> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Upgrade Cloud Account Permissions

> Upgrade an onboarded Aviatrix PaaS cloud account from read-only to read-write permissions

This section describes how to upgrade a cloud account from read-only (limited)
to read-write (full) permissions.

When you onboard a cloud account with read-only (limited) permissions, Aviatrix
can discover and assess the resources in that account but cannot make changes to
your environment.

Upgrade the read-only (limited) account to read-write (full) permissions to
allow Aviatrix to perform further actions in the account, such as onboarding
VPCs or VNets, enabling egress, authoring Distributed Cloud Firewall rules, and
provisioning gateways.

The following table compares what Aviatrix can do in an account at each
permission level:

| Capability | Read-only (limited) | Read-write (full) |
| - | - | - |
| Discover networks, VPCs or VNets, and threats | Yes | Yes |
| Run security assessments and view insights | Yes | Yes |
| Onboard VPCs or VNets | No | Yes |
| Enable egress | No | Yes |
| Author Distributed Cloud Firewall rules | No | Yes |
| Provision gateways | No | Yes |
| Create Smart Groups | No | Yes |

Aviatrix recommends upgrading one cloud account at a time from the Cloud
Accounts list. The upgrade re-onboards the cloud account with a read-write role
and preserves the account's existing configuration.

<Note>
  Cloud account permission levels are not the same as user permissions.

  The cloud account permission level controls what Aviatrix can do in your cloud
  environment. User permissions control which console pages and actions a user can
  access.
</Note>

## Prerequisites

* An AWS or Azure cloud account that is already onboarded with read-only
  (limited) permissions. Upgrading permissions is supported for AWS and Azure
  accounts.

* Permission in the cloud account to create IAM roles and grant Aviatrix the
  required permissions using templates or scripts. Use the same onboarding
  method that you used to onboard the account:

  * For **AWS**, the Aviatrix CloudFormation template.
  * For **Azure**, the Aviatrix onboarding script (a command that you run in
    your cloud provider's shell, such as Azure Cloud Shell, which creates the
    roles and permissions Aviatrix needs).

  If you do not have this access, contact your cloud administrator.

* For an AWS organization, plan to upgrade every account that you onboarded in
  that organization.

## Upgrade a Cloud Account to Read-Write Permissions

To upgrade an onboarded account from read-only to read-write permissions, do the
following:

1. In the Aviatrix PaaS console, go to **Cloud Resources > Cloud Accounts**. A
   list of onboarded cloud accounts appears.

2. In the accounts list, find the account to upgrade. The **Permission Level**
   column identifies the accounts that currently have read-only permissions.

3. In that account's row, click **Upgrade**. The upgrade dialog appears.

4. Launch the read-write onboarding template or script for your cloud provider
   and run it in the cloud account to grant Aviatrix read-write permissions.

   Refer to
   [Onboard Your AWS Cloud Account](/docs/cloud/platform-administration/onboard-offboard/aws-cloud-account-onboard)
   and
   [Onboard Your Azure Cloud Account](/docs/cloud/platform-administration/onboard-offboard/azure-cloud-account-onboard)
   for more information.

   <Warning>
     In the AWS CloudFormation template, do not modify the AviatrixPrincipalArn.
     This is the IAM role owned by Aviatrix and permitted to assume the
     aviatrix-platform-app role.
   </Warning>

5. Return to the Aviatrix PaaS console. The account status changes while
   Aviatrix re-onboards the account with the new permissions.

6. Wait for the account status to return to ready. When the upgrade completes,
   the account's permission level shows read-write (full).

7. For an AWS organization, repeat these steps for each account that you
   onboarded in the organization.

<Note>
  You cannot downgrade an account from read-write back to read-only. To remove
  Aviatrix access from an account, offboard it. See [Offboard a Cloud
  Account](/docs/cloud/platform-administration/onboard-offboard/cloud-account-offboard).
</Note>

*Next Step*: Onboard your
[VPCs or VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.