AWS permission mapping

Category	Entity Create Level	Tessell Permission	Request Tag	Resource Tag	Constrained by Condition	Commentary on unconstrained permissions	Attached to Role(s)	Applicable Resources	Cloud Description	Applicable for Register Use Case	Feature Mapping	Applicable for only Private CP DP Use Case	Private CP DP Use Case
*		ec2:Describe*	N/A	N/A	NO	EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html	CrossAccountAccessRole, TessellDbVmMgmtRole	*	Allows describing EC2 resources.	Yes	Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance	No	Public CP DP, Private CP DP
*		ec2:Get*	N/A	N/A	NO	EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html	CrossAccountAccessRole	*	Allows getting EC2 resources.	Yes	Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance	No	Public CP DP, Private CP DP
*		ec2:List*	N/A	N/A	NO	EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html	CrossAccountAccessRole	*	Allows listing EC2 resources.	Yes	Provisioning	No	Public CP DP, Private CP DP
*		ec2:Search*	N/A	N/A	NO	EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html	CrossAccountAccessRole	*	Allows searching EC2 resources.	Yes	Provisioning, Delete Service	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	CloudWatchAgentServerPolicy	N/A	N/A	NO	Managed Policy from AWS	TessellDbVmMgmtRole	N/A	Allows the CloudWatch agent to collect and send metrics and logs to CloudWatch.	Yes	DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:DeleteLogGroup	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deleting CloudWatch log groups with the specified resource tag.	Yes	DB Deletion, DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:DeleteLogStream	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deleting log streams with the specified resource tag.	Yes	DB Deletion, DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:DescribeLogGroups	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing CloudWatch log groups.	Yes	Provisioning, DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:DescribeLogStreams	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing log streams within CloudWatch log groups.	Yes	Provisioning, DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:GetLogEvents	N/A	N/A	NO		CrossAccountAccessRole	*	Allows retrieving log events from CloudWatch logs.	Yes	Provisioning, DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:PutRetentionPolicy	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows setting retention policies on log groups with the specified resource tag.	Yes	DB Logs	No	Public CP DP, Private CP DP
CloudWatch	Log Group per DB Service	logs:TagLogGroup	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows tagging CloudWatch log groups with the specified resource tag.	Yes	Provisioning, DB Logs	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:ModifyInstanceAttribute	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows modifying attributes of instances with the specified resource tag.	Yes	Add Tags	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:MonitorInstances	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows enabling detailed monitoring for instances with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:RebootInstances	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows rebooting instances with the specified resource tag.	Yes	provisioning, stop, start, patch, resize	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:RunInstances	N/A	N/A	NO		CrossAccountAccessRole	Network interfaces, security groups, subnets, volumes, etc.	Allows launching EC2 instances with access to specified resources.	Yes	Provisioning, Add-replica, Clone	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:RunInstances	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	Specific EC2 instances (arn:aws:ec2)	Allows launching EC2 instances with the specified request tag.	Yes	Provisioning, Add-replica, Clone	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:StartInstances	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows starting instances with the specified resource tag.	Yes	start service, resize, stop rollback	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:StopInstances	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows stopping instances with the specified resource tag.	Yes	stop service, resize, start rollback	No	Public CP DP, Private CP DP
EC2	Compute Resource	ec2:TerminateInstances	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows terminating instances with the specified resource tag.	Yes	Delete replica, delete service, provisioning rollback, add-replica rollback	No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:AddTags	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	*	Allows adding tags to load balancer resources with the specified request tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:CreateListener	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	*	Allows creating load balancer listeners with the specified request tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:CreateLoadBalancer	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	*	Allows creating load balancers with the specified request tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:CreateTargetGroup	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	*	Allows creating target groups with the specified request tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DeleteListener	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deleting load balancer listeners with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DeleteLoadBalancer	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deleting load balancers with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DeleteTargetGroup	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deleting target groups with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DeregisterTargets	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows deregistering targets from target groups with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeListeners	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing load balancer listeners.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeLoadBalancerAttributes	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing attributes of load balancers.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeLoadBalancers	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing load balancers.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeTags	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing tags for load balancer resources.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeTargetGroupAttributes	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing attributes of target groups.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeTargetGroups	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing target groups.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:DescribeTargetHealth	N/A	N/A	NO		CrossAccountAccessRole	*	Allows describing the health of targets in a target group.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:ModifyListener	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows modifying load balancer listeners with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:ModifyLoadBalancerAttributes	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows modifying attributes of load balancers with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:ModifyTargetGroup	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows modifying target groups with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:ModifyTargetGroupAttributes	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows modifying attributes of target groups with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:RegisterTargets	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows registering targets with target groups with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:SetIpAddressType	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows setting IP address types for load balancers with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
ELB	VPC	elasticloadbalancing:SetSubnets	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows setting subnets for load balancers with the specified resource tag.	Yes		No	Public CP DP, Private CP DP
IAM	Subscription	ec2:AssociateIamInstanceProfile	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows associating IAM instance profiles with instances that have the specified resource tag.	Yes	Provisioning, DP AWS Services Access	No	Public CP DP, Private CP DP
IAM	Subscription	ec2:DisassociateIamInstanceProfile	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows disassociating IAM instance profiles from instances with the specified resource tag.	Yes	DB Deletion, DP AWS Services Access	No	Public CP DP, Private CP DP
IAM	Subscription	iam:PassRole	N/A	N/A	NO		CrossAccountAccessRole	ARN of TessellDbVmMgmtRole	Allows passing the TessellDbVmMgmtRole to EC2 instances or other services.	Yes	Provisioning, DP AWS Services Access	No	Public CP DP, Private CP DP
IAM	Subscription	iam:CreateServiceLinkedRole	N/A	N/A	NO		CrossAccountAccessRole, TessellDbVmMgmtRole	AWSServiceRoleForKeyManagementServiceMultiRegionKeys	Allows creating service-linked roles for KMS multi-region keys.	Yes		No	Public CP DP, Private CP DP
IAM	Subscription	iam:CreateServiceLinkedRole	N/A	N/A	NO		CrossAccountAccessRole, TessellDbVmMgmtRole	AWSServiceRoleForElasticLoadBalancing	Allows creating service-linked roles for AWS services (e.g., ELB, KMS).	Yes		No	Public CP DP, Private CP DP
IP Address	Compute Resource	ec2:AllocateAddress	TESSELL_TENANT_ID = {{TenantName}}	N/A	YES		CrossAccountAccessRole	*	Allows allocating Elastic IP addresses with the specified request tag.	Yes	Provisioning, Add-replica, Clone	No	Public CP DP, Private CP DP
IP Address	Compute Resource	ec2:AssignPrivateIpAddresses	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows assigning private IP addresses to network interfaces with the specified resource tag.	Yes	Provisioning, Add-replica, Clone	No	Public CP DP, Private CP DP
IP Address	Compute Resource	ec2:AssociateAddress	N/A	N/A	NO		CrossAccountAccessRole	*	Allows associating an Elastic IP address with an instance or network interface.	Yes	Provisioning, Add-replica, Clone	No	Public CP DP, Private CP DP
IP Address	Compute Resource	ec2:DisassociateAddress	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole	*	Allows disassociating Elastic IP addresses from resources with the specified resource tag.	Yes	Delete service, Delete-replica	No	Public CP DP, Private CP DP
IP Address	Compute Resource	ec2:ReleaseAddress	N/A	TESSELL_TENANT_ID = {{TenantName}}	YES		CrossAccountAccessRole