---
title: Grant New Relic permissions with AWS managed policies
source: https://docs.newrelic.com/docs/infrastructure/amazon-integrations/get-started/integrations-managed-policies
---

In order to use [infrastructure integrations](https://docs.newrelic.com/docs/infrastructure/integrations), you need to grant New Relic permission to read the relevant data from your account. Amazon Web Services (AWS) uses managed policies to grant these permissions.

## Recommended policy [#recommended]

> #### ⚠️ IMPORTANT
>
> Recommendation: Grant an account-wide `ReadOnlyAccess` [managed policy](http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) from AWS. AWS automatically updates this policy when new services are added or existing services are modified. New Relic infrastructure integrations have been designed to function with `ReadOnlyAccess` policies. For instructions, see [Connect AWS integrations to infrastructure](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/getting-started/connect-aws-integrations-infrastructure).

**Exception:** The [Trusted Advisor](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-trusted-advisor-integration) integration is not covered by the `ReadOnlyAccess` policy. It requires the additional `AWSSupportAccess` managed policy. This is also the only integration that requires full access permissions (`support:*`) in order to correctly operate. We notified Amazon about this limitation. Once it's resolved we'll update documentation with more specific permissions required for this integration.

## Optional policy [#optional]

If you cannot use the `ReadOnlyAccess` [managed policy](http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) from AWS, you can create your own customized policy based on the [list of permissions](https://docs.newrelic.com/docs/integrations/amazon-integrations/getting-started/integrations-managed-policies#list-permissions). This allows you to specify the optimal permissions required to fetch data from AWS for each integration. While this option is available, it is not recommended because it must be manually updated when you add or modify your integrations.

> #### ⚠️ IMPORTANT
>
> New Relic has no way of identifying problems related to custom permissions. If you choose to create a custom policy, it is your responsibility to maintain it and ensure proper data is being collected.

There are two ways to set up your customized policy: You can either use [our CloudFormation template](#cf-template), or create own yourself by [adding the permissions you need](#list-permissions).

### Option 1: Use our CloudFormation template [#cf-template]

Our CloudFormation template contains all the permissions for all our AWS integrations.

A user different than `root` can be used in the managed policy.

