> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Web Services - Permissions & Resources

> Complete reference of all IAM roles, policies, and trust relationships nOps requires in your AWS environment for Savings Analysis and Commitment Management.

## Overview

nOps AWS access is configured in two layers:

1. **Platform integration** ([Integration setup](/aws/integration-setup)) — CUR delivery + a cross-account IAM role in your payer account. Choose **Minimum Platform** (Savings Analysis) or **Full Platform** (Inform & Operate) during IAM setup.
2. **Commitment Management** ([CM setup](/aws/commitment-management-setup)) — Optional. Three additional cross-account IAM roles (CloudFormation) for inventory reads and commitment purchasing.

**Minimum Platform** is a single allow-only customer-managed policy. **Full Platform** layers a smaller customer-managed allow-list and a customer-managed Deny policy on top of the AWS-managed `ReadOnlyAccess` policy, to match the broader read coverage of nOps's legacy integration role.

***

## Platform permission levels

Select the level in **Step 3: IAM Policy Creation** of the AWS integration wizard.

| Level                | IAM policy name                  | Product scope    | When to use                                                                                                                                                     |
| -------------------- | -------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Minimum Platform** | `nOpsMinimumPlatformPermissions` | Savings Analysis | CUR ingestion, billing exports, Cost Explorer commitment *read* APIs, Organizations metadata                                                                    |
| **Full Platform**    | `nOpsFullPlatformPermissions`    | Inform & Operate | Everything in Minimum, plus broader inventory reads (Compute Optimizer, EC2/RDS/EKS, etc.) and selected write actions for rightsizing and operational workflows |

Both levels also require `nOpsBucketPolicy` on the same role. **Full Platform is a superset of Minimum**, but it attaches more than a single swapped-in policy — see [Customer-Managed Policies](#customer-managed-policies) below for what each level actually requires.

***

## Permissions -- Platform integration

The platform integration uses a **single cross-account IAM role** in your payer (management) account. The policies attached to it depend on your selected permission level (see below).

### IAM Role

| Role name                           | Account            | Purpose                                                      |
| ----------------------------------- | ------------------ | ------------------------------------------------------------ |
| `nops-integration-role-<client_id>` | Payer / management | Cross-account role for nOps data ingestion and cost analysis |

