What are the required minimal AWS permissions/roles for CPM operation?

What are the required minimal AWS permissions/roles for CPM operation?


You can apply all the required roles by using the JSON files inside the archive attached to this article (including the new permissions required for v4.0 and up).

To apply these permissions in AWS, follow these instructions:

2. Go to 'Roles' and select user which requires the permission to assume the role.

3. Open 'Permissions' tab and click 'Add permissions'.

4. Select 'Attach existing policies directly' and click 'Create policy', you will need to create 2 policies in order to include all needed permissions needed.

5. In the opened window open 'JSON' tab, select all data and replace it with data from one of the JSON files you've downloaded previously, and click Review policy'.

6. Specify the name for the policy, enter the description if needed and click 'Create policy'. Follow the same steps to create the second policy that is needed.

7. Go back to the user settings and to the 'Permissions' tab and click 'Add permissions', select 'Attach existing policies directly' and search for the 2 policies you've created and add them both by checking he box next to them, then click Next:Review'.

8. Click 'Add permissions'.

9. If the permissions for your edition of CPM include 2 files, repeat the steps 3-8 for the second file


For assuming a role, the role needs this permission:"sts:AssumeRole"
Please check this document for the procedure on establishing trust: https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-role-prepare

For cross-account operations, you need to add the following permissions:
"ec2:ModifyImageAttribute",
"ec2:ModifySnapshotAttribute",
"rds:ModifyDBSnapshotAttribute",

Different set of KMS related permissions is required for admin and non-admin users.
If you are an admin user, ListAliases & ListKeys are enough

Other users need these minimum KMS permissions:
- For backup and DR:
  "kms:CreateGrant",
  "kms:DescribeKey",
  "kms:GenerateDataKeyWithoutPlaintext",
  "kms:GenerateDataKeyPairWithoutPlaintext",
  "kms:ListAliases",
  "kms:ListKeys"

- For recovery:
   "kms:DescribeKey",
   "kms:ListAliases",
   "kms:ListKeys",
   "kms:ReEncryptFrom",
   "kms:ReEncryptTo"





Click below to see Azure minimal permissions KB Article