This policy defines the AWS permissions that Cloudvisor requires in order to collect data in read-only mode.
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Integration IAM Role for Cloudvisor",
  "Metadata": {
    "AWS::CloudFormation::Interface": {
      "ParameterGroups": [
        {
          "Label": {
            "default": "Cloudvisor Customer Configuration"
          },
          "Parameters": [
            "ClientUUIDToken"
          ]
        }
      ],
      "ParameterLabels": {
        "ClientUUIDToken": {
          "default": "Cloudvisor Customer ID"
        }
      }
    }
  },
  "Parameters": {
    "ClientUUIDToken": {
      "Description": "[DO NOT MODIFY] The customer ID provided by Cloudvisor to identify you as a client",
      "Type": "String"
    }
  },
  "Resources": {
    "CloudvisorIamRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": {
                    "Ref": "ClientUUIDToken"
                  }
                }
              },
              "Principal": {
                "AWS": [
                  "arn:aws:iam::672188301118:root"
                ]
              }
            }
          ]
        },
        "MaxSessionDuration": 43200,
        "Policies": [
          {
            "PolicyName": "Cloudvisor-Policy",
            "PolicyDocument": {
              "Statement": [
                {
                  "Sid": "CloudvisorEC2Access",
                  "Effect": "Allow",
                  "Action": [
                    "ec2:List*",
                    "tag:GetResources",
                    "tag:GetTagKeys",
                    "tag:GetTagValues",
                    "elasticloadbalancing:Describe*",
                    "ec2:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorEC2AutoScalingAccess",
                  "Effect": "Allow",
                  "Action": [
                    "autoscaling:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorOrganizationsAccess",
                  "Effect": "Allow",
                  "Action": [
                    "organizations:List*",
                    "organizations:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorCloudWatchAccess",
                  "Effect": "Allow",
                  "Action": [
                    "cloudwatch:List*",
                    "cloudwatch:Describe*",
                    "cloudwatch:GetMetricStatistics"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorSavingsPlansAccess",
                  "Effect": "Allow",
                  "Action": [
                    "savingsplans:List*",
                    "savingsplans:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorCostExplorerAccess",
                  "Effect": "Allow",
                  "Action": [
                    "ce:List*",
                    "ce:Describe*",
                    "ce:Get*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorCloudTrailAccess",
                  "Effect": "Allow",
                  "Action": [
                    "cloudtrail:List*",
                    "cloudtrail:LookupEvents",
                    "cloudtrail:Describe*",
                    "cloudtrail:Get*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorRDSAccess",
                  "Effect": "Allow",
                  "Action": [
                    "rds:List*",
                    "rds:ListTagsForResource",
                    "rds:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorElastiCacheAccess",
                  "Effect": "Allow",
                  "Action": [
                    "elasticache:List*",
                    "elasticache:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorRedshiftAccess",
                  "Effect": "Allow",
                  "Action": [
                    "redshift:Describe*"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorElasticsearchAccess",
                  "Effect": "Allow",
                  "Action": [
                    "es:List*",
                    "es:Describe*",
                    "es:GetCompatibleElasticsearchVersions"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Sid": "CloudvisorS3Access",
                  "Effect": "Allow",
                  "Action": [
                    "s3:HeadBucket",
                    "s3:ListAllMyBuckets",
                    "s3:ListBucket",
                    "s3:GetBucketAcl",
                    "s3:GetBucketCORS",
                    "s3:GetBucketLocation",
                    "s3:GetBucketLogging",
                    "s3:GetBucketPolicy",
                    "s3:GetBucketRequestPayment",
                    "s3:GetBucketTagging",
                    "s3:GetBucketVersioning",
                    "s3:GetBucketWebsite",
                    "s3:GetEncryptionConfiguration",
                    "s3:GetLifecycleConfiguration",
                    "s3:GetMetricsConfiguration",
                    "s3:GetReplicationConfiguration"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "CloudvisorRoleArn": {
      "Description": "The ARN of the role created for Cloudvisor integration",
      "Value": {
        "Fn::GetAtt": [
          "CloudvisorIamRole",
          "Arn"
        ]
      }
    }
  }
}
Advice and answers from the Renovisor Team
