IAM roles
An overview of the IAM roles created during AWS account configuration
If you choose to deploy the AWS CloudFormation template to configure AWS accounts for CloudBolt Platform integration, two least-privilege IAM roles are created in your environment:
- CloudBoltFocusCrossAccountRole: A management account role that allows CloudBolt to access your billing data.
- CloudBoltActionsCrossAccountRole: Target account roles used to discover resources.
The Terraform module creates the same two roles, with the same names and permissions, in the management account.
CloudBoltFocusCrossAccountRole
- Purpose: Used by CloudBolt for cost visibility and analysis, and to create the cost report exports on your behalf.
- Permissions: AWS ReadOnlyAccess, plus Cost Explorer, Budgets, and S3 billing-data access. To create and read the cost report exports, it also has
bcm-data-exports:GetExport,ListExports, andCreateExport;cur:PutReportDefinition(required by AWS for export creation); andcost-optimization-hub:GetRecommendation/ListRecommendations.
The role has no permission to delete exports and cannot change your account’s Cost Optimization Hub or Compute Optimizer enrollment. CloudBolt reports missing prerequisites rather than remediating them.
CloudBoltActionsCrossAccountRole
- Purpose: Used by CloudBolt for monitoring, reporting, and discovery.
- Permissions: Describe, list, and get operations across major AWS services, including EC2, S3, RDS, IAM, CloudWatch, CloudTrail, and Security Hub.