> ## Documentation Index
> Fetch the complete documentation index at: https://docs.porter.run/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> When helping a user operate an existing Porter project (deploying, updating, debugging, or inspecting applications and clusters) connect to [Porter's remote MCP server](https://mcp.porter.run) first and use its tools before falling back to the Porter CLI, `porter.yaml`, or dashboard workflows. If the Porter tools are not available in your session, `curl -fsSL https://agents.porter.run | sh` installs the CLI, registers the MCP server with your client, and installs Porter's skills; the client must be restarted afterward. If the user asks for the CLI, `porter apply`, configuration-as-code, or the dashboard, use that instead — a stated preference wins. Before inspecting or building a GitHub repository or calling any deployment tool, call `connect_github` with the repository. Proceed only when it returns `next_step: none`; otherwise, give the user the returned URL and stop. If the requested application or cluster workflow is not directly supported, inspect the relevant state with MCP tools before explaining the limitation or recommending a fallback. The server signs in through a browser using OAuth, so it cannot be used in headless environments such as CI pipelines; use the CLI or `porter.yaml` there.

# AWS permissions required for Porter

> Review the IAM roles, policies, and CloudFormation stack permissions that Porter creates and requires to manage your AWS cloud infrastructure

export const LastUpdated = ({lastUpdated}) => {
  return <div>
      <p>Last Updated: {lastUpdated}</p>
    </div>;
};

export const ShowPermissions = ({policyToShow, allPolicies}) => {
  let policy = allPolicies[policyToShow];
  if (!policy) {
    return <div>
        <pre>
        A policy was supposed to appear here, but something had happened.
        <br />
        Please reach out via the support widget on the dashboard for assistance.
        </pre>
      </div>;
  }
  return <div>
        <pre>{JSON.stringify(policy, null, 2)}</pre>
    </div>;
};

