Permissions for integrating AWS cloud services with Micetro - Micetro - 26.1.0

Micetro Reference Articles
ft:locale
en-US
Product name
Micetro
Version
26.1.0

This page provides the minimum and recommended permissions necessary for successfully adding AWS services to Micetro. Whether you’re dealing with DNS, IPAM, or cloud network management, ensuring the correct permissions is essential for a seamless integration experience.

Minimum permissions for adding an AWS account

When adding an AWS account to Micetro, make sure the credentials used have the following permissions:

Required permissions:

  • iam:GetUser
  • iam:ListGroupsForUser
  • sts:GetCallerIdentity

For multi-account setups, add these additional permissions:

  • iam:GetGroup
  • iam:ListGroupPolicies
  • iam:GetGroupPolicy
Note: Restrict IAM permissions to the user associated with the credentials provided to Micetro.

If you want Micetro to be able to read the alias of your account to use it as an account name, the following permission is also required:

  • iam:ListAccountAliases

DNS management permissions

The following permissions are required or recommended for managing DNS.

Required permissions:

  • route53:ListHostedZones
  • route53:GetHostedZoneCount
  • route53:ListHealthChecks
  • route53:ListHostedZonesByName
  • route53:ListResourceRecordSets

Recommended permissions:

To maximize the capabilities of cloud network management in Micetro, we highly recommend granting the following permissions:

  • route53:GetHostedZone
  • route53:CreateHostedZone
  • route53:DeleteHostedZone
  • route53:ChangeResourceRecordSets
  • route53:AssociateVPCWithHostedZone

It's important to note that you have the flexibility to omit certain permissions or restrict the resources the user can access based on your preferences. However, be mindful that such limitations may impact Micetro's functionality. For example, omitting the ec2:DeleteVpc permission will result in Micetro being unable to remove virtual private clouds (VPCs).

Cloud network management permissions

The following permissions are required or recommended for managing cloud networks.

Required permissions:

  • ec2:DescribeRegions
  • ec2:DescribeSubnets
  • ec2:DescribeVPCs
  • ec2:DescribeInstances

Recommended permissions:

For optimal cloud network management in Micetro, it is strongly recommended that you grant the following permissions:

  • ec2:CreateVpc
  • ec2:DeleteVpc
  • ec2:CreateSubnet
  • ec2:DeleteSubnet
  • ec2:CreateTags
  • ec2:DeleteTags

It's important to note that you have the flexibility to omit permissions or restrict resource access according to your needs. However, be mindful that such exclusions may result in limited functionality within Micetro. For example, omitting the ec2:DeleteVpc permission will result in Micetro being unable to remove virtual private clouds (VPCs).

Permissions in a multi-account setup

In an AWS multi-account setup, additional permissions are necessary. Take note of the following requirements:

  • The user integrated into Micetro must possess inline group policies enabling them to execute sts:AssumeRole on the designated accounts it needs to connect to.
  • In the accounts for which roles are assumed from the Micetro user, roles must already be configured, with the account containing the Micetro user designated as a trusted entity.
  • The roles assumed in these accounts should be assigned the DNS and/or cloud network permissions outlined in the required/recommended permission list above.

For more information about multi-account setup, refer to Configuring AWS multi-account setup.

For information about adding multiple AWS accounts using organizational discovery, refer to Set up Micetro to discover AWS Organizations.