# AWS permission mapping

<table><thead><tr><th>Category</th><th>Entity Create Level</th><th>Tessell Permission</th><th>Request Tag</th><th>Resource Tag</th><th>Constrained by Condition</th><th>Commentary on unconstrained permissions</th><th>Attached to Role(s)</th><th>Applicable Resources</th><th>Cloud Description</th><th width="128">Applicable for Register Use Case</th><th width="119.3125">Feature Mapping</th><th>Applicable for only Private CP DP Use Case</th><th>Private CP DP Use Case</th></tr></thead><tbody><tr><td>*</td><td></td><td>ec2:Describe*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows describing EC2 resources.</td><td>Yes</td><td>Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:Get*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows getting EC2 resources.</td><td>Yes</td><td>Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:List*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing EC2 resources.</td><td>Yes</td><td>Provisioning</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:Search*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows searching EC2 resources.</td><td>Yes</td><td>Provisioning, Delete Service</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>CloudWatchAgentServerPolicy</td><td>N/A</td><td>N/A</td><td>NO</td><td>Managed Policy from AWS</td><td>TessellDbVmMgmtRole</td><td>N/A</td><td>Allows the CloudWatch agent to collect and send metrics and logs to CloudWatch.</td><td>Yes</td><td>DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:DeleteLogGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting CloudWatch log groups with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:DeleteLogStream</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting log streams with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:DescribeLogGroups</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing CloudWatch log groups.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:DescribeLogStreams</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing log streams within CloudWatch log groups.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:GetLogEvents</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows retrieving log events from CloudWatch logs.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:PutRetentionPolicy</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting retention policies on log groups with the specified resource tag.</td><td>Yes</td><td>DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch</td><td>Log Group per DB Service</td><td>logs:TagLogGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows tagging CloudWatch log groups with the specified resource tag.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:ModifyInstanceAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of instances with the specified resource tag.</td><td>Yes</td><td>Add Tags</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:MonitorInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows enabling detailed monitoring for instances with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:RebootInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows rebooting instances with the specified resource tag.</td><td>Yes</td><td>provisioning, stop, start, patch, resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:RunInstances</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>Network interfaces, security groups, subnets, volumes, etc.</td><td>Allows launching EC2 instances with access to specified resources.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:RunInstances</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>Specific EC2 instances (arn:aws:ec2)</td><td>Allows launching EC2 instances with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:StartInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows starting instances with the specified resource tag.</td><td>Yes</td><td>start service, resize, stop rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:StopInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows stopping instances with the specified resource tag.</td><td>Yes</td><td>stop service, resize, start rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2</td><td>Compute Resource</td><td>ec2:TerminateInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows terminating instances with the specified resource tag.</td><td>Yes</td><td>Delete replica, delete service, provisioning rollback, add-replica rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:AddTags</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows adding tags to load balancer resources with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateListener</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating load balancer listeners with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateLoadBalancer</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating load balancers with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateTargetGroup</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating target groups with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteListener</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting load balancer listeners with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteLoadBalancer</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteTargetGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeregisterTargets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deregistering targets from target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeListeners</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing load balancer listeners.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeLoadBalancerAttributes</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing attributes of load balancers.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeLoadBalancers</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing load balancers.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTags</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing tags for load balancer resources.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetGroupAttributes</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing attributes of target groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetGroups</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing target groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetHealth</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing the health of targets in a target group.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyListener</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying load balancer listeners with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyLoadBalancerAttributes</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyTargetGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyTargetGroupAttributes</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:RegisterTargets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows registering targets with target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:SetIpAddressType</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting IP address types for load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:SetSubnets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting subnets for load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>ec2:AssociateIamInstanceProfile</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating IAM instance profiles with instances that have the specified resource tag.</td><td>Yes</td><td>Provisioning, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>ec2:DisassociateIamInstanceProfile</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating IAM instance profiles from instances with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:PassRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>ARN of TessellDbVmMgmtRole</td><td>Allows passing the TessellDbVmMgmtRole to EC2 instances or other services.</td><td>Yes</td><td>Provisioning, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:CreateServiceLinkedRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>AWSServiceRoleForKeyManagementServiceMultiRegionKeys</td><td>Allows creating service-linked roles for KMS multi-region keys.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:CreateServiceLinkedRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>AWSServiceRoleForElasticLoadBalancing</td><td>Allows creating service-linked roles for AWS services (e.g., ELB, KMS).</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AllocateAddress</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows allocating Elastic IP addresses with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AssignPrivateIpAddresses</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows assigning private IP addresses to network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AssociateAddress</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating an Elastic IP address with an instance or network interface.