# AWS permission mapping

<table><thead><tr><th>Category</th><th>Entity Create Level</th><th>Tessell Permission</th><th>Request Tag</th><th>Resource Tag</th><th>Constrained by Condition</th><th>Commentary on unconstrained permissions</th><th>Attached to Role(s)</th><th>Applicable Resources</th><th>Cloud Description</th><th width="128">Applicable for Register Use Case</th><th width="119.3125">Feature Mapping</th><th>Applicable for only Private CP DP Use Case</th><th>Private CP DP Use Case</th></tr></thead><tbody><tr><td>*</td><td></td><td>ec2:Describe*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows describing EC2 resources.</td><td>Yes</td><td>Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:Get*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows getting EC2 resources.</td><td>Yes</td><td>Provisioning, Start, Stop, Clone, Resize, Refresh, Add Instance</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:List*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing EC2 resources.</td><td>Yes</td><td>Provisioning</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>*</td><td></td><td>ec2:Search*</td><td>N/A</td><td>N/A</td><td>NO</td><td>EC2 Describe permissions doesn't support Request/Resource Tag based conditions. Ref: <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html">https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html</a></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows searching EC2 resources.</td><td>Yes</td><td>Provisioning, Delete Service</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>CloudWatchAgentServerPolicy</td><td>N/A</td><td>N/A</td><td>NO</td><td>Managed Policy from AWS</td><td>TessellDbVmMgmtRole</td><td>N/A</td><td>Allows the CloudWatch agent to collect and send metrics and logs to CloudWatch.</td><td>Yes</td><td>DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:DeleteLogGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting CloudWatch log groups with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:DeleteLogStream</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting log streams with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:DescribeLogGroups</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing CloudWatch log groups.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:DescribeLogStreams</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing log streams within CloudWatch log groups.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:GetLogEvents</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows retrieving log events from CloudWatch logs.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:PutRetentionPolicy</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting retention policies on log groups with the specified resource tag.</td><td>Yes</td><td>DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>CloudWatch </td><td>Log Group per DB Service</td><td>logs:TagLogGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows tagging CloudWatch log groups with the specified resource tag.</td><td>Yes</td><td>Provisioning, DB Logs</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:ModifyInstanceAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of instances with the specified resource tag.</td><td>Yes</td><td>Add Tags</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:MonitorInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows enabling detailed monitoring for instances with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:RebootInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows rebooting instances with the specified resource tag.</td><td>Yes</td><td>provisioning, stop, start, patch, resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:RunInstances</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>Network interfaces, security groups, subnets, volumes, etc.</td><td>Allows launching EC2 instances with access to specified resources.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:RunInstances</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>Specific EC2 instances (arn:aws:ec2)</td><td>Allows launching EC2 instances with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:StartInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows starting instances with the specified resource tag.</td><td>Yes</td><td>start service, resize, stop rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:StopInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows stopping instances with the specified resource tag.</td><td>Yes</td><td>stop service, resize, start rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>EC2 </td><td>Compute Resource</td><td>ec2:TerminateInstances</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows terminating instances with the specified resource tag.</td><td>Yes</td><td>Delete replica, delete service, provisioning rollback, add-replica rollback</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:AddTags</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows adding tags to load balancer resources with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateListener</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating load balancer listeners with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateLoadBalancer</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating load balancers with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:CreateTargetGroup</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating target groups with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteListener</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting load balancer listeners with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteLoadBalancer</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeleteTargetGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DeregisterTargets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deregistering targets from target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeListeners</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing load balancer listeners.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeLoadBalancerAttributes</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing attributes of load balancers.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeLoadBalancers</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing load balancers.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTags</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing tags for load balancer resources.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetGroupAttributes</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing attributes of target groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetGroups</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing target groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:DescribeTargetHealth</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows describing the health of targets in a target group.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyListener</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying load balancer listeners with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyLoadBalancerAttributes</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyTargetGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:ModifyTargetGroupAttributes</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:RegisterTargets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows registering targets with target groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:SetIpAddressType</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting IP address types for load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>ELB</td><td>VPC</td><td>elasticloadbalancing:SetSubnets</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows setting subnets for load balancers with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>ec2:AssociateIamInstanceProfile</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating IAM instance profiles with instances that have the specified resource tag.</td><td>Yes</td><td>Provisioning, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>ec2:DisassociateIamInstanceProfile</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating IAM instance profiles from instances with the specified resource tag.