IAM Reference
This page lists every permission SKE needs, organized by feature group. You only need to grant permissions for features you use — core permissions for deployment, plus optional permissions for databases, caches, networking, and custom domains.
AWS IAM Permissions
Section titled “AWS IAM Permissions”SKE validates permissions per feature group using iam:SimulatePrincipalPolicy. Each group is checked independently, simulating each action on the kind of resource SKE uses it on (such as ske-* functions and roles) in the connection’s region, so both a role scoped to SKE’s resources and one granted the actions on * pass.
SKE doesn’t pass CloudFormation a separate service role, so CloudFormation creates, updates and deletes each stack’s resources (queues, scheduler rules, the CDN, the execution role, log groups, the network’s VPC) with your role’s own permissions. The groups below include those actions.
Scoped policy
Section titled “Scoped policy”SKE serves a permission policy for the role it assumes: GET /api/v1/organizations/{org}/workspaces/{workspace}/cloud-providers/aws-policy returns it, split into as many managed policies as it needs to fit AWS’s size limit, along with the permissions boundary below. It grants every action the role check asks for, limited to SKE’s own ske-* resources where AWS allows and on * otherwise. It lets the role create, change and pass ske-* roles only when they carry the permissions boundary.
The dashboard’s Connect cloud provider wizard shows them on its AWS step: the Boundary policy SkeExecutionBoundary first, then each Role policy (SkeAccess1, SkeAccess2, …), each with Name and JSON copy buttons, then the Trust policy. Its steps:
- In IAM, Policies, create the boundary policy
SkeExecutionBoundaryfirst, from its JSON. Don’t attach it: the roles SKE creates for your functions carry it. - Create each role policy under its name.
- Create a role for another AWS account with the trust policy, and attach the role policies to it.
- Enter the role ARN, pick a default region and select Validate connection.
Warnings from the check, such as a missing boundary or a low Lambda concurrency limit, show in the permission checklist and don’t stop you from continuing.
Permissions boundary
Section titled “Permissions boundary”SkeExecutionBoundary is a customer-managed policy you create in the account from the boundary SKE serves, without attaching it to anything. Every execution role SKE creates for your functions carries it, so a role SKE creates can never do more than it allows: write logs, manage the functions’ VPC network interfaces, use the environment’s queues, the storage bucket and mail, and invoke its own functions (the warmer). SKE’s role can’t create or change the boundary.
- With a role granted on
*, the boundary is optional. Without it, the connection check warns, and the execution roles carry no boundary. Once it exists, each environment’s next deploy adds it to its role. - With the scoped policy, the boundary is required: the role can only create roles that carry it, so the connection check fails until it exists.
To move an existing environment to the scoped policy:
- Create
SkeExecutionBoundaryfrom the boundary SKE serves. - Deploy each environment once with the role’s current policy. The deploy adds the boundary to the execution role.
- Replace the role’s policy with the scoped policy, then run Re-validate on the connection.
If a deploy can’t read the boundary (iam:GetPolicy), the execution role keeps whatever boundary it carries now and the deploy says so.
Core (required for deployment)
Section titled “Core (required for deployment)”ECR — Container Registry
Section titled “ECR — Container Registry”ecr:GetAuthorizationTokenecr:CreateRepositoryecr:DescribeRepositoriesecr:BatchCheckLayerAvailabilityecr:GetDownloadUrlForLayerecr:BatchGetImageecr:InitiateLayerUploadecr:UploadLayerPartecr:CompleteLayerUploadecr:PutImageecr:SetRepositoryPolicyecr:GetRepositoryPolicyecr:DeleteRepositoryecr:ListImagesecr:BatchDeleteImageecr:PutLifecyclePolicyecr:DescribeImagesecr:ListTagsForResourceecr:TagResourceecr:UntagResourceLambda — Compute
Section titled “Lambda — Compute”lambda:CreateFunctionlambda:UpdateFunctionCodelambda:UpdateFunctionConfigurationlambda:GetFunctionlambda:DeleteFunctionlambda:InvokeFunctionlambda:GetFunctionConfigurationlambda:ListFunctionslambda:AddPermissionlambda:GetPolicylambda:RemovePermissionlambda:CreateAliaslambda:UpdateAliaslambda:GetAliaslambda:DeleteAliaslambda:PublishVersionlambda:ListVersionsByFunctionlambda:PutFunctionConcurrencylambda:DeleteFunctionConcurrencylambda:GetFunctionConcurrencylambda:TagResourcelambda:UntagResourcelambda:ListTagslambda:PutFunctionEventInvokeConfiglambda:GetFunctionEventInvokeConfiglambda:CreateEventSourceMappinglambda:GetEventSourceMappinglambda:UpdateEventSourceMappinglambda:DeleteEventSourceMappinglambda:ListEventSourceMappingslambda:PutProvisionedConcurrencyConfiglambda:GetProvisionedConcurrencyConfiglambda:DeleteProvisionedConcurrencyConfiglambda:ListProvisionedConcurrencyConfigslambda:GetAccountSettingslambda:GetAccountSettings lets the connection check read the account’s Lambda concurrency limit. Below 100 concurrent executions it warns that requests and queued jobs would be throttled under load, and says to request a higher Concurrent executions quota in the Service Quotas console.