**CloudFormation template**

````yml
AWSTemplateFormatVersion: 2010-09-09
Outputs:
  NewRelicRoleArn:
    Description: NewRelicRole to monitor AWS Lambda
    Value: !GetAtt 
      - NewRelicIntegrationsTemplate
      - Arn
Parameters:
  NewRelicAccountNumber:
    Type: String
    Description: The Newrelic account number to send data
    AllowedPattern: '[0-9]+'
Resources:
  NewRelicIntegrationsTemplate:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub NewRelicTemplateTest
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::253490767857:root'
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref NewRelicAccountNumber
      Policies:
        - PolicyName: NewRelicIntegrations
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'elasticloadbalancing:DescribeLoadBalancers'
                  - 'elasticloadbalancing:DescribeTargetGroups'
                  - 'elasticloadbalancing:DescribeTags'
                  - 'elasticloadbalancing:DescribeLoadBalancerAttributes'
                  - 'elasticloadbalancing:DescribeListeners'
                  - 'elasticloadbalancing:DescribeRules'
                  - 'elasticloadbalancing:DescribeTargetGroupAttributes'
                  - 'elasticloadbalancing:DescribeInstanceHealth'
                  - 'elasticloadbalancing:DescribeLoadBalancerPolicies'
                  - 'elasticloadbalancing:DescribeLoadBalancerPolicyTypes'
                  - 'apigateway:GET'
                  - 'autoscaling:DescribeLaunchConfigurations'
                  - 'autoscaling:DescribeAutoScalingGroups'
                  - 'autoscaling:DescribePolicies'
                  - 'autoscaling:DescribeTags'
                  - 'autoscaling:DescribeAccountLimits'
                  - 'budgets:ViewBudget'
                  - 'cloudfront:ListDistributions'
                  - 'cloudfront:ListStreamingDistributions'
                  - 'cloudfront:ListTagsForResource'
                  - 'cloudtrail:LookupEvents'
                  - 'config:BatchGetResourceConfig'
                  - 'config:ListDiscoveredResources'
                  - 'dynamodb:DescribeLimits'
                  - 'dynamodb:ListTables'
                  - 'dynamodb:DescribeTable'
                  - 'dynamodb:ListGlobalTables'
                  - 'dynamodb:DescribeGlobalTable'
                  - 'dynamodb:ListTagsOfResource'
                  - 'ec2:DescribeVolumeStatus'
                  - 'ec2:DescribeVolumes'
                  - 'ec2:DescribeVolumeAttribute'
                  - 'ec2:DescribeInstanceStatus'
                  - 'ec2:DescribeInstances'
                  - 'ec2:DescribeVpnConnections'
                  - 'ecs:ListServices'
                  - 'ecs:DescribeServices'
                  - 'ecs:DescribeClusters'
                  - 'ecs:ListClusters'
                  - 'ecs:ListTagsForResource'
                  - 'ecs:ListContainerInstances'
                  - 'ecs:DescribeContainerInstances'
                  - 'elasticfilesystem:DescribeMountTargets'
                  - 'elasticfilesystem:DescribeFileSystems'
                  - 'elasticache:DescribeCacheClusters'
                  - 'elasticache:ListTagsForResource'
                  - 'es:ListDomainNames'
                  - 'es:DescribeElasticsearchDomain'
                  - 'es:DescribeElasticsearchDomains'
                  - 'es:ListTags'
                  - 'elasticbeanstalk:DescribeEnvironments'
                  - 'elasticbeanstalk:DescribeInstancesHealth'
                  - 'elasticbeanstalk:DescribeConfigurationSettings'
                  - 'elasticloadbalancing:DescribeLoadBalancers'
                  - 'elasticmapreduce:ListInstances'
                  - 'elasticmapreduce:ListClusters'
                  - 'elasticmapreduce:DescribeCluster'
                  - 'elasticmapreduce:ListInstanceGroups'
                  - 'health:DescribeAffectedEntities'
                  - 'health:DescribeEventDetails'
                  - 'health:DescribeEvents'
                  - 'iam:ListSAMLProviders'
                  - 'iam:ListOpenIDConnectProviders'
                  - 'iam:ListServerCertificates'
                  - 'iam:GetAccountAuthorizationDetails'
                  - 'iam:ListVirtualMFADevices'
                  - 'iam:GetAccountSummary'
                  - 'iot:ListTopicRules'
                  - 'iot:GetTopicRule'
                  - 'iot:ListThings'
                  - 'firehose:DescribeDeliveryStream'
