Required minimal AWS permissions/roles for CPM operation

Required minimal AWS permissions/roles for CPM operation


Info
You can apply all the required roles by using the JSON files inside the archive attached to this article (including the new permissions required for v4.0 and up).
Note that for some editions there is more then 1 json file.
Info
If you are using FLR or Copy to S3 in the same account as N2WS server, then due to AWS changes you will add self-trust to the role,

How to Add permissions: 
1. Go to the IAM  Console https://console.aws.amazon.com/iam/home
2. Go to 'Policies'.
3. Click on 'Create policy' 
4. Click on JSON, Then delete the content and replace with the json from the minimal permission zip.
Notes
It is Important to use notepad to open the JSON file, so when you copy and paste its contents you do not add any formatting characters.
Failure to do this can cause syntax errors when saving the policy and other issues.
5. Then click Next, Select policy name and click Create policy
6. You will need to create a policy for each needed extra json file for your edition.
7. Once all policies are created, go to 'Roles' and click on the role used by the N2WS server
8. Open 'Permissions' tab and click 'Attach policies'
9. Search for the policies you've created and add them by checking the box next to them, then click Add Permissions.
  
For assuming a role type accounts:
You will also need to add trust relation to the target role, to allow the source role to assume it.
Please check this document for the procedure on establishing trust: https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-role-prepare

KMS:
Different set of KMS related permissions is required for admin and non-admin users.
If you are an admin user, ListAliases & ListKeys are enough

Other users need these minimum KMS permissions:
- For backup and DR:
  "kms:CreateGrant",
  "kms:DescribeKey",
  "kms:GenerateDataKeyWithoutPlaintext",

  "kms:GenerateDataKeyPairWithoutPlaintext",
  "kms:ListAliases",
  "kms:ListKeys"
- For recovery:
   "kms:DescribeKey",
   "kms:ListAliases",
   "kms:ListKeys",
   "kms:ReEncryptFrom",
   "kms:ReEncryptTo"



Click below to see Azure minimal permissions KB Article