// Module included in the following assemblies:
//
// * installing/installing_aws/installing-aws-account.adoc

:_mod-docs-content-type: REFERENCE
[id="installation-aws-permissions-iam-roles_{context}"]
= Default permissions for IAM instance profiles

[role="_abstract"]
To ensure your cluster operates with the correct security permissions in {product-title}, review the default IAM instance profiles created by the installation program.

By default, the installation program creates IAM instance profiles for the bootstrap, control plane, and compute instances with the necessary permissions for the cluster to operate.

The following list specifies the default IAM role permissions for control plane instance profiles:

* `ec2:AttachVolume`
* `ec2:AuthorizeSecurityGroupIngress`
* `ec2:CreateSecurityGroup`
* `ec2:CreateTags`
* `ec2:CreateVolume`
* `ec2:DeleteSecurityGroup`
* `ec2:DeleteVolume`
* `ec2:Describe*`
* `ec2:DetachVolume`
* `ec2:ModifyInstanceAttribute`
* `ec2:ModifyVolume`
* `ec2:RevokeSecurityGroupIngress`
* `elasticloadbalancing:AddTags`
* `elasticloadbalancing:AttachLoadBalancerToSubnets`
* `elasticloadbalancing:ApplySecurityGroupsToLoadBalancer`
* `elasticloadbalancing:CreateListener`
* `elasticloadbalancing:CreateLoadBalancer`
* `elasticloadbalancing:CreateLoadBalancerPolicy`
* `elasticloadbalancing:CreateLoadBalancerListeners`
* `elasticloadbalancing:CreateTargetGroup`
* `elasticloadbalancing:ConfigureHealthCheck`
* `elasticloadbalancing:DeleteListener`
* `elasticloadbalancing:DeleteLoadBalancer`
* `elasticloadbalancing:DeleteLoadBalancerListeners`
* `elasticloadbalancing:DeleteTargetGroup`
* `elasticloadbalancing:DeregisterInstancesFromLoadBalancer`
* `elasticloadbalancing:DeregisterTargets`
* `elasticloadbalancing:Describe*`
* `elasticloadbalancing:DetachLoadBalancerFromSubnets`
* `elasticloadbalancing:ModifyListener`
* `elasticloadbalancing:ModifyLoadBalancerAttributes`
* `elasticloadbalancing:ModifyTargetGroup`
* `elasticloadbalancing:ModifyTargetGroupAttributes`
* `elasticloadbalancing:RegisterInstancesWithLoadBalancer`
* `elasticloadbalancing:RegisterTargets`
* `elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer`
* `elasticloadbalancing:SetLoadBalancerPoliciesOfListener`
* `kms:DescribeKey`

The following list specifies the default IAM permissions for compute instance profiles:

* `ec2:DescribeInstances`
* `ec2:DescribeRegions`
