AWS IAM Permissions for Enrichment

Table of Contents

Overview
All Namespaces
Core Services
Direct CloudWatch Metric Polling (Conditional)
Per-Namespace Permissions

The enrichment scraper calls AWS APIs to fetch resource metadata and attach it as labels to CloudWatch metrics. The policies on this page grant the scraper the read-only permissions it needs.

See Configure IAM for Enrichment for the steps to create and attach the policy. For the complete list of metadata fields the scraper attaches per namespace, see AWS Supported Services.

Overview

Choose the policy that matches the namespaces you are collecting:

All namespaces — grants permissions for every supported AWS service. Use this when forwarding all namespaces from CloudWatch Metrics Streams.
Core services — a minimal policy covering EC2, RDS, Lambda, DynamoDB, ECS, ElastiCache, and CloudWatch Logs. Use this when collecting only those namespaces.
Direct CloudWatch metric polling — an additive policy required only when the scrapeMetricsFromCloudWatch mode is enabled. Attach alongside one of the above policies.

Both policies are read-only (Describe*, List*, Get*) and use "Resource": "*" because CloudWatch enrichment APIs do not support resource-level restrictions.

All Namespaces

This policy covers every namespace in AWS Supported Services.

cat > kloudfuse-enrichment-policy-all.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KloudfuseEnrichmentAllNamespaces",
      "Effect": "Allow",
      "Action": [
        "acm:ListCertificates",
        "acm:ListTagsForCertificate",
        "apigateway:GET",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "autoscaling:DescribeAutoScalingGroups",
        "bedrock:ListFoundationModels",
        "cloudfront:ListDistributions",
        "cloudfront:ListTagsForResource",
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "ec2:DescribeInstances",
        "ec2:DescribeNatGateways",
        "ec2:DescribeVolumes",
        "ecs:DescribeContainerInstances",
        "ecs:DescribeServices",
        "ecs:ListClusters",
        "ecs:ListContainerInstances",
        "ecs:ListServices",
        "ecs:ListTagsForResource",
        "eks:DescribeCluster",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeServerlessCaches",
        "elasticache:ListTagsForResource",
        "elasticfilesystem:DescribeBackupPolicy",
        "elasticfilesystem:DescribeFileSystems",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "es:DescribeDomains",
        "es:ListDomainNames",
        "es:ListTags",
        "events:ListEventBuses",
        "events:ListRules",
        "events:ListTagsForResource",
        "firehose:DescribeDeliveryStream",
        "firehose:ListDeliveryStreams",
        "firehose:ListTagsForDeliveryStream",
        "fsx:DescribeFileSystems",
        "fsx:ListTagsForResource",
        "glue:GetTags",
        "glue:ListJobs",
        "kafka:ListClustersV2",
        "kafka:ListTagsForResource",
        "kinesis:ListStreams",
        "kinesis:ListTagsForStream",
        "lambda:ListFunctions",
        "lambda:ListTags",
        "logs:DescribeLogGroups",
        "logs:ListTagsForResource",
        "mediaconvert:ListQueues",
        "mediaconvert:ListTagsForResource",
        "mq:DescribeBroker",
        "mq:ListBrokers",
        "qbusiness:GetApplication",
        "qbusiness:ListApplications",
        "qbusiness:ListTagsForResource",
        "rds:DescribeDBClusters",
        "rds:DescribeDBInstances",
        "rds:ListTagsForResource",
        "redshift:DescribeClusters",
        "redshift:DescribeTags",
        "route53:ListHealthChecks",
        "route53:ListTagsForResource",
        "s3:GetBucketTagging",
        "s3:ListAllMyBuckets",
        "ses:GetConfigurationSet",
        "ses:ListConfigurationSets",
        "ses:ListTagsForResource",
        "sns:ListTagsForResource",
        "sns:ListTopics",
        "sqs:ListQueueTags",
        "sqs:ListQueues",
        "states:ListActivities",
        "states:ListStateMachines",
        "states:ListTagsForResource",
        "tag:GetResources",
        "tag:GetTagKeys",
        "tag:GetTagValues",
        "timestream:DescribeEndpoints",
        "timestream:ListDatabases",
        "timestream:ListTables",
        "timestream:ListTagsForResource",
        "wafv2:ListRuleGroups",
        "wafv2:ListTagsForResource",
        "wafv2:ListWebACLs"
      ],
      "Resource": "*"
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name KloudfuseEnrichmentPolicyAll \
  --policy-document file://kloudfuse-enrichment-policy-all.json

bash

Core Services

This policy covers the most commonly monitored namespaces: EC2, ECS, ElastiCache, RDS, Lambda, DynamoDB, and CloudWatch Logs. Use it when you are filtering the CloudWatch Metrics Stream to only these namespaces.

cat > kloudfuse-enrichment-policy-core.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KloudfuseEnrichmentCoreServices",
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ecs:DescribeContainerInstances",
        "ecs:DescribeServices",
        "ecs:ListClusters",
        "ecs:ListContainerInstances",
        "ecs:ListServices",
        "ecs:ListTagsForResource",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeServerlessCaches",
        "elasticache:ListTagsForResource",
        "lambda:ListFunctions",
        "lambda:ListTags",
        "logs:DescribeLogGroups",
        "logs:ListTagsForResource",
        "rds:DescribeDBClusters",
        "rds:DescribeDBInstances",
        "rds:ListTagsForResource",
        "tag:GetResources",
        "tag:GetTagKeys",
        "tag:GetTagValues"
      ],
      "Resource": "*"
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name KloudfuseEnrichmentPolicyCore \
  --policy-document file://kloudfuse-enrichment-policy-core.json

bash

Direct CloudWatch Metric Polling (Conditional)

If you enable direct CloudWatch metric polling — where the scraper calls CloudWatch APIs instead of receiving metrics via a Metrics Stream — add the following inline policy to the IAM role:

cat > kloudfuse-enrichment-policy-cloudwatch-direct.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KloudfuseEnrichmentCloudWatchDirect",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name KloudfuseEnrichmentPolicyCloudWatchDirect \
  --policy-document file://kloudfuse-enrichment-policy-cloudwatch-direct.json

bash

This policy is not required when using CloudWatch Metrics Streams. Attach it only if the scrapeMetricsFromCloudWatch mode is explicitly enabled in your Kloudfuse configuration.

Per-Namespace Permissions

For the IAM actions required by each individual namespace, see the IAM Actions Required column in AWS Supported Services. Use that table to build a custom policy when you are forwarding a specific subset of namespaces.