Permissions policy for Perforce Unified Compliance

Perforce Unified Compliance scans the S3 bucket for new cost files when the account is onboarded, and scheduled polling continues to process ongoing updates.

• Replace <BUCKET_NAME> with the name of the S3 bucket containing the spending data export.

  Copy

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "CostData",
              "Effect": "Allow",
              "Action": [
                  "s3:GetBucketLocation",
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:GetBucketNotification",
                  "s3:PutBucketNotification"
              ],
              "Resource": [
                  "arn:aws:s3:::<BUCKET_NAME>",
                  "arn:aws:s3:::<BUCKET_NAME>/*"
              ]
          },
          {
              "Sid": "Collector",
              "Effect": "Allow",
              "Action": [
                  "eks:DescribeNodegroup",
                  "eks:ListNodegroups",
                  "ec2:DescribeInstances",
                  "ec2:DescribeInstanceTypes",
                  "ec2:DescribeRegions",
                  "ec2:DescribeVolumes",
                  "ec2:DescribeAddresses",
                  "elasticache:DescribeCacheClusters",
                  "rds:DescribeDBInstances",
                  "secretsmanager:ListSecrets",
                  "elasticfilesystem:DescribeFileSystems",
                  "eks:AccessKubernetesApi",
                  "eks:DescribeCluster",
                  "eks:ListClusters"
              ],
              "Resource": [
                  "*"
              ]
          },
          {
              "Sid": "EC2Optimization",
              "Effect": "Allow",
              "Action": [
                  "support:DescribeTrustedAdvisorCheckResult",
                  "support:DescribeTrustedAdvisorChecks",
                  "cloudwatch:GetMetricData"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AccountAlias",
              "Effect": "Allow",
              "Action": [
                  "iam:ListAccountAliases"
              ],
              "Resource": "*"
          },
          {
              "Sid": "STSCredentialValidation",
              "Effect": "Allow",
              "Action": [
                  "sts:GetCallerIdentity"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AllowSendCommandWithBuiltInDocuments",
              "Effect": "Allow",
              "Action": [
                  "ssm:SendCommand"
              ],
              "Resource": [
                  "arn:aws:ssm:*:*:document/AWS-RunShellScript",
                  "arn:aws:ssm:*:*:document/AWS-RunPowerShellScript"
              ]
          },
          {
              "Sid": "AllowSendCommandOnAllInstances",
              "Effect": "Allow",
              "Action": [
                  "ssm:SendCommand"
              ],
              "Resource": "arn:aws:ec2:*:*:instance/*"
          },
          {
              "Sid": "AllowCommandStatusPolling",
              "Effect": "Allow",
              "Action": [
                  "ssm:GetCommandInvocation",
                  "ssm:ListCommandInvocations"
              ],
              "Resource": "*"
          },
          {
              "Sid": "AllowPEEnrollmentSimulate",
              "Effect": "Allow",
              "Action": [
                  "iam:SimulatePrincipalPolicy"
              ],
              "Resource": "*"
          }
      ]
  }

This IAM policy grants Perforce Unified Compliance the access it needs to onboard and operate an AWS account.

For cost and optimization it is read-only: read the Cost and Usage Report S3 bucket, discover inventory across EC2/EBS/EIP/EKS/RDS/ElastiCache/EFS/Secrets Manager, and pull rightsizing signals from Trusted Advisor and CloudWatch.

For Puppet Enrollment it grants an operational capability to run the built-in AWS Run Shell/PowerShell SSM documents on your EC2 instances, poll their results, and self-verify those permissions via iam:SimulatePrincipalPolicy. There are no create or delete rights on infrastructure; the only mutating actions are the S3 notification config and SSM command execution on instances which user needs to manage with Puppet Enrollment.