What CloudWise accesses in your AWS account
CloudWise uses read-only IAM permissions to analyze your costs. No data is modified. No resources are changed. Every permission shown here is parsed directly from our public CloudFormation templates.
No signup required to view this page.
Monitoring, all tiers
Read-only permissions
Granted by the CUR monitoring CloudFormation stack. All actions are read-only.
Loading permissions from template...
Remediation, Agentic and above, optional
Remediation role permissions
Write permissions for AI-powered remediation. Deployed as a separate stack with session-tag conditions and a hardcoded action allow-list.
Loading permissions from template...
This is a separate, optional CloudFormation stack, only deployed if you opt into the Agentic tier. All actions require aws:PrincipalTag/cloudwise-action: remediation. Sessions are 15 minutes, never cached. Delete the remediation stack at any time to revoke.