AWS Permissions

Fine-grain permissions for AWS

When creating a Harness IAM Role in AWS for CACM, there are many different permissions sets based on the features you are trying to leverage in specific accounts. This guide is meant to cover all the different features of CACM and the permissions you need to assign to enable them.

To enable specific features on a connector you need to set a specific string in the featuresEnabled field (list) in the connector YAML. The keys for each feature are listed in the sections below.

Testing Permissions

WHEN TO ENABLE

All accounts

No matter the feature you are using, when testing connector health in the UI Harness attempts to check it's own access using iam:SimulatePrincipalPolicy.

{
    "Statement": [
        {
            "Action": "iam:SimulatePrincipalPolicy",
            "Effect": "Allow",
            "Resource": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/{ROLE_NAME}",
            "Sid": "test"
        }
    ],
    "Version": "2012-10-17"
}

Cost Ingestion

FEATURESENABLED

BILLING

WHEN TO ENABLE

Master/Payer or any account which has a CUR you need to ingest

To ingest cost from AWS, Harness leverages a Cost and Usage Report (CUR) that is generated by AWS. These reports are delivered to an S3 bucket in your payer account. When assigning permissions, provide the following access so Harness can receive the data and load it into your Harness account:

• Read access to the S3 bucket where the CUR reports are delivered.

• Write access to a Harness-owned bucket.

We also include some permissions for Organizations so we can collect things like account names, account tags and access to see the definition of the CUR to make sure it matches Harness standards.

Finally we ask for ce:GetRightsizingRecommendation to collect Compute Optimizer recommendations at the organization level, to be shown in Harness Recommendations.

{
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::{YOUR_CUR_BUCKET_NAME}/*",
                "arn:aws:s3:::{YOUR_CUR_BUCKET_NAME}"
            ],
            "Sid": "readBillingBucket"
        },
        {
            "Action": [
                "s3:PutObjectAcl",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::{HARNESS_S3_BUCKET}*/*",
                "arn:aws:s3:::{HARNESS_S3_BUCKET}*"
            ],
            "Sid": "writeHarnessBucket"
        },
        {
            "Action": [
                "organizations:List*",
                "organizations:Describe*",
                "cur:DescribeReportDefinitions",
                "ce:GetRightsizingRecommendation"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "readOrg"
        }
    ],
    "Version": "2012-10-17"
}

In the above policy {YOUR_CUR_BUCKET_NAME} needs to be replaced with your S3 bucket where CUR reports are being delivered.

{HARNESS_S3_BUCKET} is the Harness S3 bucket where your CUR will be copied to. This bucket changes based on your Harness account, but most customers will use ce-customer-billing-data-prod.

Events/Inventory

FEATURESENABLED

VISIBILITY

WHEN TO ENABLE

Accounts where infrastructure is provisioned, usually every account except for the master/payer

To let Harness collect inventory data (used in dashboards) you need to give read permissions to EC2, RDS, ECS and CloudWatch as well as collect Compute Optimizer recommendations for EC2.

The ECS permissions are also used to generate recommendations to best-fit your task sizing for cost savings.

{
    "Statement": [
        {
            "Action": [
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBSnapshotAttributes",
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "ecs:ListTasks",
                "ecs:ListServices",
                "ecs:ListContainerInstances",
                "ecs:ListClusters*",
                "ecs:DescribeTasks",
                "ecs:DescribeServices",
                "ecs:DescribeContainerInstances",
                "ecs:DescribeClusters",
                "ec2:DescribeVolumes",
                "ec2:DescribeSnapshots",
                "ec2:DescribeRegions",
                "ec2:DescribeInstances*",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListMetrics",
                "ce:GetRightsizingRecommendation"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "inventory"
        }
    ],
    "Version": "2012-10-17"
}

Asset Governance

FEATURESENABLED

GOVERNANCE

WHEN TO ENABLE

Accounts where infrastructure is provisioned, usually every account except for the master/payer

When enabling asset governance, it is best practice to start with a read-only policy so you can run rules in dry-run, receive out-of-the-box recommendations, and begin to create your own custom governance recommendations.