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:DisassociateAddress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating Elastic IP addresses from resources with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete-replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:ReleaseAddress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows releasing Elastic IP addresses with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete-replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CancelKeyDeletion</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows canceling deletion of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows creating KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows creating aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateGrant</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows creating grants on KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateGrant</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows creating grants on KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateKey</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating new KMS keys with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Decrypt</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows decrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Decrypt</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows decrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DeleteAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows deleting KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DeleteAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows deleting aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DescribeKey</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows describing KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DescribeKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows describing KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DisableKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows disabling KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DisableKeyRotation</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows disabling automatic key rotation for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:EnableKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows enabling KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:EnableKeyRotation</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows enabling automatic key rotation for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Encrypt</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows encrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Encrypt</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows encrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GenerateDataKey*</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows generating data keys using KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GenerateDataKey*</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows generating data keys using KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetKeyPolicy</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows retrieving key policies for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetKeyRotationStatus</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows getting rotation status of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetParametersForImport</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows obtaining parameters for importing key material into KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ImportKeyMaterial</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows importing key material into KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListAliases</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing all KMS aliases.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListAliases</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing aliases of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListKeys</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing all KMS keys.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListKeys</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListResourceTags</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing tags for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReEncrypt*</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows re-encrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReEncrypt*</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows re-encrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReplicateKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows replicating KMS keys tagged with the specified resource tag to other regions.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ScheduleKeyDeletion</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows scheduling deletion of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:TagResource</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows tagging KMS resources with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UntagResource</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>Resources tagged with TESSELL_TENANT_ID = {{TenantName}}</td><td>Allows removing tags from KMS resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows updating KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows updating aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateKeyDescription</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows updating descriptions of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:AttachNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows attaching network interfaces to instances with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone, resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:CreateNetworkInterface</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating network interfaces.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:CreateNetworkInterfacePermission</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating permissions for network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DeleteNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting network interfaces with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DeleteNetworkInterfacePermission</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting permissions for network interfaces with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DetachNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows detaching network interfaces from instances with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica, Resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:ModifyNetworkInterfaceAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:CreateBucket</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows creating S3 buckets with the specified request tag.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:CreateJob</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>arn:aws:s3:::job/*</td><td>Allows creating S3 Batch Operations jobs.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucket</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete database, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucketPolicy</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting bucket policies from S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucketTagging</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting tags from S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete database, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows deleting objects from the specified S3 bucket.</td><td>Yes</td><td>AM SLA, Delete AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows getting bucket-level information on the specified S3 bucket.</td><td>Yes</td><td>Provisioning, add-replica, clone, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows getting objects from the specified S3 bucket.</td><td>Yes</td><td>Clone, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetReplicationConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows getting the replication configuration of the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:InitiateReplication</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows initiating replication on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ListBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows listing objects in the specified S3 bucket.</td><td>Yes</td><td>AM, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PauseReplication</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows pausing replication on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows putting bucket-level configurations on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows putting objects into the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutReplicationConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows setting replication configuration on the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateDelete</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating delete markers to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateObject</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating objects to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateTags</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating tags to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:CancelRotateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows canceling secret rotation for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:CreateSecret</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating secrets with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:DeleteSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:DescribeSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows describing secrets with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone, Stop, Start, Snapshot</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:GetSecretValue</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows retrieving secret values from secrets with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone, Stop, Start, Snapshot</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:PutSecretValue</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating the secret value for secrets with the specified resource tag.