CloudFormation — Infrastructure Provisioning
Section titled “CloudFormation — Infrastructure Provisioning”cloudformation:CreateStackcloudformation:UpdateStackcloudformation:DeleteStackcloudformation:DescribeStackscloudformation:DescribeStackEventscloudformation:DescribeStackResourcescloudformation:GetTemplatecloudformation:ListStackscloudformation:ValidateTemplatecloudformation:CreateChangeSetcloudformation:DescribeChangeSetcloudformation:ExecuteChangeSetcloudformation:DeleteChangeSetcloudformation:CancelUpdateStackSSM — Parameter Store
Section titled “SSM — Parameter Store”ssm:PutParameterssm:GetParameterssm:GetParametersssm:GetParametersByPathssm:DeleteParameterssm:DeleteParametersssm:DescribeParametersssm:AddTagsToResourcessm:RemoveTagsFromResourcessm:ListTagsForResourceDynamoDB — State Store
Section titled “DynamoDB — State Store”dynamodb:CreateTabledynamodb:DeleteTabledynamodb:DescribeTabledynamodb:PutItemdynamodb:GetItemdynamodb:UpdateItemdynamodb:DeleteItemdynamodb:Querydynamodb:Scandynamodb:TagResourcedynamodb:UntagResourcedynamodb:ListTagsOfResourcedynamodb:UpdateTimeToLiveS3 — Asset Storage
Section titled “S3 — Asset Storage”s3:CreateBuckets3:DeleteBuckets3:PutObjects3:GetObjects3:DeleteObjects3:ListBuckets3:PutBucketPolicys3:GetBucketPolicys3:PutBucketCorss3:GetBucketCorss3:PutBucketWebsites3:GetBucketWebsites3:PutBucketOwnershipControlss3:PutBucketPublicAccessBlocks3:PutBucketCORSs3:PutBucketTaggings3:PutLifecycleConfigurations3:DeleteBucketPolicys3:GetBucketAcls3:TagResources3:UntagResourceAPI Gateway
Section titled “API Gateway”apigateway:POSTapigateway:GETapigateway:DELETEapigateway:PUTapigateway:PATCHCloudWatch Logs
Section titled “CloudWatch Logs”logs:CreateLogGrouplogs:DeleteLogGrouplogs:DescribeLogGroupslogs:CreateLogStreamlogs:DescribeLogStreamslogs:GetLogEventslogs:FilterLogEventslogs:PutRetentionPolicylogs:TagLogGrouplogs:UntagLogGrouplogs:ListTagsLogGrouplogs:TagResourcelogs:UntagResourcelogs:ListTagsForResourcelogs:DescribeResourcePolicieslogs:DescribeIndexPolicieslogs:GetDataProtectionPolicyCloudWatch — Metrics
Section titled “CloudWatch — Metrics”The environment’s metrics page reads these. Without them, it names the missing action instead of showing metrics.
cloudwatch:GetMetricDatacloudwatch:ListMetricsIAM — Role Management
Section titled “IAM — Role Management”iam:CreateRoleiam:DeleteRoleiam:GetRoleiam:PassRoleiam:AttachRolePolicyiam:DetachRolePolicyiam:PutRolePolicyiam:DeleteRolePolicyiam:GetRolePolicyiam:ListRolePoliciesiam:ListAttachedRolePoliciesiam:TagRoleiam:UntagRoleiam:UpdateAssumeRolePolicyiam:SimulatePrincipalPolicyiam:PutRolePermissionsBoundaryiam:GetPolicyiam:CreateServiceLinkedRoleiam:PutRolePermissionsBoundary adds the permissions boundary to an execution role created before it, and iam:GetPolicy lets the connection check and each deploy read the boundary. iam:CreateServiceLinkedRole creates RDS’s or ElastiCache’s service-linked role for the first database or cache in an account.