                  - 'firehose:ListDeliveryStreams'
                  - 'kinesis:ListStreams'
                  - 'kinesis:DescribeStream'
                  - 'kinesis:ListTagsForStream'
                  - 'rds:ListTagsForResource'
                  - 'rds:DescribeDBInstances' 
                  - 'rds:DescribeDBClusters' 
                  - 'redshift:DescribeClusters' 
                  - 'redshift:DescribeClusterParameters'
                  - 'route53:ListHealthChecks'
                  - 'route53:GetHostedZone'
                  - 'route53:ListHostedZones'
                  - 'route53:ListResourceRecordSets'
                  - 'route53:ListTagsForResources'
                  - 's3:GetLifecycleConfiguration'
                  - 's3:GetBucketTagging'
                  - 's3:ListAllMyBuckets'
                  - 's3:GetBucketWebsite'
                  - 's3:GetBucketLogging'
                  - 's3:GetBucketCORS'
                  - 's3:GetBucketVersioning'
                  - 's3:GetBucketAcl'
                  - 's3:GetBucketNotification'
                  - 's3:GetBucketPolicy'
                  - 's3:GetReplicationConfiguration'
                  - 's3:GetMetricsConfiguration'
                  - 's3:GetAccelerateConfiguration'
                  - 's3:GetAnalyticsConfiguration'
                  - 's3:GetBucketLocation'
                  - 's3:GetBucketRequestPayment'
                  - 's3:GetEncryptionConfiguration'
                  - 's3:GetInventoryConfiguration'
                  - 'ses:ListConfigurationSets'
                  - 'ses:GetSendQuota'
                  - 'ses:DescribeConfigurationSet'
                  - 'ses:ListReceiptFilters'
                  - 'ses:ListReceiptRuleSets'
                  - 'ses:DescribeReceiptRule'
                  - 'ses:DescribeReceiptRuleSet'
                  - 'sns:GetTopicAttributes'
                  - 'sns:ListTopics'
                  - 'sqs:ListQueues'
                  - 'sqs:ListQueueTags'
                  - 'sqs:GetQueueAttributes'
                  - 'tag:GetResources'
                  - 'ec2:DescribeInternetGateways'
                  - 'ec2:DescribeVpcs'
                  - 'ec2:DescribeNatGateways'
                  - 'ec2:DescribeVpcEndpoints'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeNetworkAcls'
                  - 'ec2:DescribeVpcAttribute'
                  - 'ec2:DescribeRouteTables'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeVpcPeeringConnections'
                  - 'ec2:DescribeNetworkInterfaces'
                  - 'lambda:GetAccountSettings'
                  - 'lambda:ListFunctions'
                  - 'lambda:ListAliases'
                  - 'lambda:ListTags'
                  - 'lambda:ListEventSourceMappings'
                  - 'cloudwatch:GetMetricStatistics'
                  - 'cloudwatch:ListMetrics'
                  - 'cloudwatch:GetMetricData'
                  - 'support:*'
                Resource: '*'
```

````

### Option 2: Manually add permissions [#list-permissions]

To create your own policy using available permissions:

1.  [Add the permissions for **all** integrations](#all-permissions).
2.  Add permissions that are specific to the integrations you need

The following permissions are used by New Relic to retrieve data for specific AWS integrations:

**Required by CloudWatch metric streams and all API polling integrations**

> #### ⚠️ IMPORTANT
>
> If an integration is not listed on this page, these permissions are all you need.

| All integrations     | Permissions                                                                          |
| -------------------- | ------------------------------------------------------------------------------------ |
| CloudWatch           | `cloudwatch:GetMetricStatistics` `cloudwatch:ListMetrics` `cloudwatch:GetMetricData` |
| Config API           | `config:BatchGetResourceConfig` `config:ListDiscoveredResources`                     |
| Resource Tagging API | `tag:GetResources`                                                                   |

**ALB permissions**

Additional [ALB](https://docs.newrelic.com/docs/aws-alb-integration) permissions:

-   `elasticloadbalancing:DescribeLoadBalancers`
-   `elasticloadbalancing:DescribeTargetGroups`
-   `elasticloadbalancing:DescribeTags`
-   `elasticloadbalancing:DescribeLoadBalancerAttributes`
