CloudFix IAM Roles
Overview
This document outlines the IAM roles used by CloudFix, organized by their primary functions. Each role has specific permissions that enable CloudFix's cost optimization features.
For a higher-level summary of how the Finder/Fixer permission model works and how these roles fit into CloudFix's approval flow, see CloudFix Permission Model.
Role Categories
-
Core Functionality Roles - Handle basic CloudFix operations
-
Finder Roles - Discover and analyze resources
-
Fixer Roles - Execute cost optimization changes
-
Helper Roles - Support auxiliary functions
-
Cleanup Roles - Manage resource deletion
Security Notes
-
All roles follow least-privilege principles
-
Account and resource-level permissions are used where possible (demo account number 12341231234 is used throughout this document).
-
Actions are limited to specific service areas
-
Changes require approval through defined workflows
Core Functionality Roles
1. cloudfix-athena-query-execution-role
Primary role for cost analysis and reporting.
Key Capabilities:
-
Queries AWS Cost and Usage Reports via Athena
-
Manages AWS Organizations data
-
Controls CloudFormation stacks
-
Handles Glue operations for data processing
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::cloudfix-cur-123412341234",
"arn:aws:s3:::cloudfix-cur-123412341234/*"
],
"Effect": "Allow"
},
{
"Action": [
"cloudformation:DescribeStacks",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"organizations:ListAccountsForParent",
"organizations:ListRoots",
"organizations:DescribeOrganizationalUnit",
"organizations:ListChildren"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"athena:StartQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryResults"
],
"Resource": "arn:aws:athena:*:123412341234:workgroup/CloudFixWorkspace",
"Effect": "Allow"
},
{
"Action": [
"cloudformation:CreateStackInstances",
"cloudformation:DescribeStackSetOperation"
],
"Resource": [
"arn:aws:cloudformation:*:123412341234:stackset-target/*CloudFixOrgStackSet*",
"arn:aws:cloudformation:*:123412341234:stackset/*CloudFixOrgStackSet*"
],
"Effect": "Allow"
},
{
"Action": [
"cloudformation:CreateStackInstances"
],
"Resource": [
"arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Role",
"arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Group",
"arn:aws:cloudformation:us-east-1::type/resource/AWS-IAM-Policy",
"arn:aws:cloudformation:us-east-1::type/resource/AWS-CloudFormation-CustomResource",
"arn:aws:cloudformation:us-east-1::type/resource/AWS-S3-Bucket",
"arn:aws:cloudformation:us-east-1::type/resource/AWS-Lambda-Function"
],
"Effect": "Allow"
},
{
"Action": "glue:*",
"Resource": [
"arn:aws:glue:us-east-1:123412341234:catalog",
"arn:aws:glue:us-east-1:123412341234:database/cloudfixdb",
"arn:aws:glue:us-east-1:123412341234:table/cloudfixdb/*",
"arn:aws:glue:us-east-1:123412341234:userDefinedFunction/cloudfixdb/*"
],
"Effect": "Allow"
},
{
"Action": "ce:UpdateCostAllocationTagsStatus",
"Resource": "*",
"Effect": "Allow"
}
]
}
2. CloudFix-prod-CURStack-CURLambdaExecutor
Manages Cost and Usage Report processing.