### Trust Policy

The role trusts a single nOps connector role with an integration-specific external ID:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::861341088565:role/nops-data-connector"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<external_id_from_nops>"
        }
      }
    }
  ]
}
```

### Customer-Managed Policies

**Minimum Platform** attaches two customer-managed policies. **Full Platform** attaches four customer-managed policies (bucket, Deny list parts 1 and 2, and a trimmed allow-list) plus the AWS-managed `ReadOnlyAccess` policy.

<AccordionGroup>
  <Accordion title="nOpsBucketPolicy — S3 access for CUR delivery">
    Grants read and write access to the S3 bucket where AWS delivers your Cost and Usage Report.

    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:ListBucket",
            "s3:GetBucketPolicy",
            "s3:GetEncryptionConfiguration",
            "s3:GetBucketVersioning",
            "s3:GetBucketPolicyStatus",
            "s3:GetBucketLocation",
            "s3:GetBucketAcl",
            "s3:GetBucketLogging",
            "s3:GetObject",
            "s3:PutBucketPolicy",
            "s3:PutObject"
          ],
          "Resource": [
            "arn:aws:s3:::<your-cur-bucket-name>",
            "arn:aws:s3:::<your-cur-bucket-name>/*"
          ]
        }
      ]
    }
    ```
  </Accordion>

  <Accordion title="nOpsMinimumPlatformPermissions — Minimum Platform (Savings Analysis)">
    Allow-only policy for Savings Analysis: CUR and Data Exports, Cost Explorer commitment reads, Organizations metadata, and support case creation.

    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "bcm-data-exports:ListExports",
            "bcm-data-exports:ListTables",
            "bcm-data-exports:GetExport",
            "bcm-data-exports:GetExecution",
            "bcm-data-exports:CreateExport",
            "bcm-data-exports:UpdateExport",
            "bcm-data-exports:ListExecutions",
            "ce:GetReservationCoverage",
            "ce:GetReservationPurchaseRecommendation",
            "ce:GetReservationUtilization",
            "ce:GetSavingsPlanPurchaseRecommendationDetails",
            "ce:GetSavingsPlansCoverage",
            "ce:GetSavingsPlansPurchaseRecommendation",
            "ce:GetSavingsPlansUtilization",
            "ce:GetSavingsPlansUtilizationDetails",
            "ce:ListSavingsPlansPurchaseRecommendationGeneration",
            "cur:GetClassicReport",
            "cur:GetClassicReportPreferences",
            "cur:GetUsageReport",
            "cur:DescribeReportDefinitions",
            "cur:PutReportDefinition",
            "ec2:DescribeReservedInstances",
            "organizations:ListAccounts",
            "organizations:DescribeOrganization",
            "organizations:ListRoots",
            "savingsplans:DescribeSavingsPlanRates",
            "savingsplans:DescribeSavingsPlans",
            "savingsplans:DescribeSavingsPlansOfferingRates",
            "savingsplans:DescribeSavingsPlansOfferings",
            "savingsplans:ListTagsForResource",
            "support:CreateCase",
            "support:DescribeCases"
          ],
          "Resource": "*"
        },
        {
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::*:role/nops-sa-child-role-minimal"
        }
      ]
    }
    ```
  </Accordion>

  <Accordion title="Full Platform (Inform & Operate) — four documents">
    Full Platform doesn't use a single allow-only policy. It attaches four documents to the role instead:

    | Document                      | Type                     | Purpose                                                                                                                                                                                                                                                                                  |
    | ----------------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | `ReadOnlyAccess`              | AWS-managed              | Broad read coverage across AWS services                                                                                                                                                                                                                                                  |
    | `nOpsFullPlatformDenyList1`   | Customer-managed (Deny)  | Deny list part 1 of 2 — carves sensitive read actions (for example Secrets Manager, Cognito, KMS key material, DynamoDB item reads) out of `ReadOnlyAccess`. Split with part 2 to stay under IAM's 6,144-character customer-managed policy size quota. A Deny always overrides an Allow. |
    | `nOpsFullPlatformDenyList2`   | Customer-managed (Deny)  | Deny list part 2 of 2 — continues the sensitive-action carve-out from `ReadOnlyAccess`.                                                                                                                                                                                                  |
    | `nOpsFullPlatformPermissions` | Customer-managed (Allow) | Actions `ReadOnlyAccess` doesn't cover — a handful of writes needed for rightsizing/operational workflows, a few reads the Deny lists above block that nOps still needs, and `sts:AssumeRole` for the optional [SA child role](#sa-child-roles)                                          |

    <Info>
      Use **Copy Policy** in the nOps wizard for each document to get the current JSON — the Deny lists together cover 180+ entries and are best copied directly rather than retyped.
    </Info>
  </Accordion>
</AccordionGroup>

### SA Child Roles

To extend read access to your AWS Organization's **member accounts**, deploy a child role via CloudFormation StackSets from your payer account. This is optional and not required to finish onboarding.

