What IAM permissions does Cado use?

The Cado platform requires specific IAM permissions to operate effectively. Permissions are required to operate the main Cado virtual machine in the account where Cado is installed, and different permissions are required in target accounts to copy data back for processing.

Below is a clear breakdown of the different permission groups and their purposes.

Permission Group	Purpose
Core Platform and Worker Operations
RequiredForStartup	Essential for core platform operation and starting/stopping workers.
RequiredForStartup2	Additional permissions for core platform and worker management.
RequiredForWorkers	Launching worker VMs for parallel processing.
RequiredForWorkersAndUpdatesIAM	Granting IAM access to workers and upgrade VMs.
EC2 and Core Platform Permissions
RequiredForEC2ImportAndCorePlatform	Required to start/stop workers and acquire EC2 volumes.
Health Checks
RequiredToCheckPolicy	Needed for health checks to ensure safe operation of the core platform.
Health Check Operations
RequiredForHealthChecks	Needed for performing health checks to ensure core platform safety.
Native Updates with ALB
RequiredForNativeUpdatesWithALB	Required for performing native updates using an Application Load Balancer (ALB), optional if ALB is not used.
Cross-Account Operations
RequiredForCrossAccountAccess	Required for cross-account operations between AWS accounts.
IAM	Assuming roles for cross-account acquisition + health check.
Accessing Cado S3 Bucket
RequiredToAccessCadoS3Bucket	Allows access to the Cado S3 bucket for storing and retrieving forensic data.
S3 Bucket and Forensic Preservation
RequiredForAcquireToS3	Permissions for forensic preservation to S3 buckets and maintaining the chain of custody (can be scoped to "CadoS3BucketAlt").
RequiredForS3Import	Acquiring data from S3.
RequiredForCadoHostAndPreservation	Monitoring S3 bucket for Cado Host artifacts and preserving evidence.
RequiredForCadoHostAndPreservation2	Listing S3 buckets.
S3 Readiness Checks
RequiredForS3Readiness	Ensures the platform is ready by verifying safe S3 operations.
Memory Forensics via SSM
RequiredForMemoryForensics	Enables triage acquisitions that include memory acquisition using SSM.
KMS Encrypted EC2 Imports
RequiredForKmsEncryptedEc2Import	Allows acquisition of KMS-encrypted EBS volumes for EC2 systems.
RequiredForCrossAccountDefaultKmsEncryptedEc2Import	Needed to acquire KMS-encrypted EBS volumes from other AWS accounts.
Temporary KMS Resource Operations
RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import	Required to handle temporary KMS resources by generating keys for re-encryption during encrypted EC2 volume acquisitions.
Lambda Function Imports
RequiredForLambdaImport	Permissions for importing Lambda functions, CloudWatch logs, and container images if applicable.
ECS Imports
RequiredForEcsImport	Allows importing ECS clusters, services, and tasks. ExecuteCommand is needed to run commands on ECS tasks.
EKS Imports
RequiredForEKSImport	Required for acquiring EKS clusters.
EC2 and AMI Imports
RequiredForEc2ImportAndAmiImport	Permissions for acquiring EC2 instances, volumes, snapshots, CloudTrail logs, IAM roles, policies, and SSM documents.
RequiredForEc2ImportAndAmiImport2	Scoped permissions for handling copied volumes created by Cado during EC2 and AMI imports.
EC2 Isolation
RequiredForResponseActionIsolateEc2	Required to isolate EC2 instances (optional if isolation is not needed).
AMI Imports
RequiredForAmiImports	Permissions scoped to the Cado copy of the AMI during import.
GuardDuty Monitoring
RequiredForGuardDutyMonitoring	Needed for GuardDuty monitoring, optional if not using GuardDuty automation.
Automated Error Reporting
RequiredForAutomatedErrorReporting	Allows automated error logs to be sent to Cado (optional if logs are shared manually).
One-Time KMS Key Creation
RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter	Used once to create a Cado-specific KMS key for default encrypted EBS volumes, can be deleted afterward.
AWS Organizations Account Discovery
RequiredForAWSOrganizationsDiscoverAccounts	Required to discover accounts in AWS Organizations, optional if AWS Organizations is not being used.
EBS Direct Acquisition
ListSnapshotBlocks	Allows listing the blocks that make up a specific Amazon EBS snapshot.
ListChangedBlocks	Allows listing the blocks that have changed between two Amazon EBS snapshots.
GetSnapshotBlock	Allows retrieving the data of a specific block from an Amazon EBS snapshot.
Secrets Manager
RequiredForSecretsManagement	Encrypting secrets stored in the platform.
CloudWatch
RequiredForCloudWatchAgent	Enable CloudWatch agent to forward logs to log group (if CloudWatch is a requirement to use).

Customizing the Cado Cross-Account Policy

The Cado Cross-Account Policy includes permissions to acquire various AWS resources. You can customize it by removing permissions that are not needed for your use case:

• EC2 permissions are required to acquire EC2 systems.
• KMS permissions are needed for acquiring KMS-encrypted volumes.
• SSM permissions are necessary for triage captures.
• S3 permissions allow importing from S3 buckets in other accounts.
• CloudTrail permissions enable importing CloudTrail logs from other accounts.
• ECS permissions are required to import ECS containers.
• EC2 de-register permissions are needed for importing AMI images cross-account.

If you modify the Maximum session duration, note that the minimum currently supported by Cado is 1 hour.

Using an Existing IAM Role

If you prefer using an existing IAM role with proper resource access, update the trust relationship with the following JSON, replacing 111111111111 with the ID of your primary AWS account:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Principal": {
               "AWS": "111111111111"
           },
           "Action": "sts:AssumeRole",
           "Condition": {}
       }
   ]
}

You can further restrict this by specifying a specific Cado role rather than trusting the entire account. For more details, see the AWS documentation on IAM policy elements.