Hi @ddddddO! 👋

Great suggestion, thank you for taking the time to report this! We've created an issue (#101) to enhance our documentation with IAM permission requirements.

Quick answer for now:

The AWS plugin uses the Cloud Control API for resource operations. While Cloud Control is a separate API from CloudFormation, AWS placed its IAM permissions in the cloudformation: namespace (e.g. cloudformation:ListResources)

For the full list of required permissions and example IAM policies, see the AWS Cloud Control API Security documentation.

Workaround for now:

If you don't need automatic discovery for the time being, you can disable it by creating a config file at ~/.config/formae/formae.conf.pkl:

amends "formae:/Config.pkl"
agent {
 discovery {
 enabled = false
 }
}