWatchCrossAccountSharingRole trust policy, in your management account and in the StackSet	Yes	Keep NorthCloudWatchCrossAccountAccessRole as the trusted principal. Noros assumes the sharing roles only through that role.
Remove the write permissions from NorthCostAndUsageRolePremium	Yes	Enroll in Compute Optimizer first. See Removing Write Permissions from the Premium Role.
Use a different name for the Cost and Usage Report bucket	Yes	Send the bucket name to [e-mail], and Noros configures your account with it. The default name, north-cur-bucket-<account-id>, is preferred.
Encrypt the Cost and Usage Report bucket with your own KMS key	No	Keep the default SSE-S3 encryption (AES256). If Noros cannot decrypt your reports, your cost data stops arriving.
Trust named roles in account 480850768557 instead of the account root, in NorthCostAndUsageRole and NorthCostAndUsageRolePremium	No	Keep the account root as the principal, with an External ID if you use one. The roles in that account that assume these roles change as new features are released.
Deploy NorthCostAndUsageRolePremium in a member account, such as a Compute Optimizer delegated administrator	No	Deploy it in your management account, with the rest of the stack.

Removing Write Permissions from the Premium Role

NorthCostAndUsageRolePremium includes permissions that enroll your organization in Compute Optimizer. After your organization is enrolled, you can remove them and keep a read-only role. Do these steps in this order. If you remove the permissions before you enroll, the enrollment does not happen, and Compute Optimizer data covers your management account only.

1. Enroll your organization in Compute Optimizer, with member accounts included.
2. Turn on trusted access for Compute Optimizer in AWS Organizations.
3. Remove iam:CreateServiceLinkedRole, iam:PutRolePolicy, and organizations:EnableAWSServiceAccess from the role.
4. Replace compute-optimizer:* with compute-optimizer:Get*.

Keep the read-only Describe and List actions and organizations:ListAccounts in the role. AWS enrolls member accounts that you add to your organization later.

Transparency

Noros is committed to transparency in the permissions it uses. This page lists every permission in the Noros stack and the one change those permissions can make in your account. If you have specific security requirements or need customized permissions, contact [e-mail].