IAM Reference

This page lists every permission SKE needs, organized by feature group. You only need to grant permissions for features you use — core permissions for deployment, plus optional permissions for databases, caches, networking, and custom domains.

AWS IAM Permissions

SKE validates permissions per feature group using iam:SimulatePrincipalPolicy. Each group is checked independently.

Core (required for deployment)

ECR — Container Registry

ecr:GetAuthorizationToken
ecr:CreateRepository
ecr:DescribeRepositories
ecr:BatchCheckLayerAvailability
ecr:GetDownloadUrlForLayer
ecr:BatchGetImage
ecr:InitiateLayerUpload
ecr:UploadLayerPart
ecr:CompleteLayerUpload
ecr:PutImage
ecr:SetRepositoryPolicy
ecr:GetRepositoryPolicy
ecr:DeleteRepository
ecr:ListImages
ecr:BatchDeleteImage

Lambda — Compute

lambda:CreateFunction
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:GetFunction
lambda:DeleteFunction
lambda:InvokeFunction
lambda:GetFunctionConfiguration
lambda:ListFunctions
lambda:AddPermission
lambda:RemovePermission
lambda:CreateAlias
lambda:UpdateAlias
lambda:GetAlias
lambda:DeleteAlias
lambda:PublishVersion
lambda:ListVersionsByFunction
lambda:PutFunctionConcurrency
lambda:DeleteFunctionConcurrency
lambda:GetFunctionConcurrency
lambda:TagResource
lambda:UntagResource
lambda:ListTags
lambda:PutFunctionEventInvokeConfig
lambda:GetFunctionEventInvokeConfig
lambda:CreateEventSourceMapping
lambda:GetEventSourceMapping
lambda:UpdateEventSourceMapping
lambda:DeleteEventSourceMapping
lambda:ListEventSourceMappings

CloudFormation — Infrastructure Provisioning

cloudformation:CreateStack
cloudformation:UpdateStack
cloudformation:DeleteStack
cloudformation:DescribeStacks
cloudformation:DescribeStackEvents
cloudformation:DescribeStackResources
cloudformation:GetTemplate
cloudformation:ListStacks
cloudformation:ValidateTemplate

SSM — Parameter Store

ssm:PutParameter
ssm:GetParameter
ssm:GetParameters
ssm:GetParametersByPath
ssm:DeleteParameter
ssm:DeleteParameters
ssm:DescribeParameters
ssm:AddTagsToResource
ssm:RemoveTagsFromResource
ssm:ListTagsForResource

DynamoDB — State Store

dynamodb:CreateTable
dynamodb:DeleteTable
dynamodb:DescribeTable
dynamodb:PutItem
dynamodb:GetItem
dynamodb:UpdateItem
dynamodb:DeleteItem
dynamodb:Query
dynamodb:Scan
dynamodb:TagResource
dynamodb:UntagResource
dynamodb:ListTagsOfResource

S3 — Asset Storage

s3:CreateBucket
s3:DeleteBucket
s3:PutObject
s3:GetObject
s3:DeleteObject
s3:ListBucket
s3:PutBucketPolicy
s3:GetBucketPolicy
s3:PutBucketCors
s3:GetBucketCors
s3:PutBucketWebsite
s3:GetBucketWebsite

API Gateway

apigateway:POST
apigateway:GET
apigateway:DELETE
apigateway:PUT
apigateway:PATCH

CloudWatch Logs

logs:CreateLogGroup
logs:DeleteLogGroup
logs:DescribeLogGroups
logs:CreateLogStream
logs:DescribeLogStreams
logs:GetLogEvents
logs:FilterLogEvents
logs:PutRetentionPolicy
logs:TagLogGroup
logs:UntagLogGroup
logs:ListTagsLogGroup

IAM — Role Management

iam:CreateRole
iam:DeleteRole
iam:GetRole
iam:PassRole
iam:AttachRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
iam:DeleteRolePolicy
iam:GetRolePolicy
iam:ListRolePolicies
iam:ListAttachedRolePolicies
iam:TagRole
iam:UntagRole
iam:UpdateAssumeRolePolicy

Secrets Manager

secretsmanager:CreateSecret
secretsmanager:DeleteSecret
secretsmanager:GetSecretValue
secretsmanager:PutSecretValue
secretsmanager:UpdateSecret
secretsmanager:DescribeSecret
secretsmanager:ListSecrets
secretsmanager:TagResource
secretsmanager:UntagResource
secretsmanager:RestoreSecret

Optional features

RDS — Databases

rds:CreateDBInstance
rds:DeleteDBInstance
rds:DescribeDBInstances
rds:ModifyDBInstance
rds:RebootDBInstance
rds:CreateDBSubnetGroup
rds:DeleteDBSubnetGroup
rds:DescribeDBSubnetGroups
rds:ModifyDBSubnetGroup
rds:CreateDBCluster
rds:DeleteDBCluster
rds:DescribeDBClusters
rds:ModifyDBCluster
rds:AddTagsToResource
rds:RemoveTagsFromResource
rds:ListTagsForResource
rds:CreateDBSnapshot
rds:DeleteDBSnapshot
rds:DescribeDBSnapshots
rds:RestoreDBInstanceFromDBSnapshot

