Overview
Porter creates several roles and policies for use in the management of your AWS account. These may change over time, and will be automatically updated both here, and on your AWS account. Make sure to check back here for updates, and if you have any questions, please reach out via the support widget on the dashboard.Initial Permissions
When signing up for Porter on AWS, you will be asked to create a cloudformation stack. This is only used for setting up the initial permissions required for Porter to manage your account. If you are operating in a regulated environment, these are the minimum permissions required to execute the initial cloudformation stack:Roles
Porter Access Manager
Porter Access Manager is a role that Porter creates to manage the access given to the other roles in this document. If permissions are removed from this role, you will be unable to access new features of Porter.Porter Manager
Porter Manager is used for all API operations from Porter, to your AWS account. This role is primarily used to read resources in your account to ensure that Porter is not creating duplicate resources, or using resources managed by a non-Porter process. This role may adopt policies from the other roles mentioned here, when managing their specific domains. Porter Manager attaches the three policies below.Read
Describe, List and Get calls across the resources Porter manages. Nothing here changes state.Write
The calls that change state in your account.Data Access
The reads that return the contents of your secrets and stored objects. Porter needs these to sync environment groups and to pull images.Porter EKS Manager
Porter EKS Manager is the role used by EKS to perform actions on your AWS account, for ongoing maintenance of your EKS cluster.Porter Node Manager
Porter Node Manager is the role used by EKS worker nodes. This role also includes access to some AWS-provided roles such as:AmazonEKS_CNI_PolicyAmazonEKSClusterPolicyAmazonEKSWorkerNodePolicyAmazonEC2ContainerRegistryReadOnlyservice-role/AmazonEBSCSIDriverPolicyservice-role/AmazonEFSCSIDriverPolicy