export const awsPermissions = {
  "azure_oidc_admin_boundary_json": {
    "Statement": [{
      "Action": ["iam:CreateRole", "iam:PutRolePermissionsBoundary"],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}",
      "Sid": "AllowFederationRoleCreation"
    }, {
      "Action": ["iam:GetRole", "iam:TagRole", "iam:UpdateAssumeRolePolicy"],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}",
      "Sid": "AllowFederationRoleManagement"
    }, {
      "Action": "iam:AttachRolePolicy",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyARN": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:policy/azure-oidc-federation"
        }
      },
      "Effect": "Allow",
      "Resource": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}",
      "Sid": "AllowAttachFederationPolicy"
    }, {
      "Action": ["iam:CreateRole", "iam:PutRolePermissionsBoundary"],
      "Condition": {
        "ArnNotEquals": {
          "iam:PermissionsBoundary": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:policy/azure-oidc-boundary"
        }
      },
      "Effect": "Deny",
      "Resource": "*",
      "Sid": "RequireBoundaryOnRoleCreation"
    }, {
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Resource": ["arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}", "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-capz-controller"],
      "Sid": "AllowFederationRoleAssume"
    }, {
      "Effect": "Deny",
      "NotAction": ["iam:CreateRole", "iam:GetRole", "iam:PutRolePermissionsBoundary", "iam:TagRole", "iam:UpdateAssumeRolePolicy", "iam:AttachRolePolicy", "sts:AssumeRole", "sts:TagSession"],
      "Resource": "*",
      "Sid": "DenyEverythingElse"
    }],
    "Version": "2012-10-17"
  },
  "azure_oidc_boundary_json": {
    "Statement": [{
      "Action": "sts:GetWebIdentityToken",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:IdentityTokenAudience": "api://AzureADTokenExchange"
        },
        "NumericLessThanEquals": {
          "sts:DurationSeconds": 3600
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "AllowGetWebIdentityToken"
    }, {
      "Effect": "Deny",
      "NotAction": "sts:GetWebIdentityToken",
      "Resource": "*",
      "Sid": "DenyEverythingElse"
    }],
    "Version": "2012-10-17"
  },
  "azure_oidc_capz_role_trust_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/project_id": "capz-shared"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      }
    }],
    "Version": "2012-10-17"
  },
  "azure_oidc_federation_role_trust_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/project_id": "PORTER_PROJECT_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      }
    }],
    "Version": "2012-10-17"
  },
  "azure_oidc_manager_role_trust_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "sts:TransitiveTagKeys": ["project_id"]
        },
        "Null": {
          "aws:RequestTag/project_id": "false",
          "sts:TransitiveTagKeys": "false"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      }
    }],
    "Version": "2012-10-17"
  },
  "policy_azure_oidc_admin_json": {
    "Statement": [{
      "Action": ["iam:CreateRole", "iam:PutRolePermissionsBoundary"],
      "Effect": "Allow",
      "Resource": ["arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}"],
      "Sid": "PorterAzureFederationRoleCreation"
    }, {
      "Action": ["iam:GetRole", "iam:TagRole", "iam:UpdateAssumeRolePolicy"],
      "Effect": "Allow",
      "Resource": ["arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}"],
      "Sid": "PorterAzureFederationRoleManagement"
    }, {
      "Action": "iam:AttachRolePolicy",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyARN": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:policy/azure-oidc-federation"
        }
      },
      "Effect": "Allow",
      "Resource": "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}",
      "Sid": "PorterAzureFederationAttachPolicy"
    }, {
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Resource": ["arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-azure-fic-${aws:PrincipalTag/project_id}", "arn:aws:iam::PORTER_FEDERATION_ACCOUNT_ID:role/porter-capz-controller"],
      "Sid": "PorterAzureFederationRoleAssume"
    }],
    "Version": "2012-10-17"
  },
  "policy_azure_oidc_federation_json": {
    "Statement": [{
      "Action": "sts:GetWebIdentityToken",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:IdentityTokenAudience": "api://AzureADTokenExchange"
        },
        "NumericLessThanEquals": {
          "sts:DurationSeconds": 3600
        }
      },
      "Effect": "Allow",
      "Resource": "*"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_access_manager_inline_json": {
    "Statement": [{
      "Action": ["iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAccountAliases", "iam:ListAttachedRolePolicies", "iam:ListEntitiesForPolicy", "iam:ListPolicyTags", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoleTags", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:TagPolicy", "iam:TagRole", "iam:UntagPolicy", "iam:UntagRole", "iam:UpdateAssumeRolePolicy", "iam:UpdateRole"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "IamController"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_agent_compliance_inline_json": {
    "Statement": [{
      "Action": ["cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:ListTagsForResource", "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudWatchAlarms"
    }, {
      "Action": ["sns:Publish"],
      "Effect": "Allow",
      "Resource": "arn:aws:sns:*:*:porter-soc2-notifications-*",
      "Sid": "SnsPublish"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_cluster_autoscaler_json": {
    "Statement": [{
      "Action": ["autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeTags", "autoscaling:SetDesiredCapacity", "autoscaling:TerminateInstanceInAutoScalingGroup", "ec2:DescribeImages", "ec2:DescribeInstanceTypes", "ec2:DescribeLaunchTemplateVersions", "ec2:GetInstanceTypesFromInstanceRequirements", "eks:DescribeNodegroup"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "ClusterAutoscaling"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_data_access_json": {