Key Functions:
-
CloudWatch logging
-
S3 bucket notifications
-
Cost allocation tagging
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:PutBucketNotification"
],
"Resource": "arn:aws:s3:::cloudfix-cur-123412341234"
},
{
"Effect": "Allow",
"Action": [
"ce:UpdateCostAllocationTagsStatus",
"support:CreateCase"
],
"Resource": "*"
}
]
}
3. CloudFix-prod-CURStack-AWSCURCrawlerLambdaExecut
Controls Glue crawler operations for CUR data.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"glue:StartCrawler"
],
"Resource": "arn:aws:glue:us-east-1:123412341234:crawler/AWSCURCrawler-CloudFix-CUR"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
}
]
}
4. CloudFix-prod-CURStack-1S-AWSCURCrawlerComponentFun
Handles Glue processing of CUR data.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::cloudfix-cur-123412341234/cloudfix/CloudFix-CUR/CloudFix-CUR*"
},
{
"Effect": "Allow",
"Action": [
"glue:*"
],
"Resource": [
"arn:aws:glue:us-east-1:123412341234:database/cloudfixdb",
"arn:aws:glue:us-east-1:123412341234:table/cloudfixdb*",
"arn:aws:glue:us-east-1:123412341234:catalog"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::cloudfix-cur-123412341234"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:/aws-glue/*"
}
]
}
Finder Roles
cloudfix-finder-role
Discovers optimization opportunities across AWS services.
Key Capabilities:
-
Resource metadata collection
-
Configuration analysis
-
Usage metrics gathering
-
Cost optimization identification
{
"Effect": "Allow",
"Action": [
"application-autoscaling:DescribeScalableTargets",
"autoscaling:DescribeAutoScalingGroups",
"ce:GetReservationPurchaseRecommendation",
"cloudfront:GetCachePolicy",
"cloudfront:GetDistributionConfig",
"cloudfront:ListTagsForResource",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetInsightSelectors",
"cloudtrail:GetTrailStatus",
"cloudtrail:listTags",
"cloudtrail:ListTrails",
"cloudtrail:LookupEvents",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics",
"compute-optimizer:GetAutoScalingGroupRecommendations",
"compute-optimizer:GetEC2InstanceRecommendations",
"compute-optimizer:GetEC2RecommendationProjectedMetrics",
"compute-optimizer:GetECSServiceRecommendations",
"compute-optimizer:GetEnrollmentStatus",
"compute-optimizer:GetLicenseRecommendations",
"compute-optimizer:GetRDSRecommendationProjectedMetrics",
"dms:DescribeReplicationInstances",
"dms:DescribeReplicationTasks",
"dms:ListTagsForResource",
"dynamodb:DescribeTable",
"dynamodb:ListTagsOfResource",
"ebs:ListChangedBlocks",
"ebs:ListSnapshotBlocks",
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:DescribeAddresses",
"ec2:DescribeAddressesAttribute",
"ec2:DescribeFastSnapshotRestores",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeNatGateWays",
"ec2:DescribeNatGateways",
"ec2:DescribeRegions",
"ec2:DescribeReservedInstances",
"ec2:DescribeRouteTables",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:GetLaunchTemplateData",
"ecs:DescribeCapacityProviders",
"ecs:DescribeClusters",
"ecs:DescribeServices",
"ecs:DescribeTaskDefinition",
"ecs:DescribeTasks",
"ecs:ListClusters",
"ecs:ListContainerInstances",
"ecs:ListServices",
"ecs:ListTagsForResource",
"ecs:ListTasks",
"eks:DescribeCluster",
"eks:ListClusters",
"eks:ListTagsForResource",
"elasticache:DescribeCacheClusters",
"elasticache:ListTagsForResource",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeLifecycleConfiguration",
"elasticfilesystem:ListTagsForResource",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTags",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:GetManagedScalingPolicy",
"elasticmapreduce:ListClusters",
"elasticmapreduce:ListInstanceGroups",
