IAM minimum permissions comparison

Summary

This article displays a table for comparing what IAM permissions have been added in each release since v4.1.1a.

v4.2.1 -> v4.3.0 minimal permissions comparison 

This table shows the new permissions added to the minimal permission JSON files in comparison to 4.2.0

Azure

AWS

"ec2:LockSnapshot", "ec2:UnlockSnapshot", "ec2:DescribeLockedSnapshots" "elasticloadbalancing:DescribeLoadBalancerPolicyTypes", "elasticloadbalancing:CreateLBCookieStickinessPolicy", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeLoadBalancerPolicies", "elasticloadbalancing:CreateRule", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:CreateTargetGroup", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:AddTags", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:ModifyLoadBalancerAttributes", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:CreateListener", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:CreateAppCookieStickinessPolicy", "elasticloadbalancing:DescribeListenerCertificates", "elasticloadbalancing:CreateLoadBalancerPolicy", "elasticloadbalancing:DeleteRule", "elasticloadbalancing:DescribeSSLPolicies", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:CreateLoadBalancerListeners", "elasticloadbalancing:SetLoadBalancerPoliciesOfListener", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:ModifyTargetGroupAttributes", "elasticloadbalancing:RegisterTargets", "cognito-idp:DescribeUserPoolClient" "elasticfilesystem:ListTagsForResource"

v4.2.0 -> v4.2.1 minimal permissions comparison 

This table shows the new permissions added to the minimal permission json files in comparison to 4.2.0

Azure	AWS
"Microsoft.Authorization/locks/write", "Microsoft.Authorization/locks/delete",

v4.1.1a -> v4.2.0 minimal permissions comparison 

This table shows the new permissions added to the minimal permission json files in comparison to 4.1.1a

Azure

AWS

"Microsoft.Compute/disks/delete", "Microsoft.Compute/disks/beginGetAccess/action", "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/sshPublicKeys/read", "Microsoft.CostManagement/query/read", "Microsoft.Network/networkInterfaces/delete", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/publicIPAddresses/delete", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPAddresses/write", "Microsoft.Network/publicIPAddresses/join/action", "Microsoft.Network/privateDNSZones/read", "Microsoft.Network/privateDNSZones/write", "Microsoft.Network/privateDNSZones/delete", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/privateEndpoints/write", "Microsoft.Network/privateEndpoints/delete", "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action", "Microsoft.Network/privateDnsZones/A/write", "Microsoft.Network/privateDnsZones/A/delete", "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action", "Microsoft.Sql/servers/virtualNetworkRules/delete", "Microsoft.Sql/servers/virtualNetworkRules/write", "Microsoft.Sql/servers/virtualNetworkRules/read", "Microsoft.Storage/storageAccounts/listkeys/action", "Microsoft.Storage/storageAccounts/managementPolicies/read", "Microsoft.Storage/storageAccounts/managementPolicies/write" "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action", "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read", "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write"

"iam:ListInstanceProfiles", "ec2:DescribeInstanceTypeOfferings", "redshift:DeleteTags", "redshift:DeleteCluster", "redshift:AuthorizeSnapshotAccess", "redshift:RevokeSnapshotAccess" "elasticfilesystem:TagResource", "elasticfilesystem:DescribeMountTargets", "elasticfilesystem:CreateMountTarget", "elasticfilesystem:DescribeAccessPoints", "elasticfilesystem:CreateAccessPoint", "elasticfilesystem:DescribeMountTargetSecurityGroups", "fsx:CopyBackup", "ssm:ListCommandInvocations" "secretsmanager:GetSecretValue"