    "Statement": [{
      "Action": ["ssm:GetParameter"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "SsmGetParameter"
    }, {
      "Action": ["s3:GetObject"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "S3Storage"
    }, {
      "Action": ["ssm:GetParameter"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SsmParameterStore"
    }, {
      "Action": ["secretsmanager:GetSecretValue"],
      "Effect": "Allow",
      "Resource": ["arn:*:secretsmanager:*:*:secret:/porter/env-groups/*"],
      "Sid": "EnvGroupSecrets"
    }, {
      "Action": ["ecr:BatchGetImage", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EcrPullImages"
    }, {
      "Action": ["kms:Decrypt"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KmsClusterEncryption"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_ec2_and_networking_json": {
    "Statement": [{
      "Action": ["ec2:AllocateAddress", "ec2:AssociateRouteTable", "ec2:AttachInternetGateway", "ec2:CreateInternetGateway", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateNatGateway", "ec2:CreateNetworkInterface", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:DeleteInternetGateway", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteNatGateway", "ec2:DeleteRouteTable", "ec2:DeleteSecurityGroup", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DetachInternetGateway", "ec2:DisassociateRouteTable", "ec2:ModifyLaunchTemplate", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ReleaseAddress", "ec2:ReplaceRoute", "ec2:RevokeSecurityGroupIngress", "ec2:RunInstances"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Ec2NetworkingCore"
    }, {
      "Action": ["ec2:AcceptVpcPeeringConnection", "ec2:CreateVpcPeeringConnection", "ec2:DeleteVpcPeeringConnection", "ec2:ModifyVpcPeeringConnectionOptions"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcPeering"
    }, {
      "Action": ["ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:ModifyVpcEndpoint"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcEndpoints"
    }, {
      "Action": ["ec2:CreateFlowLogs"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcFlowLogs"
    }, {
      "Action": ["ec2:DeleteFlowLogs"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/porter.run/managed": "true"
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcFlowLogsDelete"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_eks_manager_json": {
    "Statement": [{
      "Action": ["ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:TagResource", "ecr:UploadLayerPart", "eks:AssociateEncryptionConfig", "eks:CreateAddon", "eks:CreateCluster", "eks:CreateNodegroup", "eks:DeleteAddon", "eks:DeleteCluster", "eks:DeleteNodegroup", "eks:TagResource", "eks:UntagResource", "eks:UpdateAddon", "eks:UpdateClusterConfig", "eks:UpdateClusterVersion", "eks:UpdateNodegroupConfig", "eks:UpdateNodegroupVersion", "iam:AddClientIDToOpenIDConnectProvider", "iam:CreateOpenIDConnectProvider", "iam:CreateServiceLinkedRole", "iam:DeleteOpenIDConnectProvider", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:PassRole", "iam:TagOpenIDConnectProvider", "iam:UpdateOpenIDConnectProviderThumbprint", "secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:TagResource", "servicequotas:RequestServiceQuotaIncrease"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EksClusterManagement"
    }, {
      "Action": ["cloudformation:CreateStack", "cloudformation:UpdateStack"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudFormation"
    }, {
      "Action": ["iam:UpdateAssumeRolePolicy"],
      "Effect": "Allow",
      "Resource": ["arn:aws:iam::*:role/porter*"],
      "Sid": "IamPorterAssumeRolePolicy"
    }, {
      "Action": ["kms:CreateAlias", "kms:CreateGrant", "kms:EnableKeyRotation", "kms:PutKeyPolicy", "kms:TagResource"],
      "Effect": "Allow",
      "Resource": ["arn:aws:kms:*:*:alias/*", "arn:aws:kms:*:*:key/*"],
      "Sid": "KmsAliasAndKey"
    }, {
      "Action": ["kms:CreateKey"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "KmsCreateKey"
    }, {
      "Action": ["elasticfilesystem:CreateAccessPoint", "elasticfilesystem:CreateFileSystem", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DeleteFileSystem", "elasticfilesystem:DeleteMountTarget", "elasticfilesystem:TagResource", "elasticfilesystem:UntagResource"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Efs"
    }, {
      "Action": ["ecr:PutRegistryScanningConfiguration", "inspector2:Disable", "inspector2:Enable"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Soc2Requirements"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_flow_log_delivery_inline_tmpl_json": {
    "Statement": [{
      "Action": ["logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams"],
      "Effect": "Allow",
      "Resource": "arn:aws:logs:*:ACCOUNT_ID:log-group:*",
      "Sid": "FlowLogDelivery"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_infra_manager_inline_json": {
    "Statement": [{
      "Action": ["kms:CreateAlias", "kms:CreateKey", "kms:DeleteAlias", "kms:Describe*", "kms:EnableKeyRotation", "kms:GenerateRandom", "kms:Get*", "kms:List*", "kms:ScheduleKeyDeletion", "kms:TagResource", "kms:UntagResource", "kms:UpdateAlias"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KmsManagement"
    }, {
      "Action": ["iam:GetRolePolicy", "iam:GetUser", "iam:ListGroups", "iam:ListRoles", "iam:ListUsers"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "IamReadOnly"
    }, {
      "Action": ["s3:*"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::aws-cloudtrail-logs*", "arn:aws:s3:::porter-*", "arn:aws:s3:::porter-*/*"],
      "Sid": "CloudTrailS3Buckets"
    }, {
      "Action": ["s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListAllMyBuckets"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "S3BucketsRead"