</td><td>Yes</td><td>DB Deletion, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:PassRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>ARN of TessellDbVmMgmtRole</td><td>Allows passing the TessellDbVmMgmtRole to EC2 instances or other services.</td><td>Yes</td><td>Provisioning, DP AWS Services Access</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:CreateServiceLinkedRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>AWSServiceRoleForKeyManagementServiceMultiRegionKeys</td><td>Allows creating service-linked roles for KMS multi-region keys.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IAM</td><td>Subscription</td><td>iam:CreateServiceLinkedRole</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>AWSServiceRoleForElasticLoadBalancing</td><td>Allows creating service-linked roles for AWS services (e.g., ELB, KMS).</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AllocateAddress</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows allocating Elastic IP addresses with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AssignPrivateIpAddresses</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows assigning private IP addresses to network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:AssociateAddress</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating an Elastic IP address with an instance or network interface.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:DisassociateAddress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating Elastic IP addresses from resources with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete-replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>IP Address</td><td>Compute Resource</td><td>ec2:ReleaseAddress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows releasing Elastic IP addresses with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete-replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CancelKeyDeletion</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows canceling deletion of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows creating KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows creating aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateGrant</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows creating grants on KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateGrant</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows creating grants on KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:CreateKey</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating new KMS keys with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Decrypt</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows decrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Decrypt</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows decrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DeleteAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows deleting KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DeleteAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows deleting aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DescribeKey</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows describing KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DescribeKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows describing KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DisableKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows disabling KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:DisableKeyRotation</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows disabling automatic key rotation for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:EnableKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows enabling KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:EnableKeyRotation</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows enabling automatic key rotation for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Encrypt</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows encrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:Encrypt</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows encrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GenerateDataKey*</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows generating data keys using KMS keys with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GenerateDataKey*</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows generating data keys using KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetKeyPolicy</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows retrieving key policies for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetKeyRotationStatus</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows getting rotation status of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:GetParametersForImport</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows obtaining parameters for importing key material into KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ImportKeyMaterial</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows importing key material into KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListAliases</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing all KMS aliases.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListAliases</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing aliases of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListKeys</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing all KMS keys.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListKeys</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ListResourceTags</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows listing tags for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReEncrypt*</td><td>N/A</td><td>ALLOW_IMPORT_TO_TESSELL = true</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>KMS keys tagged with ALLOW_IMPORT_TO_TESSELL=true</td><td>Allows re-encrypting data using KMS keys with the specified resource tag.</td><td>Yes</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReEncrypt*</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows re-encrypting data using KMS keys tagged with the specified resource tag.</td><td>No</td><td>Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ReplicateKey</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows replicating KMS keys tagged with the specified resource tag to other regions.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:ScheduleKeyDeletion</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows scheduling deletion of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:TagResource</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows tagging KMS resources with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UntagResource</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>Resources tagged with TESSELL_TENANT_ID = {{TenantName}}</td><td>Allows removing tags from KMS resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateAlias</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:kms:<em>:</em>:alias/*</td><td>Allows updating KMS aliases without any tag restrictions.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateAlias</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows updating aliases for KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>KMS</td><td>Encryption Key</td><td>kms:UpdateKeyDescription</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>* (with resource tag condition)</td><td>Allows updating descriptions of KMS keys tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:AttachNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows attaching network interfaces to instances with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone, resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:CreateNetworkInterface</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating network interfaces.