What are the required minimal AWS permissions/roles for CPM operation?

What are the required minimal AWS permissions/roles for CPM operation?


You can apply all the required roles by using the JSON files inside the archive attached to this article (including the new permissions required for v4.0 and up).
Note that for some editions there is more then 1 json file.
If you are using FLR or Copy to S3 in the same account as N2WS server, then due to AWS changes you will add self-trust to the role, please see this KB for more info: FLR or Copy to S3 with Exception: could not assume role

How to Add permissions: 

2. Go to 'Roles' and select user which requires the permission to assume the role.

3. Open 'Permissions' tab and click 'Add permissions'.

4. Select 'Attach existing policies directly' and click 'Create policy', you will need to create 2 policies in order to include all needed permissions needed.

5. In the opened window open 'JSON' tab, select all data and replace it with data from one of the JSON files you've downloaded previously, and click Review policy'.

6. Specify the name for the policy, enter the description if needed and click 'Create policy'. Follow the same steps to create the second policy that is needed.

7. Go back to the user settings and to the 'Permissions' tab and click 'Add permissions', select 'Attach existing policies directly' and search for the 2 policies you've created and add them both by checking he box next to them, then click Next:Review'.

8. Click 'Add permissions'.

9. If the permissions for your edition of CPM include 2 files, repeat the steps 3-8 for the second file


For assuming a role accounts:
You will also need to add trust relation to the target role, to allow the source role to assume it.
Please check this document for the procedure on establishing trust: https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html#cli-role-prepare

KMS:
Different set of KMS related permissions is required for admin and non-admin users.
If you are an admin user, ListAliases & ListKeys are enough

Other users need these minimum KMS permissions:
- For backup and DR:
  "kms:CreateGrant",
  "kms:DescribeKey",
  "kms:GenerateDataKeyWithoutPlaintext",
  "kms:GenerateDataKeyPairWithoutPlaintext",
  "kms:ListAliases",
  "kms:ListKeys"

- For recovery:
   "kms:DescribeKey",
   "kms:ListAliases",
   "kms:ListKeys",
   "kms:ReEncryptFrom",
   "kms:ReEncryptTo"





Click below to see Azure minimal permissions KB Article