    }, {
      "Action": ["ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeManagedPrefixLists", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SecurityGroups"
    }, {
      "Action": ["ec2:AcceptVpcPeeringConnection", "ec2:AssociateRouteTable", "ec2:CreateFlowLogs", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSubnet", "ec2:CreateTags", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:CreateVpcEndpointServiceConfiguration", "ec2:CreateVpcPeeringConnection", "ec2:DeleteFlowLogs", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DeleteSubnet", "ec2:DeleteVpc", "ec2:DeleteVpcEndpoint", "ec2:DeleteVpcEndpointServiceConfigurations", "ec2:DeleteVpcPeeringConnection", "ec2:DescribeFlowLogs", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpointServicePermissions", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DisassociateRouteTable", "ec2:ModifySubnetAttribute", "ec2:ModifyVpcAttribute", "ec2:ModifyVpcEndpoint", "ec2:ModifyVpcEndpointServiceConfiguration", "ec2:ModifyVpcEndpointServicePermissions"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcManagement"
    }, {
      "Action": ["cloudtrail:*"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudTrail"
    }, {
      "Action": ["logs:CreateLogGroup"],
      "Effect": "Allow",
      "Resource": ["arn:aws:logs:*:*:log-group:aws-cloudtrail-logs*"],
      "Sid": "CloudTrailLogGroup"
    }, {
      "Action": ["iam:PassRole"],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "cloudtrail.amazonaws.com"
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudTrailPassRole"
    }, {
      "Action": ["iam:PassRole"],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "s3.amazonaws.com"
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "S3ReplicationPassRole"
    }, {
      "Action": ["iam:PassRole"],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "vpc-flow-logs.amazonaws.com"
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "FlowLogDeliveryPassRole"
    }, {
      "Action": ["iam:PassRole"],
      "Effect": "Allow",
      "Resource": "PORTER_INFRA_MANAGER_ARN",
      "Sid": "PorterInfraManagerPassRole"
    }, {
      "Action": ["cloudwatch:DeleteAlarms", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "ec2:CreateTags", "ec2:CreateVpcEndpoint", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeCoipPools", "ec2:DescribeInternetGateways", "ec2:DescribeLocalGatewayRouteTablePermissions", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGateways", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", "elasticache:*", "kms:DescribeKey", "kms:ListAliases", "kms:ListKeys", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "rds:*", "sns:ListSubscriptions", "sns:ListTopics", "sns:Publish"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Datastores"
    }, {
      "Action": ["ec2:DescribeLaunchTemplates"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/porter.run/managed": "true"
        }
      },
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "NodeGroupManagement"
    }, {
      "Action": ["aps:*"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/porter.run/managed": "true"
        }
      },
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Telemetry"
    }, {
      "Action": ["iam:CreateServiceLinkedRole"],
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": ["elasticache.amazonaws.com", "rds.amazonaws.com", "rds.application-autoscaling.amazonaws.com"]
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "DatastoreServiceLinkedRoles"
    }, {
      "Action": ["ce:GetCostAndUsage"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CostExplorer"
    }, {
      "Action": ["ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AttachInternetGateway", "ec2:CreateInternetGateway", "ec2:DescribeAddresses", "ec2:DescribeInstances", "ec2:DetachInternetGateway", "ec2:ImportKeyPair", "ec2:RunInstances", "ec2:TerminateInstances"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "PorterInstanceProxy"
    }, {
      "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeSubscriptionFilters", "logs:ListTagsForResource", "logs:PutLogEvents", "logs:PutRetentionPolicy", "logs:TagResource", "logs:UntagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudWatchLogs"
    }, {
      "Action": ["sns:CreateTopic", "sns:DeleteTopic", "sns:GetTopicAttributes", "sns:ListTagsForResource", "sns:SetTopicAttributes", "sns:Subscribe", "sns:TagResource", "sns:Unsubscribe"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Sns"
    }, {
      "Action": ["events:DeleteRule", "events:DescribeEventBus", "events:DescribeRule", "events:ListTagsForResource", "events:ListTargetsByRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:TagResource", "events:UntagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EventBridgeRules"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_karpenter_json": {
    "Statement": [{
      "Action": ["ec2:CreateFleet", "ec2:RunInstances"],
      "Effect": "Allow",
      "Resource": ["arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:subnet/*"],
      "Sid": "ScopedEc2InstanceAccess"
    }, {
      "Action": ["ec2:CreateFleet", "ec2:RunInstances"],
      "Effect": "Allow",
      "Resource": "arn:aws:ec2:*:*:launch-template/*",
      "Sid": "ScopedEc2LaunchTemplateAccess"
    }, {
      "Action": ["ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:RunInstances"],
      "Effect": "Allow",
      "Resource": ["arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:spot-instances-request/*", "arn:aws:ec2:*:*:volume/*"],
      "Sid": "ScopedEc2InstanceCreate"
    }, {
      "Action": ["ec2:CreateTags"],
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": ["CreateFleet", "CreateLaunchTemplate", "RunInstances"]
        },
        "StringLike": {
          "aws:RequestTag/karpenter.sh/nodepool": "*"
        }
      },
      "Effect": "Allow",
