# Security and permissions | CUR enrichment reference
Source: https://greenpixie.com/docs/reference/cur-enrichment/security-and-permissions

The access model behind CUR enrichment.

## The access model [#the-access-model]

CUR enrichment only ever touches the storage you set up for it. Greenpixie is granted access to your nominated input and output buckets/containers and nothing else in your environment. We read billing data from the input directory and write enriched results to the output directory.

* Access is scoped to the specific buckets/containers you nominate
* Input-only storage can be granted read-only access
* You grant the access in your own environment, and you can revoke it at any time by removing the policy or role assignment

## How access is granted per platform [#how-access-is-granted-per-platform]

Each storage platform uses its native access mechanism; see the platform guides for the exact setup:

| Platform                                                                          | Mechanism                                                                                                | You grant                                                                                  |
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| [Amazon S3](/reference/cur-enrichment/s3-connection)                              | Bucket policy naming a dedicated Greenpixie IAM principal (one per data connection)                      | `s3:GetObject`, `s3:PutObject`, `s3:ListBucket` and multipart-upload actions on the bucket |
| [Azure Blob Storage](/reference/cur-enrichