Why we need permissions
To deliver savings, we analyse your AWS usage and apply commitment-based discounts on your behalf. This is done through a cross-account IAM role that you create in your payer account with our CloudFormation template. The role follows the principle of least privilege. We only receive the access strictly necessary to:- Read cost and usage data.
- Detect optimisation opportunities.
- Manage the lifecycle of our .
Monitoring (Read-Only)
These permissions let MilkStraw AI monitor your spend and resources without touching your workloads. Cost managementWe have a deny policy for Redshift, to block access to cluster credentials:Storage & Containers
We only read bucket and repository metadata (configuration, lifecycle policies, Storage Lens metrics). Never the objects stored inside your buckets.Networking & Load Balancing
We only read log group metadata (retention settings, stored bytes). Never the log events themselves.AWS optimisation tools These permissions let us read recommendations that AWS itself generates for your account.
Enabling AWS cost tools
These actions are required to enable AWS Compute Optimizer and S3 Storage Lens for your account, so their recommendations can feed into our analysis.iam:CreateServiceLinkedRoleandorganizations:EnableAWSServiceAccessare locked down with IAM conditions so they can only be used for the Compute Optimizer, S3 Storage Lens, and AWS Organizations service-linked roles, nothing else.
Integration management
These actions are required to integrate MilkBox accounts into your AWS Organization.We useorganizations:CreateOrganizationwhen the organization is not already created, this is a one-time operation for small standalone accounts, if you already have an organization, this api cant be executed against your account, thenorganizations:InviteAccountToOrganizationis used to invite MilkBox accounts to your organization.