      "Resource": ["arn:aws:ec2:*:*:fleet/*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:spot-instances-request/*", "arn:aws:ec2:*:*:volume/*"],
      "Sid": "ScopedResourceCreationTagging"
    }, {
      "Action": ["ec2:CreateTags"],
      "Effect": "Allow",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Sid": "ScopedResourceTagging"
    }, {
      "Action": ["ec2:DeleteLaunchTemplate", "ec2:TerminateInstances"],
      "Effect": "Allow",
      "Resource": ["arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:launch-template/*"],
      "Sid": "ScopedEc2Deletion"
    }, {
      "Action": ["ec2:DescribeImages", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeInstances", "ec2:DescribeLaunchTemplates", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "RegionalEc2Read"
    }, {
      "Action": ["pricing:GetProducts"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "PricingRead"
    }, {
      "Action": ["ssm:GetParameter"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SsmParameterRead"
    }, {
      "Action": ["sqs:CreateQueue", "sqs:DeleteMessage", "sqs:DeleteQueue", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:SetQueueAttributes", "sqs:TagQueue"],
      "Effect": "Allow",
      "Resource": "arn:aws:sqs:*:*:*",
      "Sid": "SqsInterruptionQueue"
    }, {
      "Action": ["events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets"],
      "Effect": "Allow",
      "Resource": ["arn:aws:events:*:*:rule/*"],
      "Sid": "EventBridgeRules"
    }, {
      "Action": ["iam:PassRole"],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": ["ec2.amazonaws.com", "ec2.amazonaws.com.cn"]
        }
      },
      "Effect": "Allow",
      "Resource": "NODE_ROLE_ARN",
      "Sid": "PassNodeInstanceRole"
    }, {
      "Action": ["iam:AddRoleToInstanceProfile", "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:TagInstanceProfile"],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::*:instance-profile/*",
      "Sid": "InstanceProfileScoped"
    }, {
      "Action": ["iam:ListInstanceProfiles"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "InstanceProfileList"
    }, {
      "Action": ["eks:DescribeCluster"],
      "Effect": "Allow",
      "Resource": "arn:aws:eks:*:*:cluster/*",
      "Sid": "EksClusterDescribe"
    }, {
      "Action": ["iam:CreateServiceLinkedRole"],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::*:role/aws-service-role/*",
      "Sid": "ServiceLinkedRoleCreate"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_load_balancer_controller_json": {
    "Statement": [{
      "Action": ["acm:DescribeCertificate", "acm:ListCertificates", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVpcs", "ec2:GetSecurityGroupsForVpc", "ec2:RevokeSecurityGroupIngress", "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:AddTags", "elasticloadbalancing:CreateListener", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:CreateRule", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:DescribeListenerAttributes", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:ModifyListener", "elasticloadbalancing:ModifyListenerAttributes", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ModifyRule", "elasticloadbalancing:ModifyTargetGroup", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:RemoveTags", "elasticloadbalancing:SetIpAddressType", "elasticloadbalancing:SetRulePriorities", "elasticloadbalancing:SetSecurityGroups", "elasticloadbalancing:SetSubnets", "elasticloadbalancing:SetWebACL", "wafv2:AssociateWebACL", "wafv2:DisassociateWebACL", "wafv2:GetWebACL", "wafv2:GetWebACLForResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "LoadBalancerController"
    }, {
      "Action": "iam:CreateServiceLinkedRole",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
        }
      },
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CreateELBServiceLinkedRole"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_manager_write_json": {
    "Statement": [{
      "Action": ["eks:CreatePodIdentityAssociation", "eks:DeletePodIdentityAssociation", "eks:UpdatePodIdentityAssociation"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EksClusterOperations"
    }, {
      "Action": ["acm:AddTagsToCertificate", "acm:RequestCertificate"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "LoadBalancersRead"
    }, {
      "Action": ["wafv2:CreateWebACL", "wafv2:TagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "WAFv2WebACLManagement"
    }, {
      "Action": ["route53:ChangeResourceRecordSets"],
      "Condition": {
        "ForAllValues:StringEquals": {
          "route53:ChangeResourceRecordSetsActions": ["CREATE", "UPSERT"],
          "route53:ChangeResourceRecordSetsRecordTypes": ["CNAME"]
        },
        "ForAllValues:StringLike": {
          "route53:ChangeResourceRecordSetsNormalizedRecordNames": ["_????????????????????????????????.*"]
        },
        "Null": {
          "route53:ChangeResourceRecordSetsActions": "false",
          "route53:ChangeResourceRecordSetsNormalizedRecordNames": "false",
          "route53:ChangeResourceRecordSetsRecordTypes": "false"
        }
      },
      "Effect": "Allow",
      "Resource": "arn:aws:route53:::hostedzone/*",
      "Sid": "Route53ACMValidationRecordWrite"
    }, {
      "Action": ["iam:AttachRolePolicy", "iam:CreateRole", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", "iam:PutRolePermissionsBoundary", "iam:PutRolePolicy", "iam:TagRole"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "IamRoles"
    }, {
      "Action": ["s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:PutBucketObjectLockConfiguration", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketTagging", "s3:PutBucketVersioning", "s3:PutObject"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "S3Storage"
    }, {
      "Action": ["ssm:AddTagsToResource", "ssm:DeleteParameter", "ssm:PutParameter"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SsmParameterStore"
    }, {
