Minimum IAM permissions required for Spacelift AWS role

Last updated: September 22, 2026

When setting up Spacelift to manage AWS resources, you don't need to grant Administrator access to the IAM role. The minimum permissions required depend on your specific use case and the resources your Terraform configurations manage.

Baseline Requirements

The minimum baseline permissions include:

  • The role's trust policy must allow Spacelift to assume it. The permission policy itself needs only your state backend access and the actions for the resources your stacks manage.

  • Permissions for your Terraform state backend (if managing state yourself):

    • S3 read/write on the state object, plus kms:Decrypt and kms:GenerateDataKey if the bucket uses a customer-managed key. DynamoDB is only needed if you are still using DynamoDB-based locking, which is now deprecated in favour of S3 native lockfiles.

  • Policy generation requires an existing CloudTrail trail delivering to S3, and covers up to 90 days of activity. Note that iam:PassRole is not tracked by CloudTrail and will not appear in the generated policy, so add it manually wherever Terraform attaches a role to a resource. Also exercise an update and a destroy before generating, not only a create, otherwise the policy will fail on a later run.

Resource-Specific Permissions

Beyond the baseline, the required permissions depend on what AWS resources your Terraform stacks are creating or modifying. For example:

  • EC2-related actions if provisioning compute instances

  • RDS actions if creating databases

  • VPC actions if managing networking resources

Fine-Tuning Permissions

To determine the exact permissions needed for your use case:

  1. Generate a baseline policy from your Terraform plan using IAM Policy Autopilot (Terraform plan support). AWS describes the output as a baseline to refine rather than a finished policy.

  2. Start from that baseline, broadening it only where a run fails.

  3. Execute your Spacelift runs.

  4. Use IAM Access Analyzer policy generation to review which API calls were actually made.

  5. Progressively restrict the role based on actual usage.

This approach ensures you grant only the minimum permissions necessary while avoiding the security risks of overly broad Administrator access.