Skip to main content
Read-only. Xerg can only list and describe resources (functions, databases, buckets, queues, APIs, certificates, DNS zones, secret names) and read 30-day cost totals. It can’t read stored data or secret values, or change anything. Listing Lambda functions also returns their environment variables: Xerg drops them without storing them. Only admins and owners can connect services. See Connecting a service for where to find Connect, refreshing and disconnecting.

​
Permissions

The read-only user and the read-only role both get exactly these actions, and nothing else (the policy):
  • ec2:DescribeRegions
  • ec2:DescribeInstances
  • lambda:ListFunctions
  • rds:DescribeDBInstances
  • dynamodb:ListTables
  • ecs:ListClusters
  • ecs:DescribeClusters
  • sqs:ListQueues
  • acm:ListCertificates
  • ecr:DescribeRepositories
  • secretsmanager:ListSecrets
  • s3:ListAllMyBuckets
  • cloudfront:ListDistributions
  • route53:ListHostedZones
  • ce:GetCostAndUsage
  • apigateway:GET on arn:aws:apigateway:*::/apis and arn:aws:apigateway:*::/restapis

​
Connect

  1. Open AWS CloudShell in the account you want mapped (the >_ icon at the top of the AWS console).
  2. Paste the command Xerg shows you. It creates a role named XergReadOnly that only Xerg can use, and prints its ARN.
  3. Paste the ARN into Xerg. To revoke later, delete the xerg-readonly stack.
Xerg asks for: Role ARN.