Permission for Scaling

Note

The role permissions may not update instantly. Changes may take 2-5 minutes to sync and apply.
For Azure:
- If the Resource Group of the Virtual Network is other than Kyvos, you must add custom roles with the required permissions, as mentioned below in the (Scaling Permissions) table. If Virtual Network is in the same Resource Group as Kyvos, no additional permission is required for scaling nodes as Azure Managed Identity has Contributor access rights to all resources of the given Resource Group.
- While creating a custom role, add the Resource IDs for the following services in the assignable scope:
  - Application Gateway
  - Virtual Network
  - Network Security Group
- Once the custom role is created, it must be assigned to each of the above-listed services.
- No permission is required for Query Engine disk increase and disk decrease.

Scaling Permissions

Functionality	AWS (IAM Role)	AZURE	GCP
Increase Node	ec2:GetLaunchTemplateData ec2:CreateLaunchTemplate ec2:RunInstances	Microsoft.Network/networkSecurityGroups/read Microsoft.Network/networkInterfaces/write Microsoft.Network/virtualNetworks/subnets/join/action Microsoft.Network/networkSecurityGroups/join/action NOTE: Applicable only when Virtual Network is in another Resource Group.	compute.subnetworks.use (applicable for Marketplace only when shared VPC is used) compute.instances.create compute.disks.create compute.disks.use compute.instances.setServiceAccount compute.instances.use
Decrease Node	ec2:DeleteLaunchTemplate ec2:TerminateInstances	Microsoft.Network/applicationGateways/write (applicable only for Web Portal) Microsoft.Network/networkSecurityGroups/read Microsoft.Network/networkInterfaces/write Microsoft.Network/virtualNetworks/subnets/join/action Microsoft.Network/networkSecurityGroups/join/action NOTE: Applicable only when Virtual Network is in another Resource Group.	compute.subnetworks.use (applicable for Marketplace only) compute.instances.delete compute.instances.detachDisk compute.disks.delete
Query Engine Increase Disk	ec2:CreateVolume ec2:AttachVolume ec2:ModifyInstanceAttribute ec2:DescribeVolumes	Contributor Access	compute.instances.get compute.disks.create compute.instances.attachDisk compute.disks.use compute.disks.setLabels
Query Engine Decrease Disk	ec2:DetachVolume ec2:DeleteVolume	Contributor Access	compute.instances.detachDisk compute.disks.delete
Load Balancer Entry Addition	TargetGroup elasticloadbalancing:DescribeTargetGroups elasticloadbalancing:RegisterTargets	Microsoft.Network/applicationGateways/write (applicable only for Web Portal)	Instance Group compute.instanceGroups.get compute.instanceGroups.update
Load Balancer Entry Deletion	Target Group elasticloadbalancing:DescribeTargetGroups elasticloadbalancing:DeregisterTargets	Microsoft.Network/applicationGateways/write (applicable only for Web Portal)	Instance Group compute.instanceGroups.get compute.instanceGroups.update
Health Check	Target Group Health Check Probe elasticloadbalancing:ModifyTargetGroup	Contributor Access	Instance Group Health Check compute.instanceGroups.get compute.instanceGroups.update

Read Also:

Managing Nodes and Services