Amazon Web Services

Overview

nOps AWS access is configured in two layers:

Platform integration (Integration setup) — CUR delivery + a cross-account IAM role in your payer account. Choose Minimum Platform (Savings Analysis) or Full Platform (Inform & Operate) during IAM setup.
Commitment Management (CM setup) — Optional. Three additional cross-account IAM roles (CloudFormation) for inventory reads and commitment purchasing.

Minimum Platform is a single allow-only customer-managed policy. Full Platform layers a smaller customer-managed allow-list and a customer-managed Deny policy on top of the AWS-managed ReadOnlyAccess policy, to match the broader read coverage of nOps’s legacy integration role.

Platform permission levels

Select the level in Step 3: IAM Policy Creation of the AWS integration wizard.

Level	IAM policy name	Product scope	When to use
Minimum Platform	`nOpsMinimumPlatformPermissions`	Savings Analysis	CUR ingestion, billing exports, Cost Explorer commitment read APIs, Organizations metadata
Full Platform	`nOpsFullPlatformPermissions`	Inform & Operate	Everything in Minimum, plus broader inventory reads (Compute Optimizer, EC2/RDS/EKS, etc.) and selected write actions for rightsizing and operational workflows

Both levels also require nOpsBucketPolicy on the same role. Full Platform is a superset of Minimum, but it attaches more than a single swapped-in policy — see Customer-Managed Policies below for what each level actually requires.

Permissions — Platform integration

The platform integration uses a single cross-account IAM role in your payer (management) account. The policies attached to it depend on your selected permission level (see below).

IAM Role

Role name	Account	Purpose
`nops-integration-role-<client_id>`	Payer / management	Cross-account role for nOps data ingestion and cost analysis

Trust Policy

The role trusts a single nOps connector role with an integration-specific external ID:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::861341088565:role/nops-data-connector"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<external_id_from_nops>"
        }
      }
    }
  ]
}

Customer-Managed Policies

Minimum Platform attaches two customer-managed policies. Full Platform attaches four customer-managed policies (bucket, Deny list parts 1 and 2, and a trimmed allow-list) plus the AWS-managed ReadOnlyAccess policy.

nOpsBucketPolicy — S3 access for CUR delivery

Grants read and write access to the S3 bucket where AWS delivers your Cost and Usage Report.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketPolicy",
        "s3:GetEncryptionConfiguration",
        "s3:GetBucketVersioning",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketLocation",
        "s3:GetBucketAcl",
        "s3:GetBucketLogging",
        "s3:GetObject",
        "s3:PutBucketPolicy",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::<your-cur-bucket-name>",
        "arn:aws:s3:::<your-cur-bucket-name>/*"
      ]
    }
  ]
}

nOpsMinimumPlatformPermissions — Minimum Platform (Savings Analysis)

Allow-only policy for Savings Analysis: CUR and Data Exports, Cost Explorer commitment reads, Organizations metadata, and support case creation.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bcm-data-exports:ListExports",
        "bcm-data-exports:ListTables",
        "bcm-data-exports:GetExport",
        "bcm-data-exports:GetExecution",
        "bcm-data-exports:CreateExport",
        "bcm-data-exports:UpdateExport",
        "bcm-data-exports:ListExecutions",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetSavingsPlanPurchaseRecommendationDetails",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "cur:GetClassicReport",
        "cur:GetClassicReportPreferences",
        "cur:GetUsageReport",
        "cur:DescribeReportDefinitions",
        "cur:PutReportDefinition",
        "ec2:DescribeReservedInstances",
        "organizations:ListAccounts",
        "organizations:DescribeOrganization",
        "organizations:ListRoots",
        "savingsplans:DescribeSavingsPlanRates",
        "savingsplans:DescribeSavingsPlans",
        "savingsplans:DescribeSavingsPlansOfferingRates",
        "savingsplans:DescribeSavingsPlansOfferings",
        "savingsplans:ListTagsForResource",
        "support:CreateCase",
        "support:DescribeCases"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/nops-sa-child-role-minimal"
    }
  ]
}

