Skip to content
pier pier

AWS permissions

Two permission levels exist. Setup needs IAM rights once, to create the role, the instance profile, and the security group. Daily use needs only:

  • ec2: run, start, stop, terminate, describe, and create-tags
  • ssm: start-session and get-parameter
  • sts: get-caller-identity
  • iam: PassRole on pier-session (plus get-role and get-instance-profile for pier doctor)
  • ec2 security group ingress calls for direct connect (skipped when aws.direct = false)

Some commands add to that:

CommandExtra permissions
pier resizeec2:ModifyInstanceAttribute
pier bakeec2:CreateImage, ec2:DeregisterImage, ec2:DeleteSnapshot
vCPU headroom displayservicequotas:GetServiceQuota (degrades politely without it)

The same list ships as comments in pier setup --print-admin, the command that prints the one-time admin steps for locked-down accounts.

What sessions can do

Section titled “What sessions can do”

The VM side is deliberately minimal. The instance role (pier-session) carries only AmazonSSMManagedInstanceCore. The VM never holds cloud credentials. Parking is the VM shutting itself down, and anything needing account credentials happens from the laptop.