| Role name                    | Deployed via                  | Matches                     |
| ---------------------------- | ----------------------------- | --------------------------- |
| `nops-sa-child-role`         | StackSets, from payer account | Full Platform payer role    |
| `nops-sa-child-role-minimal` | StackSets, from payer account | Minimum Platform payer role |

Each child role trusts only the payer integration role (passed as the `PayerRoleArn` CloudFormation parameter), and its permissions mirror the payer role's own tier. A payer role can only assume the child role name matching its own tier — a Full Platform payer role can't assume `nops-sa-child-role-minimal`, and vice versa.

***

## Permissions -- Commitment Management

Commitment Management uses **three additional cross-account IAM roles** deployed via CloudFormation. These are separate from the Savings Analysis role.

### Role Summary

| Role name                  | Account                             | Purpose                                                      | How nOps reaches it                        |
| -------------------------- | ----------------------------------- | ------------------------------------------------------------ | ------------------------------------------ |
| `NopsCMCrossAccountAssume` | Any org account                     | Assume child read roles across member accounts               | nOps bridge → this role (with external ID) |
| `NopsCMReadEC2Instances`   | Each member account (via StackSets) | Read-only EC2, RDS, ElastiCache, and Savings Plans inventory | Central role → this role                   |
| `nops-sharesave-mgt`       | Dedicated child account             | Commitment purchasing and management                         | nOps bridge → this role (with external ID) |

### Role 1: NopsCMCrossAccountAssume (Central Role)

Deployed in **any account in your AWS Organization** (not required to be the payer / management account). This role's only permission is to assume the child read role in member accounts.

<AccordionGroup>
  <Accordion title="Trust policy">
    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::861341088565:role/NopsCMCentralClientAccountAssume"
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "<central_external_id_from_nops>"
            }
          }
        }
      ]
    }
    ```
  </Accordion>

  <Accordion title="Inline policy: NopsCMAssumeChildRoles">
    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "arn:aws:iam::*:role/NopsCMReadEC2Instances"
        }
      ]
    }
    ```
  </Accordion>
</AccordionGroup>

### Role 2: NopsCMReadEC2Instances (Child Read Role)

Deployed in **every member account** via CloudFormation StackSets. Provides read-only access to compute and commitment metadata.

<AccordionGroup>
  <Accordion title="Trust policy">
    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::<central-account-id>:role/NopsCMCrossAccountAssume"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }
    ```

    <Info>
      The `CentralRoleArn` parameter in the CloudFormation template is set to the ARN of your `NopsCMCrossAccountAssume` role. Only that central role can assume this child read role.
    </Info>
  </Accordion>

  <Accordion title="Inline policy: NopsCMReadEC2Policy">
    | Action                                   | Service       | Purpose                                                                    |
    | ---------------------------------------- | ------------- | -------------------------------------------------------------------------- |
    | `ec2:DescribeInstances`                  | EC2           | List running instances for coverage analysis                               |
    | `ec2:DescribeReservedInstances`          | EC2           | List active EC2 Reserved Instances                                         |
    | `savingsplans:DescribeSavingsPlans`      | Savings Plans | List active Savings Plans                                                  |
    | `rds:DescribeDBInstances`                | RDS           | List RDS instances for coverage analysis                                   |
    | `rds:DescribeReservedDBInstances`        | RDS           | List active RDS Reserved Instances                                         |
    | `elasticache:DescribeReservedCacheNodes` | ElastiCache   | List active ElastiCache Reserved Cache Nodes                               |
    | `organizations:ListAccounts`             | Organizations | List organization member accounts (returns data only in the payer account) |

    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:DescribeInstances",
            "ec2:DescribeReservedInstances",
            "savingsplans:DescribeSavingsPlans",
            "rds:DescribeDBInstances",
            "rds:DescribeReservedDBInstances",
            "elasticache:DescribeReservedCacheNodes",
            "organizations:ListAccounts"
          ],
          "Resource": "*"
        }
      ]
    }
    ```
  </Accordion>
</AccordionGroup>

### Role 3: nops-sharesave-mgt (ShareSave Role)

Deployed in a **dedicated child account** within your AWS Organization. This role has the permissions needed to purchase and manage commitments. Purchased commitments automatically apply across the organization via RI/SP sharing.

<AccordionGroup>
  <Accordion title="Trust policy">
    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::861341088565:role/CrossAccountSharesaveMgt"
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "<sharesave_external_id_from_nops>"
            }
          }
        }
      ]
    }
    ```
  </Accordion>

  <Accordion title="AWS managed policies (5)">
    | Managed Policy ARN                                       | Policy Name                        | Purpose                                               |