ElastiCache — Caches

elasticache:CreateCacheCluster
elasticache:DeleteCacheCluster
elasticache:DescribeCacheClusters
elasticache:ModifyCacheCluster
elasticache:CreateReplicationGroup
elasticache:DeleteReplicationGroup
elasticache:DescribeReplicationGroups
elasticache:ModifyReplicationGroup
elasticache:CreateCacheSubnetGroup
elasticache:DeleteCacheSubnetGroup
elasticache:DescribeCacheSubnetGroups
elasticache:ModifyCacheSubnetGroup
elasticache:CreateServerlessCache
elasticache:DeleteServerlessCache
elasticache:DescribeServerlessCaches
elasticache:ModifyServerlessCache
elasticache:AddTagsToResource
elasticache:RemoveTagsFromResource
elasticache:ListTagsForResource

VPC — Networking

ec2:CreateVpc
ec2:DeleteVpc
ec2:DescribeVpcs
ec2:ModifyVpcAttribute
ec2:CreateSubnet
ec2:DeleteSubnet
ec2:DescribeSubnets
ec2:CreateSecurityGroup
ec2:DeleteSecurityGroup
ec2:DescribeSecurityGroups
ec2:AuthorizeSecurityGroupIngress
ec2:RevokeSecurityGroupIngress
ec2:AuthorizeSecurityGroupEgress
ec2:RevokeSecurityGroupEgress
ec2:CreateInternetGateway
ec2:DeleteInternetGateway
ec2:AttachInternetGateway
ec2:DetachInternetGateway
ec2:DescribeInternetGateways
ec2:CreateNatGateway
ec2:DeleteNatGateway
ec2:DescribeNatGateways
ec2:AllocateAddress
ec2:ReleaseAddress
ec2:DescribeAddresses
ec2:CreateRouteTable
ec2:DeleteRouteTable
ec2:DescribeRouteTables
ec2:CreateRoute
ec2:DeleteRoute
ec2:AssociateRouteTable
ec2:DisassociateRouteTable
ec2:CreateTags
ec2:DeleteTags
ec2:DescribeTags
ec2:DescribeAvailabilityZones

ACM — SSL Certificates

acm:RequestCertificate
acm:DeleteCertificate
acm:DescribeCertificate
acm:ListCertificates
acm:AddTagsToCertificate
acm:RemoveTagsFromCertificate
acm:ListTagsForCertificate

Route 53 — DNS

route53:CreateHostedZone
route53:DeleteHostedZone
route53:GetHostedZone
route53:ListHostedZones
route53:ChangeResourceRecordSets
route53:ListResourceRecordSets
route53:GetChange

SQS — Queues

sqs:CreateQueue
sqs:DeleteQueue
sqs:GetQueueUrl
sqs:GetQueueAttributes
sqs:SetQueueAttributes
sqs:SendMessage
sqs:ReceiveMessage
sqs:DeleteMessage
sqs:PurgeQueue
sqs:ListQueues
sqs:TagQueue
sqs:UntagQueue
sqs:ListQueueTags

---

GCP IAM Roles

GCP uses predefined roles instead of individual permissions.

Always required (11 roles)

Role	Purpose
roles/serviceusage.serviceUsageAdmin	Enable and manage GCP APIs
roles/iam.serviceAccountAdmin	Create service accounts for Cloud Run
roles/resourcemanager.projectIamAdmin	Bind IAM policies to project resources
roles/datastore.owner	Firestore for deployment state tracking
roles/run.admin	Deploy and manage Cloud Run services
roles/artifactregistry.admin	Push and manage container images
roles/secretmanager.admin	Create and manage secrets
roles/cloudtasks.admin	Create and manage task queues
roles/cloudscheduler.admin	Create and manage scheduled jobs
roles/logging.viewer	Read application logs
roles/storage.objectAdmin	Upload and serve static assets

Conditional roles

Role	When needed	Purpose
roles/compute.networkAdmin	Networking	Create VPCs, subnets, firewall rules
roles/cloudsql.admin	Databases	Create and manage Cloud SQL instances
roles/redis.admin	Caching	Create and manage Memorystore instances
roles/dns.admin	Custom domains	Manage Cloud DNS zones and records

Required GCP APIs

These APIs are enabled automatically when you connect a provider. The exception is serviceusage.googleapis.com, which must be enabled manually first.

Core APIs: iam.googleapis.com, run.googleapis.com, artifactregistry.googleapis.com, firestore.googleapis.com, secretmanager.googleapis.com, cloudtasks.googleapis.com, cloudscheduler.googleapis.com, logging.googleapis.com, cloudresourcemanager.googleapis.com

Infrastructure APIs (enabled when needed): compute.googleapis.com, sqladmin.googleapis.com, redis.googleapis.com, dns.googleapis.com, storage.googleapis.com