Secrets Manager
Section titled “Secrets Manager”secretsmanager:CreateSecretsecretsmanager:DeleteSecretsecretsmanager:GetSecretValuesecretsmanager:PutSecretValuesecretsmanager:UpdateSecretsecretsmanager:DescribeSecretsecretsmanager:ListSecretssecretsmanager:TagResourcesecretsmanager:UntagResourcesecretsmanager:RestoreSecretCloudFront — Assets CDN and static sites
Section titled “CloudFront — Assets CDN and static sites”cloudfront:CreateDistributioncloudfront:GetDistributioncloudfront:GetDistributionConfigcloudfront:UpdateDistributioncloudfront:DeleteDistributioncloudfront:ListDistributionscloudfront:TagResourcecloudfront:UntagResourcecloudfront:ListTagsForResourcecloudfront:ListOriginAccessControlscloudfront:CreateOriginAccessControlcloudfront:DeleteOriginAccessControlcloudfront:CreateFunctioncloudfront:DescribeFunctioncloudfront:GetFunctioncloudfront:UpdateFunctioncloudfront:PublishFunctioncloudfront:DeleteFunctioncloudfront:ListFunctionsservicequotas:GetServiceQuotaEventBridge — Scheduler
Section titled “EventBridge — Scheduler”events:PutRuleevents:PutTargetsevents:DescribeRuleevents:ListTargetsByRuleevents:RemoveTargetsevents:DeleteRuleevents:TagResourceevents:UntagResourceevents:ListTagsForResourceOptional features
Section titled “Optional features”RDS — Databases
Section titled “RDS — Databases”rds:CreateDBInstancerds:DeleteDBInstancerds:DescribeDBInstancesrds:ModifyDBInstancerds:RebootDBInstancerds:CreateDBSubnetGrouprds:DeleteDBSubnetGrouprds:DescribeDBSubnetGroupsrds:ModifyDBSubnetGrouprds:DescribeDBProxiesrds:DescribeOrderableDBInstanceOptionsrds:DescribeDBEngineVersionsrds:CreateDBClusterrds:DeleteDBClusterrds:DescribeDBClustersrds:ModifyDBClusterrds:AddTagsToResourcerds:RemoveTagsFromResourcerds:ListTagsForResourcerds:CreateDBSnapshotrds:DeleteDBSnapshotrds:DescribeDBSnapshotsrds:RestoreDBInstanceFromDBSnapshotElastiCache — Caches
Section titled “ElastiCache — Caches”elasticache:CreateCacheClusterelasticache:DeleteCacheClusterelasticache:DescribeCacheClusterselasticache:ModifyCacheClusterelasticache:CreateReplicationGroupelasticache:DeleteReplicationGroupelasticache:DescribeReplicationGroupselasticache:ModifyReplicationGroupelasticache:CreateCacheSubnetGroupelasticache:DeleteCacheSubnetGroupelasticache:DescribeCacheSubnetGroupselasticache:ModifyCacheSubnetGroupelasticache:CreateServerlessCacheelasticache:DeleteServerlessCacheelasticache:DescribeServerlessCacheselasticache:ModifyServerlessCacheelasticache:DescribeReservedCacheNodesOfferingselasticache:AddTagsToResourceelasticache:RemoveTagsFromResourceelasticache:ListTagsForResourceVPC — Networking
Section titled “VPC — Networking”ec2:CreateVpcec2:DeleteVpcec2:DescribeVpcsec2:DescribeVpcAttributeec2:ModifyVpcAttributeec2:DescribeNetworkAclsec2:CreateSubnetec2:DeleteSubnetec2:DescribeSubnetsec2:ModifySubnetAttributeec2:CreateSecurityGroupec2:DeleteSecurityGroupec2:DescribeSecurityGroupsec2:DescribeSecurityGroupRulesec2:GetSecurityGroupsForVpcec2:AuthorizeSecurityGroupIngressec2:RevokeSecurityGroupIngressec2:AuthorizeSecurityGroupEgressec2:RevokeSecurityGroupEgressec2:CreateInternetGatewayec2:DeleteInternetGatewayec2:AttachInternetGatewayec2:DetachInternetGatewayec2:DescribeInternetGatewaysec2:CreateNatGatewayec2:DeleteNatGatewayec2:DescribeNatGatewaysec2:AllocateAddressec2:ReleaseAddressec2:DescribeAddressesec2:DisassociateAddressec2:CreateRouteTableec2:DeleteRouteTableec2:DescribeRouteTablesec2:DescribeVpcEndpointsec2:CreateRouteec2:ReplaceRouteec2:DeleteRouteec2:AssociateRouteTableec2:ReplaceRouteTableAssociationec2:DisassociateRouteTableec2:CreateTagsec2:DeleteTagsec2:DescribeTagsec2:DescribeAvailabilityZonesec2:DescribeAccountAttributesec2:DescribeNetworkInterfacesec2:DeleteNetworkInterfaceec2:DescribeInstancesBefore a deploy into a VPC with queues or storage, SKE reads the subnets’ route tables and the VPC’s endpoints (ec2:DescribeRouteTables, ec2:DescribeVpcEndpoints). If a subnet has no route to SQS or S3, through a NAT gateway or a VPC endpoint, the deploy stops before it starts and asks for a NAT gateway, VPC endpoints or other subnets. Without the check, the app’s calls to SQS or S3 would hang until they time out.
