Required Policies

In the CloudDefense Cloud Security platform, we need different types of permission for different purposes. We basically need permission for:

  1. Adding any Cloud account

  2. For auto-remediation on cloud misconfigurations

  3. To run Workload scan on your Computes like EC2, containers, etc.

  4. For Threat Detection

Here is a breakdown of the AWS permission and policies we need:

We may ask for a few AWS-managed policies to be attached to the AWS IAM user. Here is the list of required policies for AWS:

ModuleAWS PoliciesType

Account Addition

SecurityAudit, AWSSSODirectoryReadOnly


Workload Scan



Auto Remediation

Write Access for the specified resources


Threat Detection




This is a ReadOnly permission. The user with this policy monitors accounts for compliance with security requirements. This user can access logs and events to investigate potential security breaches or potentially malicious activity. Learn more about this by clicking here.

Why we need it:

To access your resources and evaluate them in detail we need ReadOnly access to your resources. That’s why we need this policy with a minimal level of access.


This readOnly permission will be used to get information about your AWS Identity center.


This policy grants permissions that allow full access to Amazon EC2. See the full access here: AmazonEC2FullAccess

Why we need it:

To perform a workload scan on your compute machines, we need Write access to your EC2s.


We need this ReadOnly access to read the data from your S3 buckets.

PS: To add AWS account using CloudFormatiion Template, make sure the IAM user you'll use to create the CloudFormation Stack has the following permissions attached - AmazonSNSFullAccess, AWSCloudFormationFullAccess and IAMFullAccess.

Last updated