    | -------------------------------------------------------- | ---------------------------------- | ----------------------------------------------------- |
    | `arn:aws:iam::aws:policy/AWSSavingsPlansFullAccess`      | AWS Savings Plans Full Access      | Create, describe, list, and return Savings Plans      |
    | `arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess` | AWS Organizations Read-Only Access | List and describe organization accounts and structure |
    | `arn:aws:iam::aws:policy/AWSCloudTrail_ReadOnlyAccess`   | AWS CloudTrail Read-Only Access    | Read CloudTrail event history for auditing            |
    | `arn:aws:iam::aws:policy/AWSSupportAccess`               | AWS Support Access                 | Create and view AWS support cases                     |
    | `arn:aws:iam::aws:policy/ServiceQuotasFullAccess`        | Service Quotas Full Access         | View and request service quota increases              |
  </Accordion>

  <Accordion title="Inline policy: NopsSharesaveMgtPolicy">
    | Action                                            | Service       | Purpose                                                 |
    | ------------------------------------------------- | ------------- | ------------------------------------------------------- |
    | `ec2:CreateTags`                                  | EC2           | Tag purchased Reserved Instances                        |
    | `ec2:DescribeReservedInstances`                   | EC2           | List active EC2 RIs                                     |
    | `ec2:DescribeReservedInstancesListings`           | EC2           | View RI marketplace listings                            |
    | `ec2:DescribeReservedInstancesModifications`      | EC2           | Track RI modification status                            |
    | `ec2:DescribeReservedInstancesOfferings`          | EC2           | Discover available RI offerings                         |
    | `ec2:ModifyReservedInstances`                     | EC2           | Modify RI scope or Availability Zone                    |
    | `ec2:PurchaseReservedInstancesOffering`           | EC2           | Purchase EC2 Reserved Instances                         |
    | `ec2:CreateReservedInstancesListing`              | EC2           | List RIs on the RI Marketplace                          |
    | `ec2:CancelReservedInstancesListing`              | EC2           | Cancel RI Marketplace listings                          |
    | `ec2:DeleteQueuedReservedInstances`               | EC2           | Cancel a queued (not-yet-fired) RI purchase             |
    | `ec2:GetReservedInstancesExchangeQuote`           | EC2           | Get pricing for convertible RI exchange                 |
    | `ec2:AcceptReservedInstancesExchangeQuote`        | EC2           | Execute convertible RI exchange                         |
    | `rds:DescribeReservedDBInstances`                 | RDS           | List active RDS RIs                                     |
    | `rds:DescribeReservedDBInstancesOfferings`        | RDS           | Discover available RDS RI offerings                     |
    | `rds:PurchaseReservedDBInstancesOffering`         | RDS           | Purchase RDS Reserved Instances                         |
    | `elasticache:DescribeReservedCacheNodes`          | ElastiCache   | List active ElastiCache RIs                             |
    | `elasticache:DescribeReservedCacheNodesOfferings` | ElastiCache   | Discover available ElastiCache RI offerings             |
    | `elasticache:PurchaseReservedCacheNodesOffering`  | ElastiCache   | Purchase ElastiCache Reserved Cache Nodes               |
    | `savingsplans:ReturnSavingsPlan`                  | Savings Plans | Return (cancel) a Savings Plan within the return window |
    | `savingsplans:TagResource`                        | Savings Plans | Tag purchased Savings Plans                             |
    | `ce:*`                                            | Cost Explorer | Full access to cost and reservation analysis            |

    ```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CreateTags",
            "ec2:DescribeReservedInstances",
            "ec2:DescribeReservedInstancesListings",
            "ec2:DescribeReservedInstancesModifications",
            "ec2:DescribeReservedInstancesOfferings",
            "ec2:ModifyReservedInstances",
            "ec2:PurchaseReservedInstancesOffering",
            "ec2:CreateReservedInstancesListing",
            "ec2:CancelReservedInstancesListing",
            "ec2:DeleteQueuedReservedInstances",
            "ec2:GetReservedInstancesExchangeQuote",
            "ec2:AcceptReservedInstancesExchangeQuote",
            "rds:DescribeReservedDBInstances",
            "rds:DescribeReservedDBInstancesOfferings",
            "rds:PurchaseReservedDBInstancesOffering",
            "elasticache:DescribeReservedCacheNodes",
            "elasticache:DescribeReservedCacheNodesOfferings",
            "elasticache:PurchaseReservedCacheNodesOffering",
            "savingsplans:ReturnSavingsPlan",
            "savingsplans:TagResource",
            "ce:*"
          ],
          "Resource": "*"
        }
      ]
    }
    ```
  </Accordion>
</AccordionGroup>

***

## Complete Role Summary

<Accordion title="All roles at a glance (Savings Analysis + Commitment Management)">
  | Account                           | Role                                                 |      Platform integration      |        Commitment Management       |
  | --------------------------------- | ---------------------------------------------------- | :----------------------------: | :--------------------------------: |
  | Payer                             | `nops-integration-role-<client_id>`                  | Yes (Minimum or Full Platform) |                 --                 |