</td><td>Yes</td><td>Reset password</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RemoveRegionsFromReplication</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows removing regions from secret replication for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:ReplicateSecretToRegions</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows replicating secrets to other regions for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RestoreSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows restoring deleted secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RotateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows rotating secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:StopReplicationToReplica</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows stopping replication to replica secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:TagResource</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows tagging secrets with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:UpdateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:UpdateSecretVersionStage</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating the version stage of secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:AuthorizeSecurityGroupEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows authorizing egress rules on security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:AuthorizeSecurityGroupIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows authorizing ingress rules on security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:CreateSecurityGroup</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating security groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:DeleteSecurityGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:ModifySecurityGroupRules</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying security group rules with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:RevokeSecurityGroupEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows revoking egress rules in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:RevokeSecurityGroupIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows revoking ingress rules in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:UpdateSecurityGroupRuleDescriptionsEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating egress rule descriptions in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:UpdateSecurityGroupRuleDescriptionsIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating ingress rule descriptions in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:GetSnapshotBlock</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows getting blocks from EBS snapshots with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:ListChangedBlocks</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing changed blocks between two EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:ListSnapshotBlocks</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing blocks in EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CopySnapshot</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows copying EBS snapshots with the specified request tag.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshot</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:ec2:::volume/</td><td>Allows creating snapshots of volumes with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshot</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating snapshots with the specified request tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshots</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:ec2:::volume/</td><td>Allows creating EBS snapshots from volumes with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshots</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating EBS snapshots with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:DeleteSnapshot</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:ModifySnapshotAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:ResetSnapshotAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows resetting attributes of EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>STS</td><td>Subscription</td><td>sts:DecodeAuthorizationMessage</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows decoding authorization failure messages.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Tags</td><td>All Cloud Resources</td><td>ec2:CreateTags</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating tags on EC2 resources with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Tags</td><td>All Cloud Resources</td><td>ec2:DeleteTags</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting tags from EC2 resources with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:AttachVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows attaching EBS volumes with the specified resource tag to instances.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:CreateVolume</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating EBS volumes with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:DeleteVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:DetachVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows detaching EBS volumes with the specified resource tag from instances.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:ModifyVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:ModifyVolumeAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows modifying attributes of EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Gives Read Access to VPCs</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:AssociateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:AttachInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows attaching Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateInternetGateway</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating Internet Gateways with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateNatGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating NAT Gateways associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP,</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateNatGateway</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating NAT Gateways with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP,</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating routes associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRoute</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating routes with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating route tables associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRouteTable</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating route tables with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateSubnet</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating subnets associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateSubnet</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating subnets with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateVpc</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPCs with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteNatGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting NAT Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting routes tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteSubnet</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting subnets tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteVpc</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPCs tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DetachInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows detaching Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DisassociateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ModifySubnetAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying subnet attributes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ModifyVpcAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying VPC attributes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ReplaceRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows replacing routes in route tables with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:CreateVpcEndpointServiceConfiguration</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC endpoint service configurations with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:DeleteVpcEndpointServiceConfigurations</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPC endpoint service configurations with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:ModifyVpcEndpointServiceConfiguration</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying VPC endpoint service configurations with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:ModifyVpcEndpointServicePermissions</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying permissions for VPC endpoint services with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:CreateVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC peering connections associated with resources tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:CreateVpcPeeringConnection</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC peering connections with the specified request tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:AcceptVpcPeeringConnection</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>arn:aws:ec2::${AWS::AccountId}:vpc-peering-connection/</td><td>Allows accepting VPC peering connections without tag conditions.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:AcceptVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows accepting VPC peering connections tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:DeleteVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPC peering connections tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPN</td><td></td><td>ec2:ExportClientVpnClientCertificateRevocationList</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows exporting VPN client certificate revocation lists.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPN</td><td></td><td>ec2:ExportClientVpnClientConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows exporting VPN client configurations.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.tessell.com/tessell/governance/subscriptions/aws-permission-mapping.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.