Permission for Scaling

This section lists the permissions required for supporting scaling of individual functionality (i.e. increase or decrease of nodes and disk). By default, these permissions don’t exist in the created role if the role is not created by enabling scaling permissions (scaling aware manner). Thus in each such environment where scaling is not enabled (either for complete scaling or for specific scaling functionality) at any time earlier than before the need to use that functionality, the role must include the permissions required for using that functionality.

Note

  • To fetch the Application Gateway from the different resource group.

    • Microsoft.Network/applicationGateways/read

  • The role permissions may not update instantly. Changes may take 2-5 minutes to sync and apply.

  • For Azure:

    • If the Resource Group of the Virtual Network is other than Kyvos, you must add custom roles with the required permissions, as mentioned below in the (Scaling Permissions) table. If Virtual Network is in the same Resource Group as Kyvos, no additional permission is required for scaling nodes as Azure Managed Identity has Contributor access rights to all resources of the given Resource Group.

    • While creating a custom role, add the Resource IDs for the following services in the assignable scope:

      • Application Gateway

      • Virtual Network

      • Network Security Group

    • Once the custom role is created, it must be assigned to each of the above-listed services.

    • No permission is required for Query Engine disk scaling.

Scaling Permissions

 Functionality

AWS (IAM Role)

AZURE

GCP

Increase Node

ec2:GetLaunchTemplateData
ec2:CreateLaunchTemplate
ec2:RunInstances

  • Microsoft.Network/networkSecurityGroups/read

  • Microsoft.Network/networkInterfaces/write

  • Microsoft.Network/virtualNetworks/subnets/join/action

  • Microsoft.Network/networkSecurityGroups/join/action

NOTE: Applicable only when Virtual Network is in another Resource Group.

compute.subnetworks.use
(applicable for Marketplace only when shared VPC is used)

compute.instances.create
compute.disks.create
compute.disks.use
compute.instances.setServiceAccount
compute.instances.use

Decrease Node

ec2:DeleteLaunchTemplate
ec2:TerminateInstances

  • Microsoft.Network/applicationGateways/write
    (applicable only for Web Portal)

  • Microsoft.Network/networkSecurityGroups/read

  • Microsoft.Network/networkInterfaces/write

  • Microsoft.Network/virtualNetworks/subnets/join/action

  • Microsoft.Network/networkSecurityGroups/join/action

NOTE: Applicable only when Virtual Network is in another Resource Group.

compute.subnetworks.use
(applicable for Marketplace only)

compute.instances.delete
compute.instances.detachDisk
compute.disks.delete

Query Engine
Increase Disk

ec2:CreateVolume
ec2:AttachVolume
ec2:ModifyInstanceAttribute
ec2:DescribeVolumes

 Contributor Access

compute.instances.get

compute.disks.create

compute.instances.attachDisk

compute.disks.use

compute.disks.setLabels

Query Engine

Decrease Disk

ec2:DetachVolume
ec2:DeleteVolume

  Contributor Access

compute.instances.detachDisk
compute.disks.delete

Load Balancer Entry Addition

TargetGroup

elasticloadbalancing:DescribeTargetGroups

elasticloadbalancing:RegisterTargets

 Microsoft.Network/applicationGateways/write
(applicable only for Web Portal)

 Instance Group

compute.instanceGroups.get
compute.instanceGroups.update

Load Balancer Entry Deletion

Target Group

elasticloadbalancing:DescribeTargetGroups

elasticloadbalancing:DeregisterTargets

 Microsoft.Network/applicationGateways/write

(applicable only for Web Portal)

 Instance Group

compute.instanceGroups.get
compute.instanceGroups.update

Health Check

 

Target Group Health Check Probe

elasticloadbalancing:ModifyTargetGroup 

  Contributor Access

Instance Group Health Check

compute.instanceGroups.get
compute.instanceGroups.update

Read Also:

Managing Nodes and Services

Copyright Kyvos, Inc. 2026. All rights reserved.