> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maia.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM permissions for runner deployment



\<table><tbody><tr><td>Runner type</td>
            \<td>Maia Hybrid</td></tr>
          \<tr><td>Runner platform</td>
            \<td /></tr></tbody></table>

This guide lists the AWS IAM permissions required to deploy a Maia runner using the CloudFormation templates Matillion provides. It covers the permissions needed by the deploying user or role—the identity that runs the CloudFormation stack—rather than the permissions the running Maia runner itself needs, which are covered separately in [AWS IAM roles](https://docs.maia.ai/docs/guides/aws-iam-roles.md).Always follow the principle of least privilege and assign only the minimum permissions required for the specific task.***## Deployer permissionsThe user or role deploying the CloudFormation stack requires permissions across several AWS services, including IAM, EC2, CloudWatch Logs, Secrets Manager, and ECS.### Coarse-grainedThe following AWS managed policies cover all deployment requirements:- AmazonECS\_FullAccess
- CloudWatchFullAccess
- SecretsManagerReadWrite
- IAMFullAccess
- AmazonS3FullAccess### Fine-grainedIf you prefer to scope permissions more tightly than the managed policies above, the following actions are required.| AWS service | Actions |
| - | - |
| IAM | `iam:AddRoleToInstanceProfile`, `iam:PutRolePolicy`, `iam:PassRole`, `iam:GetRolePolicy`, `iam:CreateInstanceProfile`, `iam:DeleteInstanceProfile`, `iam:RemoveRoleFromInstanceProfile`, `iam:DetachRolePolicy`, `iam:AttachRolePolicy`, `iam:DeleteRolePolicy`, `iam:GetRole`, `iam:CreateRole`, `iam:DeleteRole`, `iam:TagPolicy`, `iam:UntagRole`, `iam:TagRole`, `iam:UntagPolicy`, `iam:UpdateRole`, `iam:UntagInstanceProfile`, `iam:TagInstanceProfile` |
| EC2 | `ec2:ReplaceIamInstanceProfileAssociation`, `ec2:AuthorizeSecurityGroupEgress`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:RevokeSecurityGroupEgress`, `ec2:RevokeSecurityGroupIngress`, `ec2:DescribeSecurityGroups`, `ec2:DescribeVpcs`, `ec2:DescribeSubnets`, `ec2:UpdateSecurityGroupRuleDescriptionsIngress`, `ec2:UpdateSecurityGroupRuleDescriptionsEgress`, `ec2:CreateTags`, `ec2:ModifySecurityGroupRules`, `ec2:DisassociateIamInstanceProfile`, `ec2:DeleteTags`, `ec2:CreateSecurityGroup`, `ec2:AssociateIamInstanceProfile`, `ec2:DeleteSecurityGroup` |
| Logging | `logs:PutRetentionPolicy`, `logs:CreateLogStream`, `logs:TagLogGroup`, `logs:TagResource`, `logs:CreateLogGroup`, `logs:DeleteLogStream`, `logs:UntagLogGroup`, `logs:DeleteLogGroup`, `logs:UntagResource` |
| ECS and Secrets Manager | `secretsmanager:DeleteSecret`, `secretsmanager:UpdateSecretVersionStage`, `secretsmanager:TagResource`, `secretsmanager:UntagResource`, `secretsmanager:CreateSecret`, `secretsmanager:UpdateSecret`, `ecs:UpdateCluster`, `ecs:DescribeServices`, `ecs:DescribeTasks`, `ecs:DescribeClusters`, `ecs:UpdateContainerInstancesState`, `ecs:StartTask`, `ecs:CreateCapacityProvider`, `ecs:UpdateService`, `ecs:RegisterTaskDefinition`, `ecs:StopTask`, `ecs:DeregisterContainerInstance`, `ecs:DeleteTaskDefinitions`, `ecs:TagResource`, `ecs:UpdateClusterSettings`, `ecs:CreateCluster`, `ecs:DeleteService`, `ecs:DeleteCluster`, `ecs:RegisterContainerInstance`, `ecs:DeleteCapacityProvider`, `ecs:DeregisterTaskDefinition`, `ecs:CreateService`, `ecs:RunTask`, `ecs:UntagResource`, `ecs:PutClusterCapacityProviders`, `ecs:UpdateCapacityProvider`, `ecs:UpdateContainerAgent` |
| CloudFormation | `cloudformation:CreateStack` |> [!NOTE]
>
> You can refer to the [IAM roles](https://docs.maia.ai/docs/guides/aws-iam-roles.md#task-role) documentation for more detailed information on the task role and task execution role that the CloudFormation stack creates.***## AWS service-linked rolesBefore deploying a Maia runner, confirm the existence of a service-linked role for Amazon ECS in your AWS account. For details, read [Prerequisites](https://docs.maia.ai/docs/guides/aws-fargate-manual-runner-setup.md#prerequisites) in the AWS Fargate manual setup guide.***For S3 and Azure Blob Storage permissions used by pipeline components, read [Cloud provider credentials](https://docs.maia.ai/docs/guides/cloud-credentials.md#roles-and-permissions-for-cloud-storage).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.