-   `elasticloadbalancing:DescribeListeners`
-   `elasticloadbalancing:DescribeRules`
-   `elasticloadbalancing:DescribeTargetGroupAttributes`
-   `elasticloadbalancing:DescribeInstanceHealth`
-   `elasticloadbalancing:DescribeLoadBalancerPolicies`
-   `elasticloadbalancing:DescribeLoadBalancerPolicyTypes`

**API Gateway permissions**

Additional [API Gateway](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-api-gateway-monitoring-integration) permissions:

-   `apigateway:GET`

**Auto Scaling permissions**

Additional [Auto Scaling permissions:](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-auto-scaling-monitoring-integration)

-   `autoscaling:DescribeLaunchConfigurations`
-   `autoscaling:DescribeAutoScalingGroups`
-   `autoscaling:DescribePolicies`
-   `autoscaling:DescribeTags`
-   `autoscaling:DescribeAccountLimits`

**Billing permission**

Additional [Billing permission:](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-billing-integration)

-   `budgets:ViewBudget`

**CloudFront permissions**

Additional [CloudFront](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-cloudfront-integration) permissions:

-   `cloudfront:ListDistributions`
-   `cloudfront:ListStreamingDistributions`
-   `cloudfront:ListTagsForResource`

**CloudTrail permissions**

Additional [CloudTrail](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-cloudtrail-monitoring-integration) permissions:

-   `cloudtrail:LookupEvents`

**DynamoDB permissions**

Additional [DynamoDB](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-dynamodb-integration) permissions:

-   `dynamodb:DescribeLimits`
-   `dynamodb:ListTables`
-   `dynamodb:DescribeTable`
-   `dynamodb:ListGlobalTables`
-   `dynamodb:DescribeGlobalTable`
-   `dynamodb:ListTagsOfResource`

**EBS permissions**

Additional [EBS](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-ebs-integration) permissions:

-   `ec2:DescribeVolumeStatus`
-   `ec2:DescribeVolumes`
-   `ec2:DescribeVolumeAttribute`

**EC2 permissions**

Additional [EC2](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-ec2-integration) permissions:

-   `ec2:DescribeInstanceStatus`
-   `ec2:DescribeInstances`

**ECS/ECR permissions**

Additional [ECS/ECR](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-ecsecr-integration) permissions:

-   `ecs:ListServices`
-   `ecs:DescribeServices`
-   `ecs:DescribeClusters`
-   `ecs:ListClusters`
-   `ecs:ListTagsForResource`
-   `ecs:ListContainerInstances`
-   `ecs:DescribeContainerInstances`

**EFS permissions**

Additional [EFS](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-efs-monitoring-integration) permissions:

-   `elasticfilesystem:DescribeMountTargets`
-   `elasticfilesystem:DescribeFileSystems`

**ElastiCache permissions**

Additional [ElastiCache](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-elasticache-integration) permissions:

-   `elasticache:DescribeCacheClusters`
-   `elasticache:ListTagsForResource`

**ElasticSearch permissions**

Additional [ElasticSearch](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-elasticsearch-integration) permissions:

-   `es:ListDomainNames`
-   `es:DescribeElasticsearchDomain`
-   `es:DescribeElasticsearchDomains`
-   `es:ListTags`

**Elastic Beanstalk permissions**

Additional [Elastic Beanstalk](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-elastic-beanstalk-monitoring-integration) permissions:

-   `elasticbeanstalk:DescribeEnvironments`
-   `elasticbeanstalk:DescribeInstancesHealth`
-   `elasticbeanstalk:DescribeConfigurationSettings`

**ELB permissions**

Additional [ELB](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-elb-integration) permissions:

-   `elasticloadbalancing:DescribeLoadBalancers`

**EMR permissions**

Additional [EMR](https://docs.newrelic.com/docs/aws-emr-monitoring-integration) permissions:

-   `elasticmapreduce:ListInstances`
-   `elasticmapreduce:ListClusters`
-   `elasticmapreduce:DescribeCluster`
-   `elasticmapreduce:ListInstanceGroups`
-   `elasticmapreduce:ListInstanceFleets`

**Health permissions**

Additional [Health](https://docs.newrelic.com/docs/aws-health-integration) permissions:

-   `health:DescribeAffectedEntities`
-   `health:DescribeEventDetails`
-   `health:DescribeEvents`

**IAM permissions**

Additional [IAM](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-iam-integration) permissions:

-   `iam:ListSAMLProviders`
