Scanner Permissions and Trust | Cloud Cost Clinic

What the role can never do

The role grants no write, change, or data access of any kind. It cannot:

delete, stop, start, resize, or modify any resource
create resources or change networking, security groups, or IAM
read your application data, S3 object contents, database contents, or logs' contents
read secrets, parameters, or environment variables
create access keys or escalate its own permissions

Findings are a review queue, not a delete list. Nothing in the product issues remediation calls against your account. The role is deployed by you and never modified from our side — a future scanner feature that needed a new permission would require you to deploy an updated template yourself. Connections do not update themselves.

The trust model in one paragraph

You deploy a small CloudFormation stack in your AWS account. It creates one IAM role that trusts the Cloud Cost Clinic scanner account and requires a unique external ID assigned to your product account (sts:ExternalId), so no other Cloud Cost Clinic user, and no third party, can use your role even if they guess its name. This is the cross-account pattern AWS documents and recommends for third-party access. The scanner assumes the role only while running a scan you start. No static access keys, no agents, no software installed in your account. Deleting the stack revokes all access instantly.

Review the exact template before deploying: cloud-cost-clinic-readonly-scanner-role.yaml.

Every permission, and why

Base policy: AWS managed `ViewOnlyAccess`

The role attaches AWS's own ViewOnlyAccess job-function policy. AWS maintains it as a strictly metadata-level view: List and Describe style actions only, and explicitly not the broader ReadOnlyAccess policy (which can read S3 object contents - the scanner deliberately avoids it). ViewOnlyAccess powers the resource checks: unattached EBS volumes, idle Elastic IPs, snapshot ages, NAT Gateways, log group retention settings, load balancer state, RDS instance metadata, and CloudWatch metrics for utilization signals.

Additional read-only permissions

Permission	Used for
`budgets:ViewBudget`	Checking whether any AWS Budget exists. A missing budget is reported as a guardrail gap.
`ce:GetCostAndUsage` / `ce:Get*`	Checking Cost Anomaly Detection monitors, the data-transfer/cross-AZ spend review, and calibrating waste estimates against what your account actually billed in the last 30 days so the numbers are honest.
`billing:GetBillingViewData`	Billing-view metadata needed by the cost checks in accounts using AWS's newer billing views.
`compute-optimizer:Get*`	Reading AWS Compute Optimizer's own recommendations where enabled, instead of inventing rightsizing claims.
`cloudtrail:DescribeTrails`, `cloudtrail:GetEventSelectors`, `cloudtrail:GetTrailStatus`	Checking whether CloudTrail management events are recorded per Region - the prerequisite for the optional resource-birth monitor, and a governance signal on its own.
`ecr:GetLifecyclePolicy` (your account's repositories only)	Checking whether ECR repositories have lifecycle policies. Reads the policy document, never image contents.
`s3:GetLifecycleConfiguration`, `s3:GetBucketVersioning`, `s3:GetBucketLocation`	Checking whether buckets have lifecycle rules and versioning configured. Bucket-level settings only - the role cannot read any object.

The optional resource-birth monitor

After a successful scan you can optionally deploy a second small stack: cloud-cost-clinic-resource-birth-monitor.yaml. It creates two EventBridge rules (one for plain creation events, one for expensive-type EC2 launches and volume creations - volume alerts are filtered to large or high-IOPS volumes on the Cloud Cost Clinic side, and smaller ones are discarded) and one forwarding role in your account. The forwarding role has exactly one permission: events:PutEvents to the Cloud Cost Clinic alert bus. The rule forwards only selected CloudTrail resource-creation events (NAT Gateways, expensive EC2 instance types, RDS/Aurora, Redshift, OpenSearch, SageMaker, EKS, EMR, MSK, Elastic IPs, and similar high-cost signals) so you get an alert minutes after something expensive is created - before it shows up on a bill. It cannot remediate, mutate, or read anything in your account.

What Cloud Cost Clinic stores, and for how long

Your product account email and per-user external ID.
Which AWS account IDs you registered and when they were last scanned.
Scan reports (finding titles, services, regions, resource IDs you chose to scan, and estimates) so you can revisit history. Reports are private to your sign-in, and stored history is capped by plan — the free tier keeps your most recent 5 scans and older ones drop off.
Resource-birth alerts, when the optional monitor is deployed — these expire automatically after 30 days.

The scanner never stores AWS credentials (role sessions are temporary and discarded), never reads application data, and publishes its role and monitor templates openly at the links above so the access can be audited before you grant it.

How to revoke access

Delete the CloudFormation stack(s) in your AWS account. The role and EventBridge rule disappear with them, and the scanner's access ends immediately. Nothing on Cloud Cost Clinic's side can restore it.

FAQ

Why does it need an external ID?

The external ID is AWS's standard defense against the confused-deputy problem: your role only honors requests that present the exact external ID assigned to your product account, so the scanner can never be tricked into using one customer's access on behalf of another.

Can I review the code that runs against my account?

The role template and monitor template are published above. The scan itself only calls List/Describe/Get metadata APIs covered by the permissions on this page - if a check cannot read something, the report says "could not scan" rather than asking for more access.

Does the scanner work with restricted role names?

Yes. If your organization requires specific IAM naming, the role name may be the standard CloudCostClinicReadOnlyScannerRole plus a suffix; registration accepts the custom name.