# IAM roles

> An overview of the IAM roles created during AWS account configuration

---

Site [llms.txt](/llms.txt)

---

If you choose to [deploy the AWS CloudFormation template to configure AWS accounts for CloudBolt Platform integration](/docs/cbp/getting-started/configure-cloud-accounts/aws/), two least-privilege IAM roles are created in your environment:

- **CloudBoltFocusCrossAccountRole:** A management account role that allows CloudBolt to access your billing data.
- **CloudBoltActionsCrossAccountRole:** Target account roles used to discover resources.

The [Terraform module](/docs/cbp/reference/aws-account-config/terraform-onboarding/) creates the same two roles, with the same names and permissions, in the management account.

## CloudBoltFocusCrossAccountRole

- **Purpose:** Used by CloudBolt for cost visibility and analysis, and to create the cost report exports on your behalf.
- **Permissions:** AWS ReadOnlyAccess, plus Cost Explorer, Budgets, and S3 billing-data access. To create and read the cost report exports, it also has `bcm-data-exports:GetExport`, `ListExports`, and `CreateExport`; `cur:PutReportDefinition` (required by AWS for export creation); and `cost-optimization-hub:GetRecommendation` / `ListRecommendations`.

<div class="alert alert-info" role="alert">


The role has **no permission to delete exports** and cannot change your account's Cost Optimization Hub or Compute Optimizer enrollment. CloudBolt reports missing prerequisites rather than remediating them.
</div>


## CloudBoltActionsCrossAccountRole

- **Purpose:** Used by CloudBolt for monitoring, reporting, and discovery.
- **Permissions:** Describe, list, and get operations across major AWS services, including EC2, S3, RDS, IAM, CloudWatch, CloudTrail, and Security Hub.