Transilience Role Details on Security Audit (Read), Logs (Read), SSM (Write)

Created by Venkat Pothamsetty, Modified on Wed, 11 Mar at 6:55 PM by Venkat Pothamsetty

9 policies attached · 1 write policy · 8 read-only policies

Role purpose: Collecting compliance evidence from AWS accounts and monitoring — this role is assumed by the Transilience platform to assess security posture, gather audit artifacts, and run configuration checks across your AWS environment.

Policy	Access	Purpose	Read Permissions	Write Permissions	Scope
SecurityAudit AWS Managed	READ	Collect compliance evidence across AWS services for monitoring and audit	IAM, EC2, RDS, Lambda, Config S3, CloudFormation, CloudWatch Broad read across most AWS services	none	Resource: *
Transilience-ECR-S3-Read Customer Managed	READ	Vulnerability scanning of container images and reading S3 bucket configurations	ECR: auth token, images, repos, scan findings, lifecycle & repo policies S3: bucket location, policy, ACL, versioning, tagging, logging, encryption, CORS, replication, object lock S3: ListBucket, ListAllMyBuckets	none	Resource: *
Transilience-Logs-VPC-Read Customer Managed	READ	Reading logs for compliance monitoring and network configuration evidence	CloudWatch Logs: log groups, streams, events, metric filters, subscriptions EC2/VPC: flow logs, VPCs, subnets, security groups, NACLs, route tables EC2/VPC: NAT/internet gateways, transit gateways, instances, tags	none	Resource: *
Transilience-Security-Services-Read Customer Managed	READ	Collecting compliance evidence from AWS security services	Inspector v2: findings, coverage, members, config Security Hub: findings, insights, standards, controls GuardDuty: findings, detectors, members Macie: findings, bucket stats, session Access Analyzer & Detective: list/get all Account: alternate contacts	none	Resource: *
Transilience-CloudTrail-Read Customer Managed	READ	Security — auditing API activity and account-level events	CloudTrail: describe/get/list trails Event selectors, insight selectors Event data stores, queries	none	Resource: *
Transilience-SSM-Read Customer Managed	READ	Reading instance configuration and patch state as compliance evidence	Instances: describe info, properties, connection status Inventory: get inventory, schema, entries Patches: instance patches, patch states, baselines, patch groups Commands: list commands & invocations, get invocation Sessions: describe sessions Documents: list, describe, get documents Parameters: get/describe parameters & history Associations: list, describe, execution details Automation: describe/get executions & steps Maintenance Windows: describe/get windows, targets, tasks, executions Compliance: resource summaries, items, compliance summaries	none	Resource: *
Transilience-SSM-Write Customer Managed	WRITE	Running configuration scripts to collect configurations on instances, such as SSH, FIM.	none	Run Command: SendCommand, CancelCommand Sessions: StartSession, TerminateSession, ResumeSession Patches: create/update/delete patch baselines & groups Maintenance Windows: create/update/delete windows, targets, tasks Inventory: PutInventory, DeleteInventory Associations: create/update/delete associations Documents: create/update/delete documents Parameters: PutParameter, DeleteParameter, tag resources IAM PassRole ssm.amazonaws.com only	Resource: * PassRole: TransilienceComplianceRole
Transilience-Cost-Explorer Customer Managed	READ	Cost analysis of compliance runs and service usage	Cost Explorer: cost/usage, forecasts, reservations, savings plans, anomalies, tags Cost & Usage Reports: describe report definitions Budgets: view budgets, describe actions & history Billing: data, details, preferences, credits, IAM access	none	Resource: *
TransilienceCloudTrailS3Access Inline · Dynamic	READ	Security — reading CloudTrail log files from S3 for audit evidence	S3: GetBucketLocation, GetBucketAcl, ListBucket, GetBucketPolicy, GetBucketTagging CloudTrail buckets only S3: GetObject, GetObjectVersion, GetObjectTagging CloudTrail objects only	none	CloudTrail buckets Dynamic — resolved at deploy time