Permissions

Every grant Helias asks for, on every provider. This is the page to send to whoever reviews access requests.

Everything below is read-only. Nothing Helias asks for can create, modify or delete a resource. The one action that is not purely a read is Google Cloud's roles/bigquery.jobUser, which creates query jobs against your billing export, covered below.

The AWS policies on this page are rendered from the CloudFormation templates that deploy into customer accounts, not transcribed from them, so they cannot fall out of step with what your account receives.

Amazon Web Services

A CloudFormation stack creates a read-only IAM role. Its trust policy names one principal and one condition:


Principal	The role belonging to your dedicated Helias environment
Action	`sts:AssumeRole`
Condition	`sts:ExternalId` must equal the External ID generated for your organization

The role carries AWS's own ViewOnlyAccess job-function policy, maintained by AWS, plus the inline policies below.

HeliasCostAndBilling

AllowHeliasBillingReadon *

aws-portal:ViewBilling
aws-portal:ViewUsage
account:GetAccountInformation
budgets:Describe*
budgets:View*
ce:Describe*
ce:Get*
ce:List*
cur:DescribeReportDefinitions
savingsplans:Describe*
savingsplans:List*
pricing:DescribeServices
pricing:GetAttributeValues
pricing:GetPriceListFileUrl
pricing:GetProducts
pricing:ListPriceLists
bcm-data-exports:GetExport
bcm-data-exports:GetTable
bcm-data-exports:ListExports
bcm-data-exports:ListTables

AllowHeliasOptimizationRecommendationson *

cost-optimization-hub:GetPreferences
cost-optimization-hub:GetRecommendation
cost-optimization-hub:ListEnrollmentStatuses
cost-optimization-hub:ListRecommendations
cost-optimization-hub:ListRecommendationSummaries
compute-optimizer:Describe*
compute-optimizer:Get*

HeliasOrganizationsRead

Allowon *

organizations:Describe*
organizations:List*

HeliasCloudWatchMetrics

Allowon *

cloudwatch:Get*

HeliasTrustedAdvisor

Allowon *

support:DescribeTrustedAdvisorChecks
support:DescribeTrustedAdvisorCheckResult
support:DescribeTrustedAdvisorCheckSummaries
support:DescribeTrustedAdvisorCheckRefreshStatuses

HeliasS3GetObjectDeny

DenyDenyS3ObjectReadOutsideCurBucketon everything except arn:aws:s3:::<HeliasCurBucketName>/*

s3:GetObject
s3:GetObjectAcl
s3:GetObjectVersion

AllowAllowS3ObjectReadInCurBucketon arn:aws:s3:::<HeliasCurBucketName>, arn:aws:s3:::<HeliasCurBucketName>/*

s3:GetObject
s3:GetObjectAcl
s3:ListBucket

Organization member accounts receive the same role without the actions below, because they own no report and no bucket:

bcm-data-exports:GetExport
bcm-data-exports:GetTable
bcm-data-exports:ListExports
bcm-data-exports:ListTables
s3:ListBucket

S3 access is denied everywhere except the report bucket

HeliasS3GetObjectDeny is an explicit deny on object reads across the whole account, with an allow scoped to the single bucket holding the Cost and Usage Report. An explicit deny cannot be overridden by any other policy, so the role cannot read an object anywhere else in the account even though ViewOnlyAccess is broad. On member accounts the deny has no exception at all.

See Amazon Web Services for how the role is deployed.

Microsoft Azure

A service principal in your own Microsoft Entra ID tenant, with no secret. The roles depend on the scope you connect.

Organization scope

Grant	Applies to	Why
`Enrollment Reader`	Billing account (Enterprise Agreement)	Reads enrollment cost and invoice data. Used when your agreement type is EA.
`Billing account reader`	Billing account (Microsoft Customer Agreement)	Reads billing profile cost and invoice data. Used when your agreement type is MCA.
`Monitoring Reader`	Tenant root management group	Reads resource metrics and usage across every subscription. This is what makes rightsizing analysis possible, and what covers new subscriptions as they appear.
`Reservations Reader`	/providers/Microsoft.Capacity	Reads your reservation orders, so commitment savings appear in your cost analysis.

Single subscription scope

Grant	Applies to	Why
`Billing Reader`	The subscription you connect	Reads consumption and cost detail for that subscription.
`Monitoring Reader`	The subscription you connect	Reads resource metrics and usage for that subscription.

Assigning a role at the tenant root requires a one-time User Access Administrator elevation, which the connect commands perform and then remove. See Microsoft Azure.

Google Cloud

Three grants to a service account provisioned for your organization alone. No service account key is created.

Grant	Applies to	Why
`roles/bigquery.jobUser`	The project hosting your billing export	Lets Helias run the cost queries that read your export. These jobs are billed to that project.
`roles/bigquery.dataViewer`	The billing export dataset	Lets Helias read the export itself. Scoped to that dataset, not the whole project.
`roles/viewer`	Your organization, or the billing-export project	Lets Helias map the projects behind the export. This is what turns spend into per-project attribution.

roles/browser is accepted in place of roles/viewer if your organization prefers something narrower for project mapping.

Query jobs are billed to your project

roles/bigquery.jobUser exists so Helias can run cost queries against your billing export. Those queries run in your project, so BigQuery bills them to you. Connect-time validation is a dry run and is not billed. See Google Cloud.

Cursor and Anthropic

Neither offers a keyless option, so both take an API key scoped to reading usage and cost.

Grant	Applies to	Why
`read:analytics`	Anthropic, your Claude organization	Reads usage and cost through the Enterprise Analytics API. It cannot call a model, change settings, or read message content.
`Admin`	Cursor, one team	Reads the team's spend and usage through the Admin API. The key is what identifies the team.

Each key passes through the onboarding app only in memory, is never written to our database and never appears in a log, and comes to rest only in the environment dedicated to your organization. Disconnecting deletes it.

What Helias never asks for

Root or global administrator credentials.
AWS access keys or secret keys.
Google Cloud service account JSON keys.
Azure client secrets or certificates.
Any password, MFA code or session token.
Write access of any kind, in any provider.

Security covers the credential model, what we store, and how to revoke.