AWS Resilience Hub access permissions reference
You can use AWS Identity and Access Management (IAM) to manage access to the application resources and create IAM policies that apply to users, groups, or roles.
Every AWS Resilience Hub application can be configured to use the Invoker role (an IAM role), or use the current IAM user permissions (along with a set of predefined roles for cross-account and scheduled assessment). In this role, you can attach a policy that defines the permissions required by AWS Resilience Hub to access other AWS resources or application resources. The invoker role must have a trust policy that is added to AWS Resilience Hub service principle.
To manage permissions for your application, we recommend using AWS managed policies for AWS Resilience Hub. You can use these managed policies without any modifications, or you can use them as a starting point to write your own restrictive policies. Policies can restrict user permissions at the resource level for different actions by using additional optional conditions.
If your application resources are in different accounts (secondary/resource accounts), you must setup a new role in each account that contains your application resources.
Topics