Full Platform (Inform & Operate) — four documents

Full Platform doesn’t use a single allow-only policy. It attaches four documents to the role instead:

Document	Type	Purpose
`ReadOnlyAccess`	AWS-managed	Broad read coverage across AWS services
`nOpsFullPlatformDenyList1`	Customer-managed (Deny)	Deny list part 1 of 2 — carves sensitive read actions (for example Secrets Manager, Cognito, KMS key material, DynamoDB item reads) out of `ReadOnlyAccess`. Split with part 2 to stay under IAM’s 6,144-character customer-managed policy size quota. A Deny always overrides an Allow.
`nOpsFullPlatformDenyList2`	Customer-managed (Deny)	Deny list part 2 of 2 — continues the sensitive-action carve-out from `ReadOnlyAccess`.
`nOpsFullPlatformPermissions`	Customer-managed (Allow)	Actions `ReadOnlyAccess` doesn’t cover — a handful of writes needed for rightsizing/operational workflows, a few reads the Deny lists above block that nOps still needs, and `sts:AssumeRole` for the optional SA child role

Use Copy Policy in the nOps wizard for each document to get the current JSON — the Deny lists together cover 180+ entries and are best copied directly rather than retyped.

SA Child Roles

To extend read access to your AWS Organization’s member accounts, deploy a child role via CloudFormation StackSets from your payer account. This is optional and not required to finish onboarding.

Role name	Deployed via	Matches
`nops-sa-child-role`	StackSets, from payer account	Full Platform payer role
`nops-sa-child-role-minimal`	StackSets, from payer account	Minimum Platform payer role

Each child role trusts only the payer integration role (passed as the PayerRoleArn CloudFormation parameter), and its permissions mirror the payer role’s own tier. A payer role can only assume the child role name matching its own tier — a Full Platform payer role can’t assume nops-sa-child-role-minimal, and vice versa.

Permissions — Commitment Management

Commitment Management uses three additional cross-account IAM roles deployed via CloudFormation. These are separate from the Savings Analysis role.

Role Summary

Role name	Account	Purpose	How nOps reaches it
`NopsCMCrossAccountAssume`	Any org account	Assume child read roles across member accounts	nOps bridge → this role (with external ID)
`NopsCMReadEC2Instances`	Each member account (via StackSets)	Read-only EC2, RDS, ElastiCache, and Savings Plans inventory	Central role → this role
`nops-sharesave-mgt`	Dedicated child account	Commitment purchasing and management	nOps bridge → this role (with external ID)

Role 1: NopsCMCrossAccountAssume (Central Role)

Deployed in any account in your AWS Organization (not required to be the payer / management account). This role’s only permission is to assume the child read role in member accounts.

Trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::861341088565:role/NopsCMCentralClientAccountAssume"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<central_external_id_from_nops>"
        }
      }
    }
  ]
}

Inline policy: NopsCMAssumeChildRoles

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/NopsCMReadEC2Instances"
    }
  ]
}

Role 2: NopsCMReadEC2Instances (Child Read Role)

Deployed in every member account via CloudFormation StackSets. Provides read-only access to compute and commitment metadata.

Trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<central-account-id>:role/NopsCMCrossAccountAssume"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

The CentralRoleArn parameter in the CloudFormation template is set to the ARN of your NopsCMCrossAccountAssume role. Only that central role can assume this child read role.

Inline policy: NopsCMReadEC2Policy

Action	Service	Purpose
`ec2:DescribeInstances`	EC2	List running instances for coverage analysis
`ec2:DescribeReservedInstances`	EC2	List active EC2 Reserved Instances
`savingsplans:DescribeSavingsPlans`	Savings Plans	List active Savings Plans
`rds:DescribeDBInstances`	RDS	List RDS instances for coverage analysis
`rds:DescribeReservedDBInstances`	RDS	List active RDS Reserved Instances
`elasticache:DescribeReservedCacheNodes`	ElastiCache	List active ElastiCache Reserved Cache Nodes
`organizations:ListAccounts`	Organizations	List organization member accounts (returns data only in the payer account)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeReservedInstances",
        "savingsplans:DescribeSavingsPlans",
        "rds:DescribeDBInstances",
        "rds:DescribeReservedDBInstances",
        "elasticache:DescribeReservedCacheNodes",
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    }
  ]
}

Role 3: nops-sharesave-mgt (ShareSave Role)

Deployed in a dedicated child account within your AWS Organization. This role has the permissions needed to purchase and manage commitments. Purchased commitments automatically apply across the organization via RI/SP sharing.

Trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::861341088565:role/CrossAccountSharesaveMgt"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<sharesave_external_id_from_nops>"
        }
      }
    }
  ]
}

AWS managed policies (5)

Managed Policy ARN	Policy Name	Purpose
`arn:aws:iam::aws:policy/AWSSavingsPlansFullAccess`	AWS Savings Plans Full Access	Create, describe, list, and return Savings Plans
`arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess`	AWS Organizations Read-Only Access	List and describe organization accounts and structure
`arn:aws:iam::aws:policy/AWSCloudTrail_ReadOnlyAccess`	AWS CloudTrail Read-Only Access	Read CloudTrail event history for auditing
`arn:aws:iam::aws:policy/AWSSupportAccess`	AWS Support Access	Create and view AWS support cases
`arn:aws:iam::aws:policy/ServiceQuotasFullAccess`	Service Quotas Full Access	View and request service quota increases

Inline policy: NopsSharesaveMgtPolicy

Action	Service	Purpose
`ec2:CreateTags`	EC2	Tag purchased Reserved Instances
`ec2:DescribeReservedInstances`	EC2	List active EC2 RIs
`ec2:DescribeReservedInstancesListings`	EC2	View RI marketplace listings
`ec2:DescribeReservedInstancesModifications`	EC2	Track RI modification status
`ec2:DescribeReservedInstancesOfferings`	EC2	Discover available RI offerings
`ec2:ModifyReservedInstances`	EC2	Modify RI scope or Availability Zone
`ec2:PurchaseReservedInstancesOffering`	EC2	Purchase EC2 Reserved Instances
`ec2:CreateReservedInstancesListing`	EC2	List RIs on the RI Marketplace
`ec2:CancelReservedInstancesListing`	EC2	Cancel RI Marketplace listings
`ec2:DeleteQueuedReservedInstances`	EC2	Cancel a queued (not-yet-fired) RI purchase
`ec2:GetReservedInstancesExchangeQuote`	EC2	Get pricing for convertible RI exchange
`ec2:AcceptReservedInstancesExchangeQuote`	EC2	Execute convertible RI exchange
`rds:DescribeReservedDBInstances`	RDS	List active RDS RIs
`rds:DescribeReservedDBInstancesOfferings`	RDS	Discover available RDS RI offerings
`rds:PurchaseReservedDBInstancesOffering`	RDS	Purchase RDS Reserved Instances
`elasticache:DescribeReservedCacheNodes`	ElastiCache	List active ElastiCache RIs
`elasticache:DescribeReservedCacheNodesOfferings`	ElastiCache	Discover available ElastiCache RI offerings
`elasticache:PurchaseReservedCacheNodesOffering`	ElastiCache	Purchase ElastiCache Reserved Cache Nodes
`savingsplans:ReturnSavingsPlan`	Savings Plans	Return (cancel) a Savings Plan within the return window
`savingsplans:TagResource`	Savings Plans	Tag purchased Savings Plans
`ce:*`	Cost Explorer	Full access to cost and reservation analysis

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:DescribeReservedInstances",
        "ec2:DescribeReservedInstancesListings",
        "ec2:DescribeReservedInstancesModifications",
        "ec2:DescribeReservedInstancesOfferings",
        "ec2:ModifyReservedInstances",
        "ec2:PurchaseReservedInstancesOffering",
        "ec2:CreateReservedInstancesListing",
        "ec2:CancelReservedInstancesListing",
        "ec2:DeleteQueuedReservedInstances",
        "ec2:GetReservedInstancesExchangeQuote",
        "ec2:AcceptReservedInstancesExchangeQuote",
        "rds:DescribeReservedDBInstances",
        "rds:DescribeReservedDBInstancesOfferings",
        "rds:PurchaseReservedDBInstancesOffering",
        "elasticache:DescribeReservedCacheNodes",
        "elasticache:DescribeReservedCacheNodesOfferings",
        "elasticache:PurchaseReservedCacheNodesOffering",
        "savingsplans:ReturnSavingsPlan",
        "savingsplans:TagResource",
        "ce:*"
      ],
      "Resource": "*"
    }
  ]
}

