This article explains the read-only, cross-account IAM access that Cye Cloud Posture Solution uses to scan your AWS environment, and lists every permission it adds on top of the AWS-managed SecurityAudit policy.

Overview

Cye Cloud Posture Solution, the Cloud Security Posture Management (CSPM) component of the Cye platform, connects to AWS through a read-only integration based on AWS best practices. The access model follows the principle of least privilege: it gives the solution visibility into cloud risks without exposing your sensitive data or control plane.

Assume a Cross-Account Role: You create an IAM role in your AWS account that Cye Cloud Posture Solution assumes temporarily, only when it runs scans and generates insights. An External ID enforces the trust relationship and prevents the "confused deputy" problem.
Read Metadata Only: The role uses the AWS-managed SecurityAudit policy plus a few carefully selected additions for deep metadata visibility. It has no write permissions and keeps no persistent credentials in your environment.
Audit & Revoke: Every API call appears in CloudTrail, and you can revoke access at any time by removing the IAM role.

What the CloudFormation template creates

You deploy a single CloudFormation template from Cye Cloud Posture Solution. The template creates:

A cross-account IAM role with the SecurityAudit managed policy.
Additional metadata-only permissions (listed in the next section).
A trust policy that allows only the Cye Cloud Posture Solution AWS account to assume the role.
An External ID, unique to your organization.

Cye Cloud Posture Solution assumes this role temporarily, only when needed to run scans and generate insights. It does not have write access or persistent credentials in your environment.

Which permissions are added beyond SecurityAudit

The SecurityAudit policy provides broad read-only visibility. A few additional permissions are required for enhanced risk analysis. They allow metadata-level reads only and do not expose sensitive resource content or customer data.

Lambda permissions

Service	Actions	Purpose
Lambda	`lambda:GetFunctionConfiguration`	Retrieve function configuration
Lambda	`lambda:GetLayerVersion`	Access Lambda layer versions

Macie permissions

Service	Actions	Purpose
Macie	`macie2:Get*`	Retrieve Macie resources
Macie	`macie2:List*`	List Macie resources
Macie	`macie2:Describe*`	Describe Macie resources

Billing and Cost Management

Service	Actions	Purpose
Billing	`billing:Get*`	Retrieve billing information
Billing	`billing:List*`	List billing resources
Budgets	`budgets:Describe*`	Describe budget details
Budgets	`budgets:View*`	View budget information
Cost Explorer	`ce:Get*`	Retrieve cost and usage data
Cost Explorer	`ce:List*`	List cost and usage resources
Cost Explorer	`ce:Describe*`	Describe cost and usage resources

EKS permissions

Service	Actions	Purpose
EKS	`eks:List*`	List EKS resources
EKS	`eks:Describe*`	Describe EKS cluster details

Note: These permissions are read-only and used exclusively to assess risk posture, with no access to raw content or secrets.

You can review the full list in the CloudFormation template file.

IAM policy summary

Component	Purpose
`SecurityAudit` policy	Baseline AWS-managed read-only access
Extra permissions	Metadata-only read access (e.g., Macie, KMS)
Trust relationship	Enforced via cross-account role + external ID
Access frequency	Temporary / on-demand
Write access	None

How you keep visibility and control

You keep full control over the access Cye Cloud Posture Solution has to your environment.

View all Cye Cloud Posture Solution API calls in CloudTrail.
Revoke access at any time by removing the IAM role.
No credentials are stored or persisted.

Wrap-up / Next Steps

Connect a single account: Go to Cloud Accounts > Connect account in the console and follow Connecting Your AWS Account.
Connect an AWS Organization or OU: Cye Cloud Posture Solution supports AWS Organizations integration using delegated administrator access. Follow Connecting Your AWS Organization for step-by-step instructions.
Review the template before you deploy: Open the CloudFormation template file to see every permission it grants.

How Cye Cloud Posture Solution Connects to Your AWS Environment