S3

Requirements

Name	Description
Teleskope Role	Attach S3 read and/or write permissions to the Teleskope IAM role you created

---

1

Grant Teleskope Read Access to S3

Teleskope needs read access to scan and classify your data stored in S3.

For the standard setup, attach AmazonS3ReadOnlyAccess to the Teleskope IAM role you created. This grants read access across the account so Teleskope can discover and scan all buckets.

Terraform

resource "aws_iam_role_policy_attachment" "s3_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}

For SSE-KMS encrypted objects, the role also needs kms:Decrypt on the relevant KMS keys, with access allowed by the key policy. kms:GenerateDataKey is not required for ordinary object reads. See AWS SSE-KMS permissions.

Alternatively, create and attach the custom policy below. It includes account-wide reads and tagging permissions:

Optional: narrow permissions. Replace arn:aws:s3:::* and arn:aws:s3:::*/* below with the bucket and object ARNs you want to scan. Use the custom policy instead of AmazonS3ReadOnlyAccess, without another policy granting broader S3 access. Account-level discovery still lists bucket names across the account, but narrower access reduces scan coverage.

If tagging is not needed, you can remove s3:PutBucketTagging and s3:PutObjectTagging; tagging actions will then be unavailable.

Terraform

resource "aws_iam_policy" "teleskope_s3_policy" {
  name        = "TeleskopeS3Policy"
  description = "Policy to grant various read permissions for S3 resources."

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetBucketPolicyStatus",
          "s3:GetBucketPublicAccessBlock",
          "s3:GetLifecycleConfiguration",
          "s3:GetBucketTagging",
          "s3:GetInventoryConfiguration",
          "s3:GetBucketWebsite",
          "s3:GetBucketLogging",
          "s3:ListBucket",
          "s3:GetBucketVersioning",
          "s3:GetBucketAcl",
          "s3:GetBucketNotification",
          "s3:GetBucketPolicy",
          "s3:GetReplicationConfiguration",
          "s3:GetBucketObjectLockConfiguration",
          "s3:GetEncryptionConfiguration",
          "s3:PutBucketTagging",
          "s3:GetBucketCORS",
          "s3:GetBucketLocation"
        ]
        Resource = "arn:aws:s3:::*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetObjectAcl",
          "s3:GetObject",
          "s3:GetObjectTagging",
          "s3:PutObjectTagging",
          "s3:GetObjectVersion"
        ]
        Resource = "arn:aws:s3:::*/*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetAccountPublicAccessBlock",
          "s3:ListAllMyBuckets",
          "s3:GetBucketInventoryConfiguration"
        ]
        Resource = "*"
      }
    ]
  })
}

2

Grant Teleskope Read & Write Access to S3 (Optional)

Grant only the write actions required by the remediation policies you enable, scoped to their target buckets and objects. For example, tagging uses s3:PutBucketTagging or s3:PutObjectTagging. Scanning does not require these permissions.

AmazonS3FullAccess is a broad alternative when full S3 access is approved; it is not required for scanning:

Terraform

resource "aws_iam_role_policy_attachment" "s3_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}

Inventory Reports (optional)

We highly recommend enabling inventory reports on your buckets. Teleskope could use those reports to efficiently list objects and reduce cost on your cloud. When enabling inventory reports, please make sure to add the following fields:

1. Bucket

2. Key

3. Size

4. Last Modified Date

5. Storage Class