"elasticmapreduce:ListInstances",
"emr:DescribeCluster",
"es:DescribeDomain",
"es:DescribeDomainChangeProgress",
"es:DescribeDomains",
"es:ListTags",
"iam:GetInstanceProfile",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"kendra:DescribeDataSource",
"kendra:DescribeIndex",
"kendra:ListDataSources",
"kendra:ListTagsForResource",
"lambda:GetFunction",
"logs:DescribeLogGroups",
"logs:GetQueryResults",
"logs:ListTagsForResource",
"logs:StartQuery",
"pricing:GetProducts",
"quicksight:ListTagsForResource",
"quicksight:ListUsers",
"quicksight:SearchAnalyses",
"quicksight:SearchDashboards",
"quicksight:SearchDataSets",
"quicksight:SearchDataSources",
"rds:DescribeDBClusters",
"rds:DescribeDBInstances",
"rds:DescribeOrderableDBInstanceOptions",
"rds:ListTagsForResource",
"route53:ListHostedZones",
"route53:ListResourceRecordSets",
"s3:GetBucketTagging",
"s3:GetLifecycleConfiguration",
"s3:ListAllMyBuckets",
"sagemaker:DescribeEndpoint",
"sagemaker:DescribeEndpointConfig",
"sagemaker:DescribeTransformJob",
"sagemaker:ListApps",
"sagemaker:ListEndpointConfigs",
"sagemaker:ListEndpoints",
"sagemaker:ListModels",
"sagemaker:ListNotebookInstances",
"sagemaker:ListProcessingJobs",
"sagemaker:ListTrainingJobs",
"sagemaker:ListTransformJobs",
"servicequotas:GetServiceQuota",
"ssm:DescribeAssociation",
"ssm:ListAssociations",
"ssm:ListTagsForResource",
"tag:TagResources"
],
"Resource": "*"
}
Fixer Roles
CloudFix fixer roles execute cost optimization changes. All fixers can be enabled or disabled centrally through the CloudFix control panel.
Global Safeguards
-
Central Control: Each fixer can be individually enabled/disabled
-
Approval Required: All changes need explicit approval before execution
-
Rollback Plans: Each fixer includes rollback procedures
-
Change Windows: Fixes only run during approved maintenance windows
-
Resource Locking: Prevents concurrent modifications to resources
-
Audit Trails: All actions are logged and traceable
1. cloudfix-ssm-update-role
Executes approved optimization tasks.
Key Functions:
-
Manages SSM automation
-
Controls resource tagging
-
Handles SNS notifications
-
Executes approved runbooks
Safety Features:
-
Validates resource state before changes
-
Checks dependencies
-
Confirms resource availability
-
Verifies permissions before execution
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateDocument",
"ssm:GetDocument",
"ssm:UpdateDocument",
"ssm:UpdateDocumentMetadata",
"ssm:DescribeDocument",
"ssm:ListDocumentVersions",
"ssm:StartChangeRequestExecution",
"ssm:DeleteDocument",
"ssm:ListDocuments",
"ssm:UpdateDocumentDefaultVersion",
"ssm:GetAutomationExecution",
"ssm:GetOpsItem",
"ssm:DescribeOpsItems",
"ssm:ListOpsItemEvents",
"ssm:UpdateOpsItem",
"ssm:StartAutomationExecution",
"ssm:StopAutomationExecution",
"ssm:SendAutomationSignal",
"ssm:DescribeAutomationStepExecutions",
"ssm:DescribeAutomationExecutions",
"ssm:AddTagsToResource",
"iam:ListRoles",
"iam:ListUsers",
"iam:ListGroups",
"iam:GetGroup",
"iam:CreateServiceLinkedRole",
"ssm:GetOpsSummary",
"ssm:GetOpsMetadata",
"sns:CreateTopic",
"sns:ConfirmSubscription",
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting",
"autoscaling:CreateOrUpdateTags",
"backup:TagResource",
"cloudfront:TagResource",
"dlm:TagResource",
"dynamodb:TagResource",
"ec2:CreateTags",
"elasticfilesystem:CreateTags",
"rds:AddTagsToResource",
"elasticfilesystem:TagResource",
"es:AddTags",
"s3:PutBucketTagging",
"tag:TagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::cloudfix-runbook-bucket-zip/*"
}
]
}
2. cloudfix-ssm-assumed-role
Performs actual resource modifications through Systems Manager.
