AWS Permissions

Every Ventra AWS collector is strictly read only. The policies contain Describe, Get, List, Lookup, and Filter style actions only. No Create, Put, Delete, Update, Modify, Run, or Terminate action appears anywhere in the collector code or the reference policies.

Ventra collectors need read only access across 26 service areas. Each area maps to one or more collectors in Acquire, and the full action list lives in the downloadable policy files below.

• Account context (4 actions)
• IAM snapshot (24 actions)
• KMS (4 actions)
• Secrets Manager (2 actions)
• CloudTrail (7 actions)
• CloudWatch Logs (2 actions)
• AWS Config (3 actions)
• Log posture (7 actions)
• VPC flow logs (5 actions)
• ELB / ALB access logs (5 actions)
• CloudFront access logs (5 actions)
• Route 53 Resolver query logs (6 actions)
• WAF (4 actions)
• API Gateway access logs (2 actions)
• EC2 / EBS (9 actions)
• S3 (8 actions)
• S3 access logs (5 actions)
• Lambda (3 actions)
• Lambda logs (3 actions)
• EKS audit (3 actions)
• RDS export logs (2 actions)
• GuardDuty (6 actions)
• Security Hub (3 actions)
• Macie (3 actions)
• Detective (2 actions)
• Inspector (2 actions)

S3 object read access is scoped to the common log bucket name patterns, such as CloudTrail, VPC flow, and load balancer access logs. Your security team should map the resource entries to the buckets that actually hold logs in the account.

Send the plain text permission list to the client IAM administrator for review before the engagement. The JSON policy suits labs and quick validation.