Why we need permissions
To deliver savings, we analyse your AWS usage and apply commitment-based discounts on your behalf. This is done through a cross-account IAM role that you create in your management (payer) account with our CloudFormation template. If you connect your whole AWS Organization, a CloudFormation StackSet creates the same role in each member account. The role follows the principle of least privilege. We only receive the access strictly necessary to:- Read cost and usage data.
- Detect optimisation opportunities.
- Manage the lifecycle of our .
Monitoring (Read-Only)
These permissions let MilkStraw AI monitor your spend and resources without touching your workloads. Cost managementWe have a deny policy for Redshift, to block access to cluster credentials:Storage & Containers
We only read bucket and repository metadata (configuration, lifecycle policies, Storage Lens metrics). Never the objects stored inside your buckets.Networking & Load Balancing
We only read log group metadata (retention settings, stored bytes). Never the log events themselves.AWS optimisation tools These permissions let us read recommendations that AWS itself generates for your account.
Enabling AWS cost tools
These actions let us enable AWS Compute Optimizer and S3 Storage Lens for your account, and ask AWS to refresh your Savings Plans recommendations, so their data can feed into our analysis.iam:CreateServiceLinkedRoleandorganizations:EnableAWSServiceAccessare locked down with IAM conditions so they can only be used for the Compute Optimizer, S3 Storage Lens, and AWS Organizations service-linked roles, nothing else.
When you connect, MilkStraw AI creates a free S3 Storage Lens dashboard named milkstraw-org-dashboard. It exports daily bucket-level metrics to an S3 bucket that MilkStraw AI owns. If you delete your MilkStraw AI organization, the export stops, but the dashboard stays in your account.
Integration management
These actions are required to integrate MilkBox accounts into your AWS Organization.We useorganizations:CreateOrganizationwhen the organization is not already created, this is a one-time operation for small standalone accounts, if you already have an organization, this api cant be executed against your account, thenorganizations:InviteAccountToOrganizationis used to invite MilkBox accounts to your organization.