Security Features:
-
Requires runbook approval from authorized approvers
-
Validates customer subscriptions and entitlements
-
Limited to authorized changes within scope
-
Respects resource tagging policies
-
Enforces rate limiting on changes
-
Maintains detailed audit logs
Operational Controls:
-
Checks resource health before changes
-
Validates backup existence where needed
-
Tests rollback procedures
-
Monitors service quotas
-
Respects maintenance windows
-
Enforces cool-down periods between changes
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::123412341234:role/cloudfix-ssm-assumed-role"
},
{
"Effect": "Allow",
"Action": [
"cloudfront:CreateCachePolicy",
"cloudfront:GetCachePolicy",
"cloudfront:GetCachePolicyConfig",
"cloudfront:GetDistributionConfig",
"cloudfront:ListCachePolicies",
"cloudfront:TagResource",
"cloudfront:UpdateCachePolicy",
"cloudfront:UpdateDistribution",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudtrail:LookupEvents",
"cloudtrail:StopLogging",
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms",
"cloudwatch:PutMetricAlarm",
"compute-optimizer:GetRDSRecommendationProjectedMetrics",
"compute-optimizer:UpdateEnrollmentStatus",
"dms:CreateReplicationInstance",
"dms:CreateReplicationTask",
"dms:DeleteReplicationInstance",
"dms:DeleteReplicationTask",
"dms:DescribeReplicationInstances",
"dynamodb:DescribeTable",
"dynamodb:TagResource",
"dynamodb:UpdateTable",
"ec2:AssociateIamInstanceProfile",
"ec2:CreateLaunchTemplate",
"ec2:CreateNetworkInterface",
"ec2:CreateSnapshot",
"ec2:CreateSnapshots",
"ec2:CreateTags",
"ec2:CreateVpcEndpoint",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkInterface",
"ec2:DeleteSnapshot",
"ec2:DeleteVolume",
"ec2:DeleteVpcEndpointServiceConfigurations",
"ec2:DescribeAddresses",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcs",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySnapshotTier",
"ec2:ModifyVolume",
"ec2:ModifyVpcAttribute",
"ec2:MonitorInstances",
"ec2:ReleaseAddress",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ecs:DeregisterTaskDefinition",
"ecs:DescribeClusters",
"ecs:DescribeServices",
"ecs:DescribeTaskDefinition",
"ecs:DescribeTasks",
"ecs:ListServices",
"ecs:ListTasks",
"ecs:RegisterTaskDefinition",
"ecs:TagResource",
"ecs:UntagResource",
"ecs:UpdateService",
"elasticache:AddTagsToResource",
"elasticache:CreateReplicationGroup",
"elasticache:DeleteCacheCluster",
"elasticache:DeleteReplicationGroup",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeReplicationGroups",
"elasticache:DescribeSnapshots",
"elasticache:ModifyReplicationGroup",
"elasticfilesystem:CreateTags",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeLifecycleConfiguration",
"elasticfilesystem:PutLifecycleConfiguration",
"elasticfilesystem:TagResource",
"elasticfilesystem:UpdateFileSystem",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"es:AddTags",
"es:DescribeDomain",
"es:DescribeDomainChangeProgress",
"es:ListTags",
"es:UpdateDomainConfig",
"iam:AddRoleToInstanceProfile",
"iam:AttachRolePolicy",
"iam:CreateInstanceProfile",
"iam:CreateRole",
"iam:CreateServiceLinkedRole",
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:ListInstanceProfilesForRole",
"iam:PassRole",
"iam:PutRolePolicy",
"kendra:CreateDataSource",
"kendra:CreateIndex",
"kendra:DeleteIndex",
"kms:DescribeKey",
"logs:PutRetentionPolicy",
"quicksight:DeleteUserByPrincipalId",
"quicksight:UpdateAnalysisPermissions",
"quicksight:UpdateDashboardPermissions",
"quicksight:UpdateDataSetPermissions",
"quicksight:UpdateDataSourcePermissions",
"rds:AddTagsToResource",
"rds:CreateDBInstance",
"rds:CreateDBSnapshot",
"rds:DeleteDBCluster",
"rds:DeleteDBInstance",
"rds:DescribeDBClusters",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBInstances",
"rds:DescribeDBSnapshots",
"rds:FailoverDBCluster",
"rds:ListTagsForResource",
"rds:ModifyDBCluster",
"rds:ModifyDBInstance",
"rds:RemoveTagsFromResource",
"rds:RestoreDBClusterFromSnapshot",
"s3:CreateBucket",
"s3:GetBucketTagging",
"s3:GetLifecycleConfiguration",
"s3:ListBucket",
"s3:PutBucketTagging",
"s3:PutLifecycleConfiguration",
"s3:PutObject",
"sagemaker:AddTags",
"sagemaker:CreateNotebookInstanceLifecycleConfig",
"sagemaker:DescribeNotebookInstance",
"sagemaker:ListNotebookInstanceLifecycleConfigs",
"sagemaker:StartNotebookInstance",
"sagemaker:StopNotebookInstance",
"sagemaker:UpdateNotebookInstance",
"sns:Publish",
"ssm:CreateAssociation",
"ssm:DeleteAssociation",
"ssm:GetAutomationExecution",
"ssm:PutParameter",
"ssm:StartAutomationExecution",
"ssm:UpdateAssociation"
],
"Resource": "*"
}
]
}
3. cloudfix-fixer-approver-role
Controls automation workflow approvals and oversees fix execution.
Core Functions:
-
Reviews and approves runbook execution
-
Monitors fix progress
-
Controls automation workflows
-
Manages approval chains
-
Enforces approval policies
Safety Controls:
-
Validates approver permissions
-
Ensures multi-party review where needed
-
Tracks approval history
-
Enforces separation of duties
-
Manages emergency approval processes
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:SendAutomationSignal",
"ssm:GetOpsItem",
"ssm:GetDocument",
"ssm:GetServiceSetting",
"ssm:ListDocuments",
"ssm:ListDocumentVersions",
"ssm:DescribeDocument",
"ssm:UpdateDocumentMetadata"
],
"Resource": "*"
}
]
}
Helper Roles
cloudfix-backup-job-role
Manages backup operations. As well as the core poolicy below, the role uses the AWS managed policies AWSBackupServiceRolePolicyForBackup and AWSBackupServiceRolePolicyForRestores
Key Functions:
-
Creates and manages backups
-
Handles restoration tasks
-
Controls backup vault access
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"backup:DescribeBackupVault",
"backup:CopyIntoBackupVault",
"backup:CopyFromBackupVault",
"elasticfilesystem:Backup",
"elasticfilesystem:DescribeTags"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:DescribeVolumes"
],
"Resource": [
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:volume/*"
],
"Effect": "Allow"
},
{
"Action": [
"ec2:DescribeSnapshots",
"ec2:DescribeTags"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ec2:CopySnapshot",
"ec2:CreateTags",
"ec2:DeleteSnapshot"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Effect": "Allow"
},
{
"Condition": {
"Null": {
"aws:ResourceTag/aws:backup:source-resource": "false"
}
},
"Action": "ec2:ModifySnapshotAttribute",
"Resource": "*",
"Effect": "Allow"
}
]
}
Cleanup Roles
CloudFix-prod-CURStack-1S-cleanupBucketOnDeleteLamb
Manages resource cleanup.
Key Functions:
-
Removes S3 objects
-
Deletes buckets
-
Handles CUR stack cleanup
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:PutBucketNotification"
],
"Resource": "arn:aws:s3:::cloudfix-cur-123412341234"
},
{
"Effect": "Allow",
"Action": [
"ce:UpdateCostAllocationTagsStatus",
"support:CreateCase"
],
"Resource": "*"
}
]
}
Security & compliance resources
For CloudFix's current certifications, security architecture, data-handling and sub-processor commitments, see the CloudFix Trust Center:
Bill Gleeson
Comments