  | Each member (StackSets, optional) | `nops-sa-child-role` or `nops-sa-child-role-minimal` |         Yes (optional)         |                 --                 |
  | Any org account                   | `NopsCMCrossAccountAssume`                           |               --               |                 Yes                |
  | Payer (direct stack)              | `NopsCMReadEC2Instances`                             |               --               | Yes (management-account inventory) |
  | Each member (StackSets)           | `NopsCMReadEC2Instances`                             |               --               |                 Yes                |
  | Dedicated child                   | `nops-sharesave-mgt`                                 |               --               |                 Yes                |
</Accordion>

***

## Resources Created

During the setup process, nOps CloudFormation templates create the following resources in your AWS environment.

| Resource                                                                                                                                   | Account                 | Created by                                                                                                           |
| ------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- | -------------------------------------------------------------------------------------------------------------------- |
| S3 bucket for CUR delivery (the name you enter in the wizard)                                                                              | Payer                   | CloudFormation (skipped if you point the stack at an existing bucket)                                                |
| S3 bucket policy on that bucket, allowing AWS billing to deliver the report                                                                | Payer                   | CloudFormation (only for a bucket the stack creates — see [CUR delivery bucket policy](#cur-delivery-bucket-policy)) |
| Legacy CUR export `nops_cur_<client_id>_hourly`                                                                                            | Payer                   | AWS Billing console (manual) or CloudFormation                                                                       |
| IAM role `nops-integration-role-<client_id>`                                                                                               | Payer                   | Manual (setup wizard) or CloudFormation                                                                              |
| IAM policy `nOpsBucketPolicy`                                                                                                              | Payer                   | Manual (setup wizard) or CloudFormation                                                                              |
| IAM policy `nOpsMinimumPlatformPermissions` or (`nOpsFullPlatformDenyList1` + `nOpsFullPlatformDenyList2` + `nOpsFullPlatformPermissions`) | Payer                   | Manual (setup wizard; one set per integration) or CloudFormation                                                     |
| IAM role `nops-sa-child-role` or `nops-sa-child-role-minimal`                                                                              | Each member account     | CloudFormation StackSet (optional)                                                                                   |
| IAM role `NopsCMCrossAccountAssume`                                                                                                        | Any org account         | CloudFormation stack                                                                                                 |
| IAM role `NopsCMReadEC2Instances`                                                                                                          | Each member account     | CloudFormation StackSet                                                                                              |
| IAM role `nops-sharesave-mgt`                                                                                                              | Dedicated child account | CloudFormation stack                                                                                                 |

<Info>
  All IAM roles use **external IDs** in their trust policies (where applicable) to prevent the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html). External IDs are unique per integration and generated by nOps during onboarding.
</Info>

### CUR delivery bucket policy

When AWS creates a Cost and Usage Report, it checks that the destination bucket lets the billing service write to it. The Billing console adds that permission for you; CloudFormation does not. So when the integration stack creates the bucket, it also attaches this policy:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NopsCurGetBucketMetadata",
      "Effect": "Allow",
      "Principal": { "Service": "billingreports.amazonaws.com" },
      "Action": ["s3:GetBucketAcl", "s3:GetBucketPolicy"],
      "Resource": "arn:aws:s3:::<your-cur-bucket-name>",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "<your-account-id>",
          "aws:SourceArn": "arn:aws:cur:us-east-1:<your-account-id>:definition/*"
        }
      }
    },
    {
      "Sid": "NopsCurPutObject",
      "Effect": "Allow",
      "Principal": { "Service": "billingreports.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<your-cur-bucket-name>/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "<your-account-id>",
          "aws:SourceArn": "arn:aws:cur:us-east-1:<your-account-id>:definition/*"
        }
      }
    }
  ]
}
```