-   `iam:ListOpenIDConnectProviders`
-   `iam:ListServerCertificates`
-   `iam:GetAccountAuthorizationDetails`
-   `iam:ListVirtualMFADevices`
-   `iam:GetAccountSummary`

**IoT permissions**

Additional [IoT](https://docs.newrelic.com/docs/aws-iot-monitoring-integration) permissions:

-   `iot:ListTopicRules`
-   `iot:GetTopicRule`
-   `iot:ListThings`

**Kinesis Firehose permissions**

Additional [Kinesis Firehose](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-kinesis-firehose-integration) permissions:

-   `firehose:DescribeDeliveryStream`
-   `firehose:ListDeliveryStreams`

**Kinesis Streams permissions**

Additional [Kinesis Streams](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-kinesis-integration) permissions:

-   `kinesis:ListStreams`
-   `kinesis:DescribeStream`
-   `kinesis:ListTagsForStream`

**Lambda permissions**

Additional [Lambda](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-lambda-integration) permissions:

-   `lambda:GetAccountSettings`
-   `lambda:ListFunctions`
-   `lambda:ListAliases`
-   `lambda:ListTags`
-   `lambda:ListEventSourceMappings`

**RDS, RDS Enhanced Monitoring permissions**

Additional [RDS](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-rds-integration) and [RDS Enhanced Monitoring](https://docs.newrelic.com/docs/aws-rds-enhanced-monitoring-integration) permissions:

-   `rds:ListTagsForResource`
-   `rds:DescribeDBInstances`
-   `rds:DescribeDBClusters`

**Redshift permissions**

Additional [Redshift](https://docs.newrelic.com/docs/aws-redshift-integration) permissions:

-   `redshift:DescribeClusters`
-   `redshift:DescribeClusterParameters`

**Route 53 permissions**

Additional [Route 53](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/amazon-integrations/aws-route-53-integration) permissions:

-   `route53:ListHealthChecks`
-   `route53:GetHostedZone`
-   `route53:ListHostedZones`
-   `route53:ListResourceRecordSets`
-   `route53:ListTagsForResources`

**S3 permissions**

Additional [S3](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-s3-integration) permissions:

-   `s3:GetLifecycleConfiguration`
-   `s3:GetBucketTagging`
-   `s3:ListAllMyBuckets`
-   `s3:GetBucketWebsite`
-   `s3:GetBucketLogging`
-   `s3:GetBucketCORS`
-   `s3:GetBucketVersioning`
-   `s3:GetBucketAcl`
-   `s3:GetBucketNotification`
-   `s3:GetBucketPolicy`
-   `s3:GetReplicationConfiguration`
-   `s3:GetMetricsConfiguration`
-   `s3:GetAccelerateConfiguration`
-   `s3:GetAnalyticsConfiguration`
-   `s3:GetBucketLocation`
-   `s3:GetBucketRequestPayment`
-   `s3:GetEncryptionConfiguration`
-   `s3:GetInventoryConfiguration`

**Simple Email Service (SES) permissions**

Additional [SES](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-simple-email-service-ses-monitoring-integration) permissions:

-   `ses:ListConfigurationSets`
-   `ses:GetSendQuota`
-   `ses:DescribeConfigurationSet`
-   `ses:ListReceiptFilters`
-   `ses:ListReceiptRuleSets`
-   `ses:DescribeReceiptRule`
-   `ses:DescribeReceiptRuleSet`

**SNS permissions**

Additional [SNS](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-sns-integration) permissions:

-   `sns:GetTopicAttributes`
-   `sns:ListTopics`

**SQS permissions**

Additional [SQS](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-sqs-integration) permissions:

-   `sqs:ListQueues`
-   `sqs:GetQueueAttributes`
-   `sqs:ListQueueTags`

**Trusted Advisor permissions**

Additional [Trusted Advisor](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-trusted-advisor-integration) permissions:

-   `support:*`

    See also the note about the Trusted Advisor integration and [recommended policies](#recommended).

**VPC permissions**

Additional [VPC](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/amazon-integrations/aws-vpc-integration) permissions:

-   `ec2:DescribeInternetGateways`
-   `ec2:DescribeVpcs`
-   `ec2:DescribeNatGateways`
-   `ec2:DescribeVpcEndpoints`
-   `ec2:DescribeSubnets`
-   `ec2:DescribeNetworkAcls`
-   `ec2:DescribeVpcAttribute`
-   `ec2:DescribeRouteTables`
-   `ec2:DescribeSecurityGroups`
-   `ec2:DescribeVpcPeeringConnections`
-   `ec2:DescribeNetworkInterfaces`
-   `ec2:DescribeVpnConnections`

**X-Ray monitoring permissions**

Additional [X-ray monitoring](https://docs.newrelic.com/docs/integrations/amazon-integrations/aws-integrations-list/aws-x-ray-monitoring-integration) permissions:

-   `xray:BatchGet*`
-   `xray:Get*`