      "Action": ["secretsmanager:CreateSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:TagResource"],
      "Effect": "Allow",
      "Resource": ["arn:*:secretsmanager:*:*:secret:/porter/env-groups/*"],
      "Sid": "EnvGroupSecrets"
    }, {
      "Action": ["elasticache:AddTagsToResource", "elasticache:CreateCacheSubnetGroup", "elasticache:CreateReplicationGroup", "elasticache:CreateSnapshot", "elasticache:DeleteCacheSubnetGroup", "elasticache:DeleteReplicationGroup", "elasticache:ModifyCacheSubnetGroup", "elasticache:ModifyReplicationGroup", "rds:AddTagsToResource", "rds:CreateDBCluster", "rds:CreateDBClusterSnapshot", "rds:CreateDBInstance", "rds:CreateDBSnapshot", "rds:CreateDBSubnetGroup", "rds:DeleteDBCluster", "rds:DeleteDBInstance", "rds:DeleteDBSubnetGroup", "rds:FailoverDBCluster", "rds:ModifyDBCluster", "rds:ModifyDBInstance", "rds:ModifyDBSubnetGroup", "rds:RestoreDBClusterToPointInTime", "rds:RestoreDBInstanceFromDBSnapshot"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Datastores"
    }, {
      "Action": ["aps:*"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/porter.run/managed": "true"
        }
      },
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Telemetry"
    }, {
      "Action": ["ec2:AssociateAddress", "ec2:ImportKeyPair"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "PorterInstanceProxy"
    }, {
      "Action": ["sqs:CreateQueue", "sqs:DeleteQueue", "sqs:SetQueueAttributes", "sqs:TagQueue"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Sqs"
    }, {
      "Action": ["events:DeleteRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:TagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KarpenterInterruptionEventBridge"
    }, {
      "Action": ["cloudwatch:DeleteAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:TagResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudWatchObservability"
    }, {
      "Action": ["guardduty:CreateDetector", "guardduty:DeleteDetector", "guardduty:TagResource", "guardduty:UpdateDetector"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "GuardDuty"
    }, {
      "Action": ["ecr:BatchCheckLayerAvailability"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EcrPullImages"
    }, {
      "Action": ["kms:CreateGrant", "kms:Encrypt"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KmsClusterEncryption"
    }, {
      "Action": ["cloudtrail:StartLogging"],
      "Effect": "Allow",
      "Resource": "arn:aws:cloudtrail:*:*:trail/porter-trail-*",
      "Sid": "CloudTrailLogging"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_node_manager_inline_json": {
    "Statement": [{
      "Action": ["ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:ListImages", "ecr:ListTagsForResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CustomerEcrAccess"
    }, {
      "Action": ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CustomerEcrPublicAccess"
    }, {
      "Action": ["ssm:GetParameter"],
      "Effect": "Allow",
      "Resource": "arn:aws:ssm:*::parameter/aws/service/eks/optimized-ami/*",
      "Sid": "ParameterStoreAccess"
    }, {
      "Action": ["sts:AssumeRole"],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      },
      "Effect": "Allow",
      "Resource": "arn:aws:iam::*:role/porter-sandbox-bucket-access-*",
      "Sid": "SandboxBucketAccessRoleAssume"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_read_json": {
    "Statement": [{
      "Action": ["eks:DescribeAddon", "eks:DescribeUpdate", "eks:ListAddons", "eks:ListFargateProfiles", "eks:ListNodegroups", "eks:ListUpdates", "iam:GetOpenIDConnectProvider", "iam:ListOpenIDConnectProviders", "servicequotas:GetServiceQuota", "servicequotas:ListRequestedServiceQuotaChangeHistory", "servicequotas:ListRequestedServiceQuotaChangeHistoryByQuota", "servicequotas:ListServiceQuotas"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EksClusterManagement"
    }, {
      "Action": ["cloudformation:DescribeStacks"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudFormation"
    }, {
      "Action": ["elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Efs"
    }, {
      "Action": ["ecr:GetRegistryScanningConfiguration", "inspector2:ListAccountPermissions"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Soc2Requirements"
    }, {
      "Action": ["autoscaling:DescribeAutoScalingGroups", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeImages", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInstanceTypes", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeLaunchTemplates", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcs", "tag:GetResources"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "Ec2NetworkingCore"
    }, {
      "Action": ["ec2:DescribeVpcPeeringConnections"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcPeering"
    }, {
      "Action": ["ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcEndpoints"
    }, {
      "Action": ["ec2:DescribeFlowLogs"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcFlowLogs"
    }, {
      "Action": ["account:ListRegions", "autoscaling:DescribeScalingActivities", "eks:DescribeCluster", "eks:DescribeNodegroup", "eks:DescribePodIdentityAssociation", "eks:ListClusters", "eks:ListPodIdentityAssociations"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EksClusterOperations"
    }, {
      "Action": ["acm:DescribeCertificate", "acm:ListCertificates", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "LoadBalancersRead"
    }, {
      "Action": ["wafv2:GetWebACL", "wafv2:ListTagsForResource", "wafv2:ListWebACLs"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "WAFv2WebACLManagement"
    }, {
      "Action": ["route53:ListHostedZonesByName", "route53:ListResourceRecordSets"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Route53HostedZoneLookup"
    }, {
      "Action": ["iam:GetPolicy", "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "IamRoles"
    }, {
