:_mod-docs-content-type: ASSEMBLY
include::_attributes/attributes-openshift-dedicated.adoc[]
[id="rosa-cli-permission-examples"]
= Least privilege permissions for {rosa-cli} commands
:context: rosa-cli-permission-examples

toc::[]

[role="_abstract"]
Create AWS Identity and Access Management (IAM) roles that grant only the rights each user needs for {rosa-cli-first} tasks. The following examples use least privilege with the {rosa-cli}.

[IMPORTANT]
====
Although these policies and commands work together, other restrictions in your AWS environment might make these policies insufficient for your specific needs. Red{nbsp}Hat provides these examples as a baseline, assuming no other AWS Identity and Access Management (IAM) restrictions are present.
====

// Omitting from HCP build until BM gets to review
// [NOTE]
// ====
// The examples listed cover several of the most common {rosa-cli} commands. For more information regarding {rosa-cli} commands, see xref:../../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-common-commands_rosa-managing-objects-cli[Common commands and arguments].
// ====

// include::modules/rosa-cli-hcp-classic-examples.adoc[leveloffset=+1]
ifdef::openshift-rosa-hcp[]
include::modules/rosa-cli-hcp-examples.adoc[leveloffset=+1]
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa[]
include::modules/rosa-cli-classic-examples.adoc[leveloffset=+1]
endif::openshift-rosa[]
include::modules/rosa-cli-no-permissions-required.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_min-permissions-required"]
== Additional resources

* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html[IAM roles]
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[Policies and permissions in IAM]
