Overview

When installing CloudFix templates in your AWS target accounts, you notice that CloudFix creates certain Groups/Roles and grants itself write permissions through 'core' inline-policy. You want to know if these write permissions can be removed and without them, would CloudFix be able to generate at least the recommendations.

Information

• For generating recommendations, most Finder permissions are Read/List/Describe/Get/Retrieve types. Almost all of them are passive and read-only. They don't make write changes to any resource or service — they only gather information so CloudFix can generate meaningful recommendations.
  One exception is intentional: Finders for some services are also granted a narrow, scoped permission to add a cloudfix:-prefixed tag (for example cloudfix:finderIds) to the specific resource where an opportunity was found. This is still part of the Finder's job, not the Fixer's — it's how CloudFix tracks and calculates savings for that resource, and it does not modify the resource itself.
  Manually editing the standard onboarding stack to strip out individual write permissions — including this tagging permission or the write permissions used to set up Usage & Reports (Athena, CloudWatch Logs, SNS, AWS Config Recorder, etc.) — is not advisable and is not a tested configuration. There are complex inter-dependencies between these permissions, and removing them selectively can silently break recommendations or savings calculations for some Finders.
• If your goal is to run CloudFix with no Fixer/remediation capability at all, that's a supported configuration — you don't need to edit the standard stack to get it. CloudFix offers a dedicated Finder-only (read-only) version of the resource-account CloudFormation stack. Ask your CloudFix contact for it if you want to install this way instead of the standard stack.
  • What still works: Every Finder still runs and the CloudFix dashboard still shows recommendations and savings estimates, since generating recommendations only needs read access. The scoped cloudfix: tagging permission described above is still included by default, so savings tracking for the Finders that rely on it keeps working. Cost & Usage Report (CUR) setup still needs its own write permissions on the parent onboarding template, exactly as with the standard stack — that's unrelated to Fixer capability.
  • What you lose: All automatic remediation. The Finder-only stack does not create the roles CloudFix uses to run fixes — the roles used to generate and execute AWS Systems Manager Automation runbooks — so there is nothing for CloudFix to assume even to attempt a fix. You'd remediate found opportunities yourself, or move to the standard stack later if you want CloudFix to be able to fix them for you.
• Either way, rest assured that no changes to your core resources (EC2, EBS volumes, S3, etc.) happen on their own. On the standard stack, a fix only runs after you open the recommendation and explicitly generate and execute it. That execution is performed using a role created in your account by CloudFix, which CloudFix cannot assume or access outside of that action.

Related Articles

• Write to Customer AWS Accounts
• What's in the CloudFix CF Template?
• CloudFix Permission Model