Complete Role Summary

All roles at a glance (Savings Analysis + Commitment Management)

Account	Role	Platform integration	Commitment Management
Payer	`nops-integration-role-<client_id>`	Yes (Minimum or Full Platform)	—
Each member (StackSets, optional)	`nops-sa-child-role` or `nops-sa-child-role-minimal`	Yes (optional)	—
Any org account	`NopsCMCrossAccountAssume`	—	Yes
Payer (direct stack)	`NopsCMReadEC2Instances`	—	Yes (management-account inventory)
Each member (StackSets)	`NopsCMReadEC2Instances`	—	Yes
Dedicated child	`nops-sharesave-mgt`	—	Yes

Resources Created

During the setup process, nOps CloudFormation templates create the following resources in your AWS environment.

Resource	Account	Created by
S3 bucket for CUR delivery (the name you enter in the wizard)	Payer	CloudFormation (skipped if you point the stack at an existing bucket)
S3 bucket policy on that bucket, allowing AWS billing to deliver the report	Payer	CloudFormation (only for a bucket the stack creates — see CUR delivery bucket policy)
Legacy CUR export `nops_cur_<client_id>_hourly`	Payer	AWS Billing console (manual) or CloudFormation
IAM role `nops-integration-role-<client_id>`	Payer	Manual (setup wizard) or CloudFormation
IAM policy `nOpsBucketPolicy`	Payer	Manual (setup wizard) or CloudFormation
IAM policy `nOpsMinimumPlatformPermissions` or (`nOpsFullPlatformDenyList1` + `nOpsFullPlatformDenyList2` + `nOpsFullPlatformPermissions`)	Payer	Manual (setup wizard; one set per integration) or CloudFormation
IAM role `nops-sa-child-role` or `nops-sa-child-role-minimal`	Each member account	CloudFormation StackSet (optional)
IAM role `NopsCMCrossAccountAssume`	Any org account	CloudFormation stack
IAM role `NopsCMReadEC2Instances`	Each member account	CloudFormation StackSet
IAM role `nops-sharesave-mgt`	Dedicated child account	CloudFormation stack

All IAM roles use external IDs in their trust policies (where applicable) to prevent the confused deputy problem. External IDs are unique per integration and generated by nOps during onboarding.

CUR delivery bucket policy

When AWS creates a Cost and Usage Report, it checks that the destination bucket lets the billing service write to it. The Billing console adds that permission for you; CloudFormation does not. So when the integration stack creates the bucket, it also attaches this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NopsCurGetBucketMetadata",
      "Effect": "Allow",
      "Principal": { "Service": "billingreports.amazonaws.com" },
      "Action": ["s3:GetBucketAcl", "s3:GetBucketPolicy"],
      "Resource": "arn:aws:s3:::<your-cur-bucket-name>",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "<your-account-id>",
          "aws:SourceArn": "arn:aws:cur:us-east-1:<your-account-id>:definition/*"
        }
      }
    },
    {
      "Sid": "NopsCurPutObject",
      "Effect": "Allow",
      "Principal": { "Service": "billingreports.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<your-cur-bucket-name>/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "<your-account-id>",
          "aws:SourceArn": "arn:aws:cur:us-east-1:<your-account-id>:definition/*"
        }
      }
    }
  ]
}

This grants AWS billing, and nobody else, the ability to deliver reports into the bucket. It does not grant nOps anything — nOps reads the CUR through nOpsBucketPolicy on the integration role.

nOps never writes a bucket policy on a bucket you already own. A bucket policy is one document, so attaching ours would replace everything already on your bucket. If you point the stack at an existing bucket (CreateCurBucket=false), that bucket must already allow billingreports.amazonaws.com — otherwise AWS rejects the export with “Failed to verify customer bucket permission”. The stack’s CurBucketPolicyManaged output tells you which case applies.