ACM — SSL Certificates
Section titled “ACM — SSL Certificates”acm:RequestCertificateacm:DeleteCertificateacm:DescribeCertificateacm:ListCertificatesacm:AddTagsToCertificateacm:RemoveTagsFromCertificateacm:ListTagsForCertificateRoute 53 — DNS
Section titled “Route 53 — DNS”route53:CreateHostedZoneroute53:DeleteHostedZoneroute53:GetHostedZoneroute53:ListHostedZonesroute53:ChangeResourceRecordSetsroute53:ListResourceRecordSetsroute53:GetChangeroute53:ListHostedZonesByNameSQS — Queues
Section titled “SQS — Queues”sqs:CreateQueuesqs:DeleteQueuesqs:GetQueueUrlsqs:GetQueueAttributessqs:SetQueueAttributessqs:SendMessagesqs:ReceiveMessagesqs:DeleteMessagesqs:PurgeQueuesqs:ListQueuessqs:TagQueuesqs:UntagQueuesqs:ListQueueTagsSES — Email (SMTP providers)
Section titled “SES — Email (SMTP providers)”ses:SendEmailses:SendRawEmailses:GetAccountses:CreateEmailIdentityses:DeleteEmailIdentityses:GetEmailIdentityses:PutAccountDetailsses:CreateConfigurationSetses:DeleteConfigurationSetses:CreateConfigurationSetEventDestinationses:UpdateConfigurationSetEventDestinationses:DeleteConfigurationSetEventDestinationses:TagResourceSNS — Email events (SMTP providers)
Section titled “SNS — Email events (SMTP providers)”sns:CreateTopicsns:DeleteTopicsns:Subscribesns:SetTopicAttributessns:TagResourceGCP IAM Roles
Section titled “GCP IAM Roles”GCP uses predefined roles instead of individual permissions.
Always required (12 roles)
Section titled “Always required (12 roles)”| Role | Purpose |
|---|---|
roles/serviceusage.serviceUsageAdmin |
Enable and manage GCP APIs |
roles/iam.serviceAccountAdmin |
Create service accounts for Cloud Run |
roles/iam.serviceAccountUser |
Run Cloud Run services as those service accounts |
roles/resourcemanager.projectIamAdmin |
Bind IAM policies to project resources |
roles/datastore.owner |
Firestore for deployment state tracking |
roles/run.admin |
Deploy and manage Cloud Run services |
roles/artifactregistry.admin |
Push and manage container images, tag the live image, and set the repository’s cleanup policy |
roles/secretmanager.admin |
Create and manage secrets |
roles/cloudtasks.admin |
Create and manage task queues |
roles/cloudscheduler.admin |
Create and manage scheduled jobs |
roles/logging.viewer |
Read application logs |
roles/storage.objectAdmin |
Upload, serve and delete old static assets |
Conditional roles
Section titled “Conditional roles”| Role | When needed | Purpose |
|---|---|---|
roles/compute.networkAdmin |
Networking | Create VPCs, subnets, firewall rules |
roles/cloudsql.admin |
Databases | Create and manage Cloud SQL instances |
roles/redis.admin |
Caching | Create and manage Memorystore instances |
roles/dns.admin |
Listed with the infrastructure roles | Cloud DNS; custom domains use Certificate Manager and the load balancer instead |
Required GCP APIs
Section titled “Required GCP APIs”serviceusage.googleapis.com must be enabled by hand first. Connecting a provider checks the others: it stops when a critical API is off (iam, run, artifactregistry, firestore, secretmanager, cloudresourcemanager) and warns when an optional one is (cloudtasks, cloudscheduler, logging, storage, compute, sqladmin, redis, dns).
The first deploy enables all 16 APIs SKE needs: iam, run, artifactregistry, firestore, secretmanager, cloudtasks, cloudscheduler, logging, monitoring, cloudresourcemanager, storage, compute, sqladmin, redis, dns and servicenetworking (each <name>.googleapis.com).