We suggest you use the AWS-provided ReadOnlyAccess policy which will allow Harness to access AWS resources in a read-only manner.

arn:aws:iam::aws:policy/job-function/ReadOnlyAccess

Once you are ready to perform actions using governance, you can create a custom policy to allow only the actions you want to take via governance, or use built-in policies to provide whatever access you are comfortable with.

For example if you are going to begin auto-deleting snapshots using governance, you might assign ec2:DeleteSnapshot or arn:aws:iam::aws:policy/AmazonEC2FullAccess.

Commitment Orchestrator

FEATURESENABLED

COMMITMENT_ORCHESTRATOR

WHEN TO ENABLE

Master/Payer accounts

To start getting insights into your savings breakdown, spend breakdown, compute coverage, commitment utilization, and inventory of RIs and SPs, give these read-only permissions in your payer account:

{
    "Statement": [
        {
            "Action": [
                "ec2:DescribeReservedInstancesOfferings",
                "ce:GetSavingsPlansUtilization",
                "ce:GetReservationUtilization",
                "ec2:DescribeInstanceTypeOfferings",
                "ce:GetDimensionValues",
                "ce:GetSavingsPlansUtilizationDetails",
                "ec2:DescribeReservedInstances",
                "ce:GetReservationCoverage",
                "ce:GetSavingsPlansCoverage",
                "savingsplans:DescribeSavingsPlans",
                "organizations:DescribeOrganization",
                "ce:GetCostAndUsage",
                "rds:DescribeReservedDBInstancesOfferings",
                "rds:DescribeReservedDBInstances",
                "pricing:GetProducts"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "viewcoverage"
        }
    ],
    "Version": "2012-10-17"
}

To get recommendations in the actions tab and to make purchases either automatically or manually, give these permissions in your payer account:

{
    "Statement": [
        {
            "Action": [
                "ec2:PurchaseReservedInstancesOffering",
                "ec2:GetReservedInstancesExchangeQuote",
                "ec2:AcceptReservedInstancesExchangeQuote",
                "ec2:DescribeReservedInstancesModifications",
                "ec2:ModifyReservedInstances",
                "savingsplans:DescribeSavingsPlansOfferings",
                "savingsplans:CreateSavingsPlan",
                "rds:PurchaseReservedDBInstancesOffering"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "purchase"
        }
    ],
    "Version": "2012-10-17"
}

Autostopping

FEATURESENABLED

OPTIMIZATION

WHEN TO ENABLE

Accounts where infrastructure is provisioned, usually every account except for the master/payer

Autostopping has many ways to optimize resource usage and reduce costs. Across the different compute and routing SKUs there are many possible permissions needed. Based on your compute and application architecture you can use the following information to build a least-privileged policy.

For schedule or dependency based autostopping you will only need the permissions listed under the target resource type.

For ALB or Proxy based autostopping you will need both the ALB and Proxy permissions along with the specific resource actions.

ALB

To use EC2, ECS, or ASG autostopping with ALBs add the permissions below.