      "Action": ["s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetBucketTagging", "s3:ListBucket", "s3:ListBucketVersions"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "S3Storage"
    }, {
      "Action": ["elasticache:DescribeCacheClusters", "elasticache:DescribeCacheSubnetGroups", "elasticache:DescribeReplicationGroups", "elasticache:ListTagsForResource", "rds:DescribeDBClusterSnapshots", "rds:DescribeDBClusters", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeDBSnapshots", "rds:DescribeDBSubnetGroups", "rds:ListTagsForResource"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Datastores"
    }, {
      "Action": ["aps:ListWorkspaces"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Sid": "TelemetryAdmin"
    }, {
      "Action": ["ce:Get*", "ce:List*", "freetier:GetAccountPlanState", "pricing:*"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "ReadOnlyBilling"
    }, {
      "Action": ["sqs:GetQueueAttributes", "sqs:GetQueueUrl"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "Sqs"
    }, {
      "Action": ["events:DescribeRule", "events:ListTargetsByRule"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KarpenterInterruptionEventBridge"
    }, {
      "Action": ["cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "logs:DescribeLogGroups"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudWatchObservability"
    }, {
      "Action": ["guardduty:GetAdministratorAccount", "guardduty:GetDetector", "guardduty:ListDetectors"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "GuardDuty"
    }, {
      "Action": ["ecr:DescribeRepositories", "ecr:DescribeImages", "ecr:ListImages"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EcrPullImages"
    }, {
      "Action": ["kms:DescribeKey"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "KmsClusterEncryption"
    }, {
      "Action": ["cloudtrail:DescribeTrails", "cloudtrail:GetEventSelectors", "cloudtrail:GetTrailStatus", "cloudtrail:LookupEvents"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "CloudTrailRead"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_sandbox_control_plane_inline_tmpl_json": {
    "Statement": [{
      "Action": ["ecr:CreateRepository", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchDeleteImage", "ecr:PutLifecyclePolicy", "ecr:GetLifecyclePolicy"],
      "Effect": "Allow",
      "Resource": "arn:aws:ecr:*:ACCOUNT_ID:repository/SNAPSHOT_REPOSITORY_PREFIX/*",
      "Sid": "SandboxSnapshotRepositoryLifecycle"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_sandbox_daemon_inline_tmpl_json": {
    "Statement": [{
      "Action": "ecr:GetAuthorizationToken",
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SandboxSnapshotRegistryAuth"
    }, {
      "Action": ["ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer"],
      "Effect": "Allow",
      "Resource": "arn:aws:ecr:*:ACCOUNT_ID:repository/SNAPSHOT_REPOSITORY_PREFIX/*",
      "Sid": "SandboxSnapshotImageTransfer"
    }],
    "Version": "2012-10-17"
  },
  "policy_porter_vpc_manager_json": {
    "Statement": [{
      "Action": ["ec2:AcceptVpcPeeringConnection", "ec2:CreateVpcPeeringConnection", "ec2:DeleteVpcPeeringConnection", "ec2:ModifyVpcPeeringConnectionOptions"],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "VpcPeering"
    }],
    "Version": "2012-10-17"
  },
  "role_pod_identity_trust_with_account_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": ["pods.eks.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_porter_controlplane_manager_trust_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": ["eks.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_porter_flow_log_delivery_trust_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole"],
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": ["vpc-flow-logs.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_porter_infra_manager_trust_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      }
    }, {
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com", "eks.amazonaws.com", "pods.eks.amazonaws.com", "vpc-flow-logs.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_porter_node_manager_trust_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "ACCOUNT_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_porter_operator_reader_trust_tmpl_json": {
    "Statement": [{
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PORTER_EXTERNAL_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterOperatorAccessAssumeRole"
    }, {
      "Action": "sts:SetSourceIdentity",
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterOperatorAccessSetSourceIdentity"
    }],
    "Version": "2012-10-17"
  },
  "role_porter_operator_writer_trust_tmpl_json": {
    "Statement": [{
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PORTER_EXTERNAL_ID"
        },
        "StringLike": {
          "sts:SourceIdentity": "*@porter.run"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterOperatorAccessAssumeRole"
    }, {
      "Action": "sts:SetSourceIdentity",
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterOperatorAccessSetSourceIdentity"
    }],
    "Version": "2012-10-17"
  },
  "role_trust_with_external_id_tmpl_json": {
    "Statement": [{
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "PORTER_EXTERNAL_ID"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterAssumeRoleWithExternalId"
    }, {
      "Action": "sts:TagSession",
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      },
      "Sid": "PorterTagSession"
    }, {
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com", "eks.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "role_trust_without_external_id_tmpl_json": {
    "Statement": [{
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Principal": {
        "AWS": "PORTER_ROLE_ARN"
      }
    }, {
      "Action": ["sts:AssumeRole", "sts:TagSession"],
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com", "eks.amazonaws.com"]
      }
    }],
    "Version": "2012-10-17"
  },
  "updated-at": "2026-10-15T22:17:09Z"
};