This grants AWS billing, and nobody else, the ability to deliver reports into the bucket. It does not grant nOps anything — nOps reads the CUR through `nOpsBucketPolicy` on the integration role.

<Warning>
  **nOps never writes a bucket policy on a bucket you already own.** A bucket policy is one document, so attaching ours would replace everything already on your bucket. If you point the stack at an existing bucket (`CreateCurBucket=false`), that bucket must already allow `billingreports.amazonaws.com` — otherwise AWS rejects the export with *"Failed to verify customer bucket permission"*. The stack's **CurBucketPolicyManaged** output tells you which case applies.
</Warning>

***

## Cross-Account Role Chains

nOps uses two role-assumption chains to access your AWS resources. Each chain starts from an nOps-owned bridge role.

### Commitment Inventory (read path)

```
nOps bridge role (NopsCMCentralClientAccountAssume)
  → NopsCMCrossAccountAssume (your central account, with external ID)
    → NopsCMReadEC2Instances (your member accounts)
```

### Commitment Operations (purchase path)

```
nOps bridge role (CrossAccountSharesaveMgt)
  → nops-sharesave-mgt (your dedicated child account, with external ID)
```

***

## Security Model

| Layer                               | Protection                                                                                                         |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **External IDs**                    | Prevent confused deputy attacks; unique per integration                                                            |
| **Separate IAM roles**              | Purchase permissions are scoped to a dedicated role (`nops-sharesave-mgt`), isolated from your integration role    |
| **Scoped trust policies**           | Each role trusts only the specific nOps bridge role that needs to assume it                                        |
| **Least-privilege inline policies** | Child read role has only 7 read-only actions; ShareSave role has only the actions needed for commitment operations |
| **AWS managed policies**            | Used for well-defined access scopes (Savings Plans, Organizations, CloudTrail, Support, Service Quotas)            |
| **Verification checks**             | nOps verifies role assumption and API access before enabling CM                                                    |

***

## Network Requirements

nOps does not require any VPC peering, VPN connections, or network-level access to your AWS environment. All communication uses standard AWS API calls via cross-account role assumption over HTTPS.

***

## Related Guides

<CardGroup cols={2}>
  <Card title="AWS Integration Setup" icon="plug" href="/aws/integration-setup">
    Connect your payer account for Savings Analysis (CUR + IAM role).
  </Card>

  <Card title="AWS Commitment Management Setup" icon="chart-line" href="/aws/commitment-management-setup">
    Step-by-step guide to deploy the three CM roles via CloudFormation.
  </Card>

  <Card title="Users and Roles" icon="users" href="/platform/users">
    Manage team members and Admin/Owner roles for integration access.
  </Card>

  <Card title="Platform Integrations" icon="plug" href="/platform/integrations">
    Overview of all cloud integrations and setup entry points.
  </Card>
</CardGroup>