More documentation about IAM permissions needed

[beacomni]

I'm interested to use steampipe, but would like to know more about minimum IAM permissions needed. For example, it's not obvious to me from the docs whether steampipe can do CUD in CRUD (create, update, delete). I can imagine a scenario where I want a readonly role to 'audit' what I'm querying and not risk someone accidentally doing a UDPATE or DELETE. More documentation on this would be appreciated. Thanks!

[e-gineer]

Steampipe currently only supports read queries, not create, update or delete. As such, it works well with read level permissions to your AWS account. The credentials section of the docs for the AWS plugin on the hub recommends ReadOnlyAccess policy.

In practice, Steampipe needs permissions for whichever tables you'd like to use. So, as an example, you could grant it read only permissions to IAM and nothing else and it would then work for those aws_iam_* tables only.

[beacomni]

Thanks for the clarification, appreciate it!