AWS Permissions
The AWS bundle (see Tools & Integrations) follows a simpler model than the Microsoft APIs: instead of a long list of individually granted permissions, CloudPeek's IAM role uses one AWS-managed policy for reading, and you opt in to write access per service.
Read access: the SecurityAudit managed policy
Attach the AWS-managed SecurityAudit policy to the IAM role (or user) whose credentials you enter when configuring the AWS bundle. It grants read-only access across AWS services and is maintained by AWS, so new read APIs are covered without you editing policy documents.
This single policy is enough for everything the AI reads during investigations and triage:
| Service | Read use case |
|---|---|
| Security Hub | Ingest and search findings, compliance summaries and enabled standards; Security Hub findings can act as an automatic alert source |
| GuardDuty | List and inspect threat detections, detector status and member accounts |
| CloudWatch Logs | Search log groups and run Logs Insights queries for investigation evidence |
| IAM | Review users, roles, policies and the credential report during identity investigations |
| Security Lake | Query normalised (OCSF) security data and search findings across the lake; needs extra permissions beyond SecurityAudit, see below |
| Systems Manager (SSM) | Read instance inventory, patch baselines and compliance state for hosts involved in alerts |
Security Lake needs more than SecurityAudit
Security Lake queries run through Amazon Athena, and SecurityAudit does not include Athena query execution or Lake Formation data access. To use the Security Lake tools, additionally register the role as a Security Lake query subscriber (with Lake Formation SELECT on the lake tables) and grant it:
| IAM actions | Why |
|---|---|
athena:StartQueryExecution, athena:GetQueryExecution, athena:GetQueryResults | Run the Athena queries behind aws_security_lake_query and aws_security_lake_search_findings and fetch their results |
glue:GetDatabase, glue:GetTable, glue:GetTables | Let Athena resolve the Security Lake databases and tables (aws_security_lake_list_tables) |
lakeformation:GetDataAccess | Lake Formation credential vending for reading the lake data |
s3:GetObject, s3:PutObject on the Athena results bucket | Athena writes query results to an S3 output location and CloudPeek reads them back |
Write access: opt in per service
Write permissions are not part of SecurityAudit and are deliberately opt-in: only grant them for the services where you want the AI to be able to act. Every write goes through Human-in-the-Loop approval as a follow-up action; an action whose permission you have not granted simply fails, and CloudPeek reports the denied permission.
Add only the statements you want to an additional policy on the same role:
| Service | IAM actions | What the AI can then do |
|---|---|---|
| Security Hub | securityhub:BatchUpdateFindings, securityhub:UpdateFindings | Update finding workflow status, severity and notes so Security Hub reflects triage outcomes (both the current and legacy update APIs) |
| Security Hub (setup only) | securityhub:EnableSecurityHub, securityhub:EnableOrganizationAdminAccount | Enable Security Hub, or designate the organisation admin account, from CloudPeek during initial setup; not needed once Security Hub is running |
| CloudWatch | cloudwatch:PutMetricAlarm | Create metric alarms as a follow-up action, for example alerting on recurrence of investigated activity |
| Systems Manager | ssm:SendCommand, ssm:GetCommandInvocation, ssm:ListCommandInvocations | Run approved commands on managed instances and read back their output; see below |
| EC2 | ec2:ModifySecurityGroupRules | Tighten security group rules to contain a compromised instance |
| EC2 | ec2:CreateFlowLogs | Enable VPC flow logs where telemetry is missing during an investigation |
Systems Manager and Patch Manager
Systems Manager write access is the most capable grant, and the most worth scoping:
- Incident response (Run Command): with
ssm:SendCommand, the AI can propose commands on an affected instance as a follow-up action, for example collecting forensic data, listing processes or stopping a malicious service. CloudPeek only ever invokes the stockAWS-RunShellScriptandAWS-RunPowerShellScriptdocuments (the tool rejects any other document name), so you can restrict the document resource ARNs in the policy statement to exactly those two.ssm:GetCommandInvocationandssm:ListCommandInvocationslet the investigation read back each command's output and status. - Patch Manager: patch access is read-only. Patch baselines and patch compliance state are read through SecurityAudit (the
aws_ssminventory and compliance tools), so investigations can report which instances are missing which patches. CloudPeek does not executeAWS-RunPatchBaselineor install patches; no patching permissions need to be granted.
Every command is proposed to an analyst through HITL before it runs.
ssm:SendCommand allows command execution on your instances. Grant it with resource ARNs limited to the AWS-RunShellScript and AWS-RunPowerShellScript documents and to the instances or tags your change control permits.
Least-privilege guidance: start with SecurityAudit only. The read-only bundle is fully functional for triage and investigation, and you can add individual write actions later once you have seen the follow-up actions the AI proposes and want to approve them from within CloudPeek.