Cross-Account Role Chains

nOps uses two role-assumption chains to access your AWS resources. Each chain starts from an nOps-owned bridge role.

Commitment Inventory (read path)

nOps bridge role (NopsCMCentralClientAccountAssume)
  → NopsCMCrossAccountAssume (your central account, with external ID)
    → NopsCMReadEC2Instances (your member accounts)

Commitment Operations (purchase path)

nOps bridge role (CrossAccountSharesaveMgt)
  → nops-sharesave-mgt (your dedicated child account, with external ID)

Security Model

Layer	Protection
External IDs	Prevent confused deputy attacks; unique per integration
Separate IAM roles	Purchase permissions are scoped to a dedicated role (`nops-sharesave-mgt`), isolated from your integration role
Scoped trust policies	Each role trusts only the specific nOps bridge role that needs to assume it
Least-privilege inline policies	Child read role has only 7 read-only actions; ShareSave role has only the actions needed for commitment operations
AWS managed policies	Used for well-defined access scopes (Savings Plans, Organizations, CloudTrail, Support, Service Quotas)
Verification checks	nOps verifies role assumption and API access before enabling CM

Network Requirements

nOps does not require any VPC peering, VPN connections, or network-level access to your AWS environment. All communication uses standard AWS API calls via cross-account role assumption over HTTPS.

AWS Integration Setup

Connect your payer account for Savings Analysis (CUR + IAM role).

AWS Commitment Management Setup

Step-by-step guide to deploy the three CM roles via CloudFormation.

Users and Roles

Manage team members and Admin/Owner roles for integration access.

Platform Integrations

Overview of all cloud integrations and setup entry points.

Getting Started

Platform

Clara

Inform

Operate

Optimize

Third-Party Integrations

Plugins

Google Cloud Platform

Microsoft Azure

Support

Amazon Web Services - Permissions & Resources

Overview

Platform permission levels

Permissions — Platform integration

IAM Role

Trust Policy

Customer-Managed Policies

SA Child Roles

Permissions — Commitment Management

Role Summary

Role 1: NopsCMCrossAccountAssume (Central Role)

Role 2: NopsCMReadEC2Instances (Child Read Role)

Role 3: nops-sharesave-mgt (ShareSave Role)

Complete Role Summary

Resources Created

CUR delivery bucket policy

Cross-Account Role Chains

Commitment Inventory (read path)

Commitment Operations (purchase path)

Security Model

Network Requirements

AWS Integration Setup

AWS Commitment Management Setup

Users and Roles

Platform Integrations

​Overview

​Platform permission levels

​Permissions — Platform integration

​IAM Role

​Trust Policy

​Customer-Managed Policies

​SA Child Roles

​Permissions — Commitment Management

​Role Summary

​Role 1: NopsCMCrossAccountAssume (Central Role)

​Role 2: NopsCMReadEC2Instances (Child Read Role)

​Role 3: nops-sharesave-mgt (ShareSave Role)

​Complete Role Summary

​Resources Created

​CUR delivery bucket policy

​Cross-Account Role Chains

​Commitment Inventory (read path)

​Commitment Operations (purchase path)

​Security Model

​Network Requirements

​Related Guides

AWS Integration Setup

AWS Commitment Management Setup

Users and Roles

Platform Integrations

Overview

Platform permission levels

Permissions — Platform integration

IAM Role

Trust Policy

Customer-Managed Policies

SA Child Roles

Permissions — Commitment Management

Role Summary

Role 1: NopsCMCrossAccountAssume (Central Role)

Role 2: NopsCMReadEC2Instances (Child Read Role)

Role 3: nops-sharesave-mgt (ShareSave Role)

Complete Role Summary

Resources Created

CUR delivery bucket policy

Cross-Account Role Chains

Commitment Inventory (read path)

Commitment Operations (purchase path)

Security Model

Network Requirements

Related Guides