AWS permissions

The set of AWS permissions that is required by R‑Cloud and must be included in the AWS IAM role depends on whether the AWS account is added to R‑Cloud as compute or a source. Some permissions are common to both scenarios, while others are specific to a particular scenario:

Service	Permissions
EC2	Required when adding compute or a source: CreateNetworkInterface CreateTags DescribeAvailabilityZones DescribeInstances DescribeInstanceStatus DescribeInstanceTypeOfferings DescribeInstanceTypes DescribeNetworkInterfaces DescribeRegions DescribeSecurityGroups DescribeSubnets GetConsoleOutput ModifyInstanceAttribute RunInstances StartInstances StopInstances TerminateInstances Additionally required when adding a source: AllocateAddress AssociateAddress AttachVolume CopyFpgaImage CopyImage CopySnapshot CreateSnapshot CreateSnapshots CreateVolume DeleteSnapshot DeleteVolume DeregisterImage DescribeAddresses DescribeImages DescribeSnapshots DescribeVolumes DetachVolume ImportImage ImportInstance ImportKeyPair ImportSnapshot RegisterImage
Elastic Block (required only when adding a source)	CompleteSnapshot GetSnapshotBlock ListSnapshotBlocks PutSnapshotBlock StartSnapshot
IAM	Required when adding compute or a source: GetAccountSummary PassRole
SNS	Required when adding compute or a source: GetTopicAttributes Publish
SQS	Required when adding compute or a source: DeleteMessage GetQueueUrl ReceiveMessage
STS	Required when adding compute or a source: AssumeRole
S3 Express (required only when adding a source)	CreateSession ListAllMyDirectoryBuckets

Additionally, you must grant the following permissions to the AWS IAM role for performing operations on the target that you set up for storing data:

Service	Permissions
KMS	Decrypt Encrypt GenerateDataKey
STS	AssumeRole
S3	CreateBucket DeleteObject DeleteObjectVersion GetBucketLocation GetBucketObjectLockConfiguration GetBucketPublicAccessBlock GetBucketTagging GetBucketVersioning GetEncryptionConfiguration GetLifecycleConfiguration GetObject GetObjectTagging ListBucket ListBucketVersions PutBucketTagging PutObject PutObjectLegalHold PutObjectRetention PutObjectTagging PutObjectVersionTagging ReplicateTags