Policy	Usage
acm:ListCertificates	Describe certificates in create ALB flow
ec2:DescribeVpcs	List VPCs in create ALB flow
ec2:DescribeSecurityGroups	List security groups in create ALB flow
elasticloadbalancing:DescribeLoadBalancers	Describe load balancers in create ALB flow
iam:ListRoles	Lambda requires a role to execute and push the logs to cloud watch. We have a separate role for that. iam:ListRoles is used in code to list roles and identify the role created for lambda.
ec2:DescribeSubnets	List subnets for the selected VPC while creating ALB.
elasticloadbalancing:CreateLoadBalancer	Create ALB. Needed only if customer wants to create ALB from Harness
elasticloadbalancing:SetSecurityGroups	Attach security groups to ALB. Needed only if customer wants to create ALB from Harness.
elasticloadbalancing:DescribeTargetGroups	Describe target group. This is used to get details of lambda target group and EC2 target group
elasticloadbalancing:CreateTargetGroup	Create lambda target group and health check target group
elasticloadbalancing:AddTags	Add tags to Harness created target groups
lambda:GetFunction	Get lambda function details
lambda:CreateFunction	Create lambda function
iam:PassRole	We specify the lambda role when we try to create lambda. Create lambda with role in request will succeed only if this permission is present
lambda:AddPermission	This is needed to allow the lambda Target Group to execute the lambda.
elasticloadbalancing:RegisterTargets	Required to add lambda to target group
lambda:DeleteFunction	Delete lambda while deleting the load balancer
elasticloadbalancing:DeleteLoadBalancer	Only required if user trigger delete load balancer from Harness UI
elasticloadbalancing:DescribeTargetHealth	Get the target group health check details during warm up and to populate health check details in UI while creating rule.
elasticloadbalancing:DescribeListeners	Get listeners of ALB
elasticloadbalancing:CreateListener	Create new listener in ALB if doesn't exist
elasticloadbalancing:DescribeRules	Needed while creating new rule. We check existing rules and modify priority if required.
elasticloadbalancing:CreateRule	Create ALB rule
elasticloadbalancing:DescribeTags	Get tags of rules. ALB rules created by Harness will have Harness specific tags
elasticloadbalancing:DeleteTargetGroup	Delete target groups
elasticloadbalancing:DeleteRule	Delete ALB rule while editing/deleting Autostopping rules
elasticloadbalancing:SetRulePriorities	Modify existing rules priorities to make sure the ALB rules created by Harness get more priority
elasticloadbalancing:ModifyTargetGroup	Modify target group
elasticloadbalancing:ModifyRule	Modify ALB rule
cloudwatch:GetMetricStatistics	Traffic detection read cloud watch metrics to check the usage on a target group.
s3:ListBucket	Need only if custom exclusion is used. This is to read the access log from S3
s3:GetObject	Need only if custom exclusion is used. This is to read the access log from S3
s3:ListAllMyBuckets	Need only if custom exclusion is used. This is to read the access log from S3
s3:GetBucketLocation	Need only if custom exclusion is used. This is to read the access log from S3
elasticloadbalancing:DescribeLoadBalancerAttributes	Need only if custom exclusion is used.Needed to get the access logs details from ALB.
logs:CreateLogGroup	Permission assigned to the Lambda. This is to push the logs while running the lambda.
logs:CreateLogStream	Permission assigned to the Lambda. This is to push the logs while running the lambda.
logs:PutLogEvents	Permission assigned to the Lambda. This is to push the logs while running the lambda.

Proxy

To use EC2, ECS, ASG or RDS autostopping with proxies add the permissions below.

Policy	Usage
ec2:DescribeInstanceTypeOfferings	List machine types available for Proxy
ec2:DescribeKeyPairs	List key pairs for Proxy
ec2:RunInstances	Create Proxy VM
secretsmanager:GetSecretValue	Permission to read TLS certificate and secret. Needed only if TLS is used.
ec2:AllocateAddress	Allocate static IP
ec2:DescribeVpcs	List VPCs in create proxy flow
ec2:DescribeSecurityGroups	List security groups in create proxy flow
ec2:DescribeSubnets	List subnets for the selected VPC while creating ALB.
ec2:TerminateInstances	Delete the Proxy VM while deleting proxy Scope of this permission can be reduced to only proxy VMs.
ec2:DescribeImages	Describe the image for proxy
ec2:AssociateAddress	Associating address with VM
ec2:DisassociateAddress	Disassociate address while deleting proxy
ec2:ReleaseAddress	Release address while deleting proxy
ec2:ModifyInstanceAttribute	Modify security group of proxy VM if needed

EC2

Policy	Usage
ec2:DescribeInstances	List VMS in Harness UI for rule creation and in rule details page. This will be used in other operations while starting and stopping the VM.
ec2:CreateTags	Create tags on the EC2 while creating an Autostopping rule.
ec2:StartInstances	Start EC2
ec2:StopInstances	Stop EC2

EC2 Spot

Policy	Usage
ec2:DescribeVolumes ec2:CreateImage ec2:DescribeImages	Creating Snapshot for Spot VM
ec2:TerminateInstances	Spot VMs are terminate during cool down instead of stopping.
ec2:DeregisterImage ec2:DeleteSnapshot	Delete snapshot after deleting Autostopping rule
ec2:RequestSpotInstances ec2:DescribeSpotInstanceRequests ec2:DescribeAddresses	Create spot VM during warm up
ec2:RunInstances	Create on demand instance in case spot VM creation fails

ASG

Policy	Usage
autoscaling:DescribeAutoScalingGroups	List ASG
autoscaling:UpdateAutoScalingGroup	Set the desired capacity of ASG during warm up and cool down operations
ec2:DescribeSpotPriceHistory	Get the spot price for savings computation

RDS

Policy	Usage
rds:DescribeDBInstances	List RDS instances
rds:DescribeDBClusters	List RDS clusters
rds:ListTagsForResource	List tags associated with RDS
rds:StartDBInstance	Start RDS Instance
rds:StartDBCluster	Start RDS Cluster
rds:StopDBInstance	Stop RDS Instance
rds:StopDBCluster	Stop RDS Cluster

ECS

Policy	Usage
ecs:ListClusters	List ECS clusters
tag:GetResources	List tags for selecting ECS service by tag
ecs:ListServices	List ECS services
ecs:ListTasks	List tasks for ECS service
ecs:DescribeServices	Describe ECS services
ecs:UpdateService	Needed set the desired task count while warming and cooling down
ecs:DescribeTaskDefinition	Describe ECS Task
ecs:DescribeTasks	Describe ECS Tasks

Fine-Grain Policy

The following is an example policy JSON split out based on the statements above:

{
    "Statement": [
        {
            "Action": [
                "acm:ListCertificates",
                "ec2:DescribeVpcs",
                "ec2:DescribeSecurityGroups",
                "elasticloadbalancing:DescribeLoadBalancers",
                "iam:ListRoles",
                "ec2:DescribeSubnets",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:SetSecurityGroups",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:CreateTargetGroup",
                "elasticloadbalancing:AddTags",
                "lambda:GetFunction",
                "lambda:CreateFunction",
                "iam:PassRole",
                "lambda:AddPermission",
                "elasticloadbalancing:RegisterTargets",
                "lambda:DeleteFunction",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:CreateListener",
                "elasticloadbalancing:DescribeRules",
                "elasticloadbalancing:CreateRule",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DeleteRule",
                "elasticloadbalancing:SetRulePriorities",
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:ModifyRule",
                "cloudwatch:GetMetricStatistics",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "alb"
        },
        {
            "Action": [
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:DescribeKeyPairs",
                "ec2:RunInstances",
                "secretsmanager:GetSecretValue",
                "ec2:AllocateAddress",
                "ec2:DescribeVpcs",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:TerminateInstances",
                "ec2:DescribeImages",
                "ec2:AssociateAddress",
                "ec2:DisassociateAddress",
                "ec2:ReleaseAddress",
                "ec2:ModifyInstanceAttribute"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "proxy"
        },
        {
            "Action": [
                "ec2:DescribeInstances",
                "ec2:CreateTags",
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "ec2"
        },
        {
            "Action": [
                "ec2:DescribeVolumes",
                "ec2:CreateImage",
                "ec2:DescribeImages",
                "ec2:TerminateInstances",
                "ec2:DeregisterImage",
                "ec2:DeleteSnapshot",
                "ec2:RequestSpotInstances",
                "ec2:DescribeSpotInstanceRequests",
                "ec2:DescribeAddresses",
                "ec2:RunInstances"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "ec2Spot"
        },
        {
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:UpdateAutoScalingGroup",
                "ec2:DescribeSpotPriceHistory"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "asg"
        },
        {
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:ListTagsForResource",
                "rds:StartDBInstance",
                "rds:StartDBCluster",
                "rds:StopDBInstance",
                "rds:StopDBCluster"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "rds"
        },
        {
            "Action": [
                "ecs:ListClusters",
                "tag:GetResources",
                "ecs:ListServices",
                "ecs:ListTasks",
                "ecs:DescribeServices",
                "ecs:UpdateService",
                "ecs:DescribeTaskDefinition",
                "ecs:DescribeTasks"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "ecs"
        }
    ],
    "Version": "2012-10-17"
}