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:CreateNetworkInterfacePermission</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating permissions for network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DeleteNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting network interfaces with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DeleteNetworkInterfacePermission</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting permissions for network interfaces with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:DetachNetworkInterface</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows detaching network interfaces from instances with the specified resource tag.</td><td>Yes</td><td>Delete service, Delete replica, Resize</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Network Interface</td><td>Compute Resource</td><td>ec2:ModifyNetworkInterfaceAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of network interfaces with the specified resource tag.</td><td>Yes</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:CreateBucket</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows creating S3 buckets with the specified request tag.</td><td>No</td><td>Provisioning, add-replica, clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:CreateJob</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>arn:aws:s3:::job/*</td><td>Allows creating S3 Batch Operations jobs.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucket</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete database, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucketPolicy</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting bucket policies from S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteBucketTagging</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>BucketName/dblogstorage-*</td><td>Allows deleting tags from S3 buckets tagged with the specified resource tag.</td><td>No</td><td>Delete database, Delete replica</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:DeleteObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows deleting objects from the specified S3 bucket.</td><td>Yes</td><td>AM SLA, Delete AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows getting bucket-level information on the specified S3 bucket.</td><td>Yes</td><td>Provisioning, add-replica, clone, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows getting objects from the specified S3 bucket.</td><td>Yes</td><td>Clone, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:GetReplicationConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows getting the replication configuration of the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:InitiateReplication</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows initiating replication on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ListBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows listing objects in the specified S3 bucket.</td><td>Yes</td><td>AM, DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PauseReplication</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows pausing replication on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutBucket*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows putting bucket-level configurations on the specified S3 bucket.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutObject*</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-<em>/</em></td><td>Allows putting objects into the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:PutReplicationConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows setting replication configuration on the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateDelete</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating delete markers to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateObject</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating objects to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>S3</td><td>Region</td><td>s3:ReplicateTags</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>BucketName/dblogstorage-*</td><td>Allows replicating tags to the specified S3 bucket.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:CancelRotateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows canceling secret rotation for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:CreateSecret</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating secrets with the specified request tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:DeleteSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:DescribeSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows describing secrets with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone, Stop, Start, Snapshot</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:GetSecretValue</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows retrieving secret values from secrets with the specified resource tag.</td><td>Yes</td><td>Provisioning, Add-replica, Clone, Stop, Start, Snapshot</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:PutSecretValue</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating the secret value for secrets with the specified resource tag.</td><td>Yes</td><td>Reset password</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RemoveRegionsFromReplication</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows removing regions from secret replication for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:ReplicateSecretToRegions</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows replicating secrets to other regions for secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RestoreSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows restoring deleted secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:RotateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows rotating secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:StopReplicationToReplica</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows stopping replication to replica secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:TagResource</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows tagging secrets with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:UpdateSecret</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Secrets Manager</td><td>Secret per DB Service</td><td>secretsmanager:UpdateSecretVersionStage</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating the version stage of secrets with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:AuthorizeSecurityGroupEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows authorizing egress rules on security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:AuthorizeSecurityGroupIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows authorizing ingress rules on security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:CreateSecurityGroup</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating security groups.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:DeleteSecurityGroup</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:ModifySecurityGroupRules</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying security group rules with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:RevokeSecurityGroupEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows revoking egress rules in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:RevokeSecurityGroupIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows revoking ingress rules in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:UpdateSecurityGroupRuleDescriptionsEgress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating egress rule descriptions in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Security Group</td><td>Compute Resource</td><td>ec2:UpdateSecurityGroupRuleDescriptionsIngress</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows updating ingress rule descriptions in security groups with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:GetSnapshotBlock</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows getting blocks from EBS snapshots with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:ListChangedBlocks</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing changed blocks between two EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ebs:ListSnapshotBlocks</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows listing blocks in EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CopySnapshot</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows copying EBS snapshots with the specified request tag.