{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":28984,"path":"it-operations-management/cloud-account-management/about-aws-api-permissions.md","title":"About Amazon Web Services API permissions","bundle":null,"doc_type":null,"release":"australia","body":"\n# About Amazon Web Services API permissions\n\nCloud Account Management interacts with Amazon Web Services to create and manage subscription accounts.\n\n**Note:** You must establish an AWS service account for Cloud Account Management that is separate from the account for Cloud Discovery.\n\nThe following API permissions are required to start a new subscription account in AWS:\n\n-   budgets: CreateBudgetAction\n-   budgets: DescribeBudgetAction\n-   budgets: ModifyBudget\n-   budgets: ViewBudget\n-   organizations: AttachPolicy\n-   organizations: CreateAccount\n-   organizations: CloseAccount\n-   organizations: DescribeAccount\n-   organizations: DescribePolicy\n-   organizations: DescribeOrganization\n-   organizations: DescribeOrganizationalUnit\n-   organizations: DescribeCreateAccountStatus\n-   organizations: ListRoots\n-   organizations: ListAccounts\n-   organizations: ListTagsForResource\n-   organizations: ListAWSServiceAccessForOrganization\",\n-   organizations: ListAccounts\n-   organizations: ListParents\n-   organizations: ListOrganizationalUnitsForParent\n-   organizations: MoveAccount\n-   organizations: TagResource\n-   iam: GetAccountSummary\n-   sts: AssumeRole\n\n**Note:**\n\nFor more details on API permissions, download the [Cloud Discovery REST API permissions spreadsheet](https://downloads.docs.servicenow.com/resource/enus/api/servicenow-discovery-patterns-api-details.xlsx) so you can research and grant the user permissions required for running the discovery process.\n\n"}}