August 2026 release is live Read More
Breadcrumbs

Step 3: Create Role / IAM User

Mavvrik supports both types of AWS authentications,

  1. Roles

  2. Users

Role-based access is generally considered to be more secure than user-based access, as it allows organizations to control access to resources and functions based on defined roles and responsibilities. We recommend using roles over individual users whenever possible

Roles

  1. Search IAM and Navigate to IAM dashboard

AWS IAM dashboard
AWS IAM dashboard

  1. Click on Roles from the left menu options and Click on Create Role

IAM Roles page with the Create role button
IAM Roles page with the Create role button

  1. Select Custom trust policy

  2. Copy the following trust policy JSON:

    JSON
    {
  "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["sts:AssumeRole"],
        "Principal": {
          "AWS": [
            "arn:aws:iam::911403356698:user/global-user-for-assume-role",
            "arn:aws:iam::911403356698:user/mavvrik-svc-user",
            "arn:aws:iam::911403356698:role/mavvrik-svc-role"
          ]
        },
        "Condition": {
          "StringEquals": {
            "sts:ExternalId": "<TENANT-ID>"
          }
        }
      }
    ]
}

  3. Paste the copied JSON in Custom trust policy editor

  4. Remove <TENANT-ID>

Tenant ID placeholder in the trust policy
Tenant ID placeholder in the trust policy

  1. Enter your tenant id as shown image. To get the tenant id to follow instructions,

    1. Login to Mavvrik

    2. From the side menu, select API under the Admin section

    3. Capture the Tenant ID8.

  1. Click Next and don't select any permissions

Enter the role name with prefix 'Mavvrik-' e.g: Mavvrik-rolename

  1. Enter the Role name and click Create role.

Create role page with the role name
Create role page with the role name

  1. A new role should be created and displayed in the list.

  2. Click on the newly created Role which is navigated to the below page

Newly created IAM role details
Newly created IAM role details

  1. Click on Add Permissions -> Create Inline Policy under Permissions Tab

  2. Click on JSON tab & replace existing JSON with the below JSON

Use any one of the policies mentioned. The first policy grants broader IAM permissions (Resource: *) and includes CUR actions (cur:Get*, cur:ValidateReportDestination, cur:Describe*). The second scopes the IAM permissions to a specific role ARN instead of a wildcard.

  1. Option 1 — Broader IAM role permissions policy. Replace <BUCKET_NAME> on lines 11 & 12 with the name of the bucket captured in Step 1: Enable CUR & Cost Explorer

    JSON
    { 
   "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        },
        {
     "Effect": "Allow",
     "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
      ],
     "Resource": "*"
}
    ]
}

Option 2 — Scoped IAM role permissions policy:

JSON
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

  1. Click Next and Enter Policy, Name it & Click Create policy

Create inline policy page
Create inline policy page

  1. After creating policy below page is displayed. Capture ARN of the role from the summary section for the next steps.

IAM role ARN in the role summary
IAM role ARN in the role summary

Users

This step is not required if you have created a Role.

  1. Search IAM, Navigate to IAM dashboard and Click Users

IAM Users page
IAM Users page

  1. Click Add Users, Enter name of your choice

Create user page
Create user page

  1. Skip permissions for now. Keep doing Next & finally Create User.

  2. Click the User you have created & click on Security credentials.

  3. Scroll down & click on Create access key

  4. Select Others & click on next

Access key use-case selection
Access key use-case selection

  1. Click on Create Access Key

  2. Capture Access key & Secret access key which is used in subsequent steps.

  3. Click Done

Generated access key and secret access key
Generated access key and secret access key

  1. Navigate to the details of the user we just created

IAM user details page
IAM user details page

  1. Click Create Inline Policy under Permissions Tab & Click on JSON tab & replace existing JSON with the below JSON

Use any one of the policies mentioned. The first policy grants broader IAM permissions (Resource: *) and includes CUR actions (cur:Get*, cur:ValidateReportDestination, cur:Describe*). The second scopes the IAM permissions to a specific role ARN instead of a wildcard, and does not include the CUR actions.

  1. Option 1 — Broader IAM user permissions policy. Replace <BUCKET_NAME> on lines 11 & 12 with the name of the bucket captured in Step 1: Enable CUR & Cost Explorer

    JSON
    { 
   "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:ListAccounts",
                "organizations:DescribeAccount"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        },
        {
     "Effect": "Allow",
     "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
      ],
     "Resource": "*"
}
    ]
}

Option 2 — Scoped IAM user permissions policy:

JSON
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

  1. Review the policy & click create

Inline policy review and creation
Inline policy review and creation