</td><td>Yes</td><td>DAP</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshot</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:ec2:::volume/</td><td>Allows creating snapshots of volumes with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshot</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating snapshots with the specified request tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshots</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>arn:aws:ec2:::volume/</td><td>Allows creating EBS snapshots from volumes with the specified resource tag.</td><td>Yes</td><td>AM</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:CreateSnapshots</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating EBS snapshots with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:DeleteSnapshot</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:ModifySnapshotAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying attributes of EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Snapshot</td><td>Snapshots per DB Service</td><td>ec2:ResetSnapshotAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows resetting attributes of EBS snapshots with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>STS</td><td>Subscription</td><td>sts:DecodeAuthorizationMessage</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows decoding authorization failure messages.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Tags</td><td>All Cloud Resources</td><td>ec2:CreateTags</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating tags on EC2 resources with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Tags</td><td>All Cloud Resources</td><td>ec2:DeleteTags</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting tags from EC2 resources with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:AttachVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows attaching EBS volumes with the specified resource tag to instances.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:CreateVolume</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows creating EBS volumes with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:DeleteVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows deleting EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:DetachVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows detaching EBS volumes with the specified resource tag from instances.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:ModifyVolume</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>Volume</td><td>DB Service</td><td>ec2:ModifyVolumeAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole, TessellDbVmMgmtRole</td><td>*</td><td>Allows modifying attributes of EBS volumes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Gives Read Access to VPCs</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:AssociateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows associating route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:AttachInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows attaching Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateInternetGateway</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating Internet Gateways with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateNatGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating NAT Gateways associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, </td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateNatGateway</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating NAT Gateways with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, </td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating routes associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRoute</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating routes with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating route tables associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateRouteTable</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating route tables with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateSubnet</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating subnets associated with resources tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateSubnet</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating subnets with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:CreateVpc</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPCs with the specified request tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteNatGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting NAT Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting routes tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteSubnet</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting subnets tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DeleteVpc</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPCs tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DetachInternetGateway</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows detaching Internet Gateways tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:DisassociateRouteTable</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows disassociating route tables tagged with the specified resource tag.</td><td>No</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ModifySubnetAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying subnet attributes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ModifyVpcAttribute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying VPC attributes with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC</td><td>VPC</td><td>ec2:ReplaceRoute</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows replacing routes in route tables with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:CreateVpcEndpointServiceConfiguration</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC endpoint service configurations with the specified request tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:DeleteVpcEndpointServiceConfigurations</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPC endpoint service configurations with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:ModifyVpcEndpointServiceConfiguration</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying VPC endpoint service configurations with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Endpoint Service</td><td>VPC</td><td>ec2:ModifyVpcEndpointServicePermissions</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows modifying permissions for VPC endpoint services with the specified resource tag.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:CreateVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC peering connections associated with resources tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:CreateVpcPeeringConnection</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>N/A</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows creating VPC peering connections with the specified request tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:AcceptVpcPeeringConnection</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>arn:aws:ec2::${AWS::AccountId}:vpc-peering-connection/</td><td>Allows accepting VPC peering connections without tag conditions.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:AcceptVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows accepting VPC peering connections tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPC Peering</td><td>VPC</td><td>ec2:DeleteVpcPeeringConnection</td><td>N/A</td><td>TESSELL_TENANT_ID = {{TenantName}}</td><td>YES</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows deleting VPC peering connections tagged with the specified resource tag.</td><td>No</td><td>DR</td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPN</td><td></td><td>ec2:ExportClientVpnClientCertificateRevocationList</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows exporting VPN client certificate revocation lists.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr><tr><td>VPN</td><td></td><td>ec2:ExportClientVpnClientConfiguration</td><td>N/A</td><td>N/A</td><td>NO</td><td></td><td>CrossAccountAccessRole</td><td>*</td><td>Allows exporting VPN client configurations.</td><td>Yes</td><td></td><td>No</td><td>Public CP DP, Private CP DP</td></tr></tbody></table>