# Overview

Porter creates several roles and policies for use in the management of your AWS account. These may change over time, and will be automatically updated both here, and on your AWS account.
Make sure to check back here for updates, and if you have any questions, please reach out via the support widget on the dashboard.

## Initial Permissions

When signing up for Porter on AWS, you will be asked to create a cloudformation stack. This is only used for setting up the initial permissions required for Porter to manage your account.
If you are operating in a regulated environment, these are the minimum permissions required to execute the initial cloudformation stack:

```json theme={null}
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ManagePorterCloudFormation",
			"Effect": "Allow",
			"Action": [
				"cloudformation:GetTemplateSummary",
				"cloudformation:DescribeStackEvents",
				"cloudformation:CreateStack",
				"cloudformation:DeleteStack",
				"cloudformation:DescribeStacks",
				"cloudformation:ListStacks",
				"cloudformation:ListStackResources",
				"iam:DeleteRolePolicy",
				"iam:DeleteRole",
				"iam:PutRolePolicy",
				"iam:GetRole",
				"iam:CreateRole"
			],
			"Resource": "*"
		}
	]
}
```

## Roles

### Porter Access Manager

Porter Access Manager is a role that Porter creates to manage the access given to the other roles in this document.
If permissions are removed from this role, you will be **unable to access new features of Porter**.

<ShowPermissions policyToShow={"policy_porter_access_manager_inline_json"} allPolicies={awsPermissions} />

### Porter Manager

Porter Manager is used for all API operations from Porter, to your AWS account. This role is primarily used to read resources in your account to ensure that Porter is not creating duplicate resources, or using resources managed by a non-Porter process.
This role may adopt policies from the other roles mentioned here, when managing their specific domains.

Porter Manager attaches the three policies below.

#### Read

Describe, List and Get calls across the resources Porter manages. Nothing here changes state.

<ShowPermissions policyToShow={"policy_porter_read_json"} allPolicies={awsPermissions} />

#### Write

The calls that change state in your account.

<ShowPermissions policyToShow={"policy_porter_manager_write_json"} allPolicies={awsPermissions} />

#### Data Access

The reads that return the contents of your secrets and stored objects. Porter needs these to sync environment groups and to pull images.

<ShowPermissions policyToShow={"policy_porter_data_access_json"} allPolicies={awsPermissions} />

### Porter EKS Manager

Porter EKS Manager is the role used by EKS to perform actions on your AWS account, for ongoing maintenance of your EKS cluster.

<ShowPermissions policyToShow={"role_porter_controlplane_manager_trust_json"} allPolicies={awsPermissions} />

<ShowPermissions policyToShow={"policy_porter_eks_manager_json"} allPolicies={awsPermissions} />

### Porter Node Manager

Porter Node Manager is the role used by EKS worker nodes. This role also includes access to some AWS-provided roles such as:

* `AmazonEKS_CNI_Policy`
* `AmazonEKSClusterPolicy`
* `AmazonEKSWorkerNodePolicy`
* `AmazonEC2ContainerRegistryReadOnly`
* `service-role/AmazonEBSCSIDriverPolicy`
* `service-role/AmazonEFSCSIDriverPolicy`

<ShowPermissions policyToShow={"policy_porter_node_manager_inline_json"} allPolicies={awsPermissions} />

### Porter Infra Manager

This is the role used to manage non-EKS resources such as RDS, Elasticache, S3, etc.

<ShowPermissions policyToShow={"policy_porter_infra_manager_inline_json"} allPolicies={awsPermissions} />

## Policies

On top of the roles above, the following policies are created which may be attached to one, or many of the roles above.

### Cluster Autoscaler

Porter Cluster Autoscaler is used to allow Porter to scale your cluster up and down based on the load of your cluster.

<ShowPermissions policyToShow={"policy_porter_cluster_autoscaler_json"} allPolicies={awsPermissions} />

### Loadbalancer

Porter Loadbalancer is used to allow Porter to manage loadbalancers in your account.

<ShowPermissions policyToShow={"policy_porter_loadbalancer_json"} allPolicies={awsPermissions} />

<LastUpdated lastUpdated={awsPermissions["updated-at"]} />


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.