As of 2024.04, you can optionally modify roles created by RES by attaching custom permission boundaries. A custom permission boundary may be defined as part of the RES AWS CloudFormation installation by supplying the permission boundary’s ARN as part of the IAMPermissionBoundary parameter. No permission boundary is set on any RES roles if this parameter is left empty. Below is the list of actions that RES roles require to operate. Make sure that any permission boundary that you plan to use explicitly allows for the following actions:
[
{
"Effect": "Allow",
"Resource": "*",
"Sid": "ResRequiredActions",
"Action": [
"access-analyzer:*",
"account:GetAccountInformation",
"account:ListRegions",
"acm:*",
"airflow:*",
"amplify:*",
"amplifybackend:*",
"amplifyuibuilder:*",
"aoss:*",
"apigateway:*",
"appflow:*",
"application-autoscaling:*",
"appmesh:*",
"apprunner:*",
"aps:*",
"athena:*",
"auditmanager:*",
"autoscaling-plans:*",
"autoscaling:*",
"backup-gateway:*",
"backup-storage:*",
"backup:*",
"batch:*",
"bedrock:*",
"budgets:*",
"ce:*",
"cloud9:*",
"cloudformation:*",
"cloudfront:*",
"cloudtrail-data:*",
"cloudtrail:*",
"cloudwatch:*",
"codeartifact:*",
"codebuild:*",
"codeguru-profiler:*",
"codeguru-reviewer:*",
"codepipeline:*",
"codestar-connections:*",
"codestar-notifications:*",
"codestar:*",
"cognito-identity:*",
"cognito-idp:*",
"cognito-sync:*",
"comprehend:*",
"compute-optimizer:*",
"cur:*",
"databrew:*",
"datapipeline:*",
"datasync:*",
"dax:*",
"detective:*",
"devops-guru:*",
"dlm:*",
"dms:*",
"drs:*",
"dynamodb:*",
"ebs:*",
"ec2-instance-connect:*",
"ec2:*",
"ec2messages:*",
"ecr:*",
"ecs:*",
"eks:*",
"elastic-inference:*",
"elasticache:*",
"elasticbeanstalk:*",
"elasticfilesystem:*",
"elasticloadbalancing:*",
"elasticmapreduce:*",
"elastictranscoder:*",
"es:*",
"events:*",
"firehose:*",
"fis:*",
"fms:*",
"forecast:*",
"fsx:*",
"geo:*",
"glacier:*",
"glue:*",
"grafana:*",
"guardduty:*",
"health:*",
"iam:*",
"identitystore:*",
"imagebuilder:*",
"inspector2:*",
"inspector:*",
"internetmonitor:*",
"iot:*",
"iotanalytics:*",
"kafka:*",
"kafkaconnect:*",
"kinesis:*",
"kinesisanalytics:*",
"kms:*",
"lambda:*",
"lightsail:*",
"logs:*",
"memorydb:*",
"mgh:*",
"mobiletargeting:*",
"mq:*",
"neptune-db:*",
"organizations:DescribeOrganization",
"osis:*",
"personalize:*",
"pi:*",
"pipes:*",
"polly:*",
"quicksight:*",
"rds-data:*",
"rds:*",
"redshift-data:*",
"redshift-serverless:*",
"redshift:*",
"rekognition:*",
"resiliencehub:*",
"resource-groups:*",
"route53:*",
"route53domains:*",
"route53resolver:*",
"rum:*",
"s3:*",
"sagemaker:*",
"scheduler:*",
"schemas:*",
"sdb:*",
"secretsmanager:*",
"securityhub:*",
"serverlessrepo:*",
"servicecatalog:*",
"servicequotas:*",
"ses:*",
"signer:*",
"sns:*",
"sqs:*",
"ssm:*",
"ssmmessages:*",
"states:*",
"storagegateway:*",
"sts:*",
"support:*",
"tag:GetResources",
"tag:GetTagKeys",
"tag:GetTagValues",
"textract:*",
"timestream:*",
"transcribe:*",
"transfer:*",
"translate:*",
"vpc-lattice:*",
"waf-regional:*",
"waf:*",
"wafv2:*",
"wellarchitected:*",
"wisdom:*",
"xray:*"
]
}
]