Integrations Permissions Requirements

View below the various permissions requirements for AWS and Azure integrations.

AWS Inventory Scanning

FireTail scans your AWS environment for AI resources across Amazon Bedrock, Amazon Bedrock AgentCore, and Amazon SageMaker. It also reads Amazon CloudWatch metrics to locate model usage. Grant the FireTail role the following read-only permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FireTailBedrockReadOnly",
            "Effect": "Allow",
            "Action": [
                "bedrock:List*",
                "bedrock:Get*",
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricData",
                "cloudwatch:GetMetricStatistics"
            ],
            "Resource": "*"
        },
        {
            "Sid": "FireTailBedrockAgentCoreReadOnly",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:List*",
                "bedrock-agentcore:Get*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "FireTailSageMakerReadOnly",
            "Effect": "Allow",
            "Action": [
                "sagemaker:List*",
                "sagemaker:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

Alternatively, attach the AWS managed policies AmazonBedrockReadOnly and AmazonSageMakerReadOnly. Amazon Bedrock AgentCore resources are not covered by a managed read-only policy, so the inline bedrock-agentcore permissions above are still required.

AZURE Inventory Scanning

Assign the IAM role of Reader.

Learn how to set up the following integrations:

• AWS Inventory Scanning
• Azure Inventory Scanning