--- title: Cost Optimization AWS Permissions for StratusGrid Engineers description: Describes the AWS IAM permissions used by StratusGrid cloud engineers to perform cost optimization assessment and remediation. image: https://stratusgrid.com/hubfs/AI-Generated%20Media/Images/Photo%20of%20a%20person%20working%20at%20an%20office%20desk%20with%20a%20desktop%20computer%20and%20multiple%20monitors%20The%20screens%20show%20cloud%20cost%20optimization%20work%20being%20done.jpeg --- # Cost Optimization AWS Permissions for StratusGrid Engineers Describes the AWS IAM permissions used by StratusGrid cloud engineers to perform cost optimization assessment and remediation. [ Trevor Sullivan ](https://stratusgrid.com/knowledge-base/author/trevor-sullivan) Jul 14, 2025 #### Other blogs you may be interested in: [ How to Audit Amazon DynamoDB Table Access ](https://stratusgrid.com/knowledge-base/how-to-audit-dynamodb-table-access-stratusphere) [ How to Remediate Over-provisioned AWS Lambda Functions with Stratusphere™ FinOps ](https://stratusgrid.com/knowledge-base/remediate-over-provisioned-aws-lambda-functions-stratusphere) [ How to Remediate AWS EC2 Instances Consolidation for Microsoft SQL Server with Stratusphere™ FinOps ](https://stratusgrid.com/knowledge-base/remediating-aws-ec2-instances-consolidation-for-microsoft-sql-server) ### Need additional support? ### Subscribe ![](https://stratusgrid.com/hubfs/AI-Generated%20Media/Images/Photo%20of%20a%20person%20working%20at%20an%20office%20desk%20with%20a%20desktop%20computer%20and%20multiple%20monitors%20The%20screens%20show%20cloud%20cost%20optimization%20work%20being%20done.jpeg) During StratusGrid's success-based cost optimization projects, StratusGrid engineers required AWS read-only permissions for the assessment phase. After the assessment and customer approval of a remediation plan, additional AWS write permissions will be required by engineers. ## CloudFormation templates for StackSet deployment. The CloudFormation templates may be deployed to standalone AWS accounts, or to AWS accounts that belong to either an organization or a specific organizational unit (OU). When deployed in an organization, the CloudFormation templates must be deployed in the management account of an AWS organization. These create resources in all AWS accounts that belong to either an organization or a specific organizational unit (OU). - sg-restricted-read-only.json: this CloudFormation template creates an IAM role with restricted read-only permissions for the assessment phase of cost optimization projects. - sg-restricted-power-user.json: this CloudFormation template creates an IAM role with restricted power-user permissions for the remediation phase of cost optimization projects. ## AWS Cloudformation StackSet creation instructions The below instructions are for deploying the Stackset in a management account. For individual accounts, you can simply deploy the template as an individual stack. - Navigate to the **AWS Console** and log in to your AWS Organization **Management Account**. - Switch to the **region** where you want to deploy the StackSet. - Go to the **CloudFormation** section of the AWS Console and select StackSets. - Click **Create StackSet**.  - Select Upload a template file, click Choose file, and select sg-restricted-read-only.json. Click Next  - Enter the StackSet name, for instance, StratusGrid-IAM-ReadOnly. Click Next. - Scroll to the bottom of the page. Check to acknowledge that IAM role resources are being created, then click Submit.  - Enter the **AWS Organization Root ID**. The resource being created is an IAM role, and IAM is a global service; however, a region must be specified. **Select the region** where you are creating the StackSet, then click **Next**. - Scroll to the bottom of the page, then click **Submit**. - The StackSet will then deploy! ### Write Permissions Repeat the CloudFormation stackset creation process for template sg-restricted-power-user.json ## Similar posts ### [How to Audit Amazon DynamoDB Table Access](https://stratusgrid.com/knowledge-base/how-to-audit-dynamodb-table-access-stratusphere) Enable AWS CloudTrail audit logging for DynamoDB. Optimize performance & costs by tracking application access & monitoring logs with CloudWatch. Trevor Sullivan May 13, 2024 ### [How to Remediate Over-provisioned AWS Lambda Functions with Stratusphere™ FinOps](https://stratusgrid.com/knowledge-base/remediate-over-provisioned-aws-lambda-functions-stratusphere) Optimize your AWS Lambda functions by uncovering over-provisioning with Stratusphere™ FinOps by StratusGrid. Ensure cost efficiency and performance... Stratusphere's AWStronaut Mar 8, 2024 ### [How to Remediate AWS EC2 Instances Consolidation for Microsoft SQL Server with Stratusphere™ FinOps](https://stratusgrid.com/knowledge-base/remediating-aws-ec2-instances-consolidation-for-microsoft-sql-server) Learn how to optimize your Microsoft SQL Server instances on AWS with our consolidation guide. Save on licensing costs and enhance performance now! Stratusphere's AWStronaut Mar 12, 2024 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Trevor Sullivan", "url" : "https://stratusgrid.com/knowledge-base/author/trevor-sullivan" }, "dateModified" : "2025-07-14T16:44:46.774Z", "datePublished" : "2025-07-14T16:42:29.000Z", "headline" : "Cost Optimization AWS Permissions for StratusGrid Engineers", "image" : [ "https://stratusgrid.com/hubfs/AI-Generated%20Media/Images/Photo%20of%20a%20person%20working%20at%20an%20office%20desk%20with%20a%20desktop%20computer%20and%20multiple%20monitors%20The%20screens%20show%20cloud%20cost%20optimization%20work%20being%20done.jpeg" ], "mainEntityOfPage" : { "@id" : "https://stratusgrid.com/knowledge-base/cost-optimization-aws-permissions-for-stratusgrid-engineers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://stratusgrid.com/hubfs/Vertical%20Black.png" }, "name" : "StratusGrid" } } ``` ```json { "@context" : "https://schema.org/", "@type" : "Product", "aggregateRating" : { "@type" : "AggregateRating", "bestRating" : "5", "ratingCount" : "1", "ratingValue" : "5", "reviewCount" : "1", "worstRating" : "0" }, "brand" : { "@type" : "Brand", "name" : "StratusGrid" }, "description" : "StratusGrid, a premier AWS Consulting Partner, specializes in AWS cloud migration, modernization, stabilization, and cloud cost optimization services.", "image" : "https://stratusgrid.com/", "name" : "StratusGrid", "review" : { "@type" : "Review", "author" : { "@type" : "Person", "name" : "G2" }, "datePublished" : "2024-01-21", "name" : "G2 User", "publisher" : { "@type" : "Organization", "name" : "G2" }, "reviewBody" : "Great Customer Service and Extremely Knowledgable Team", "reviewRating" : { "@type" : "Rating", "bestRating" : "5", "ratingValue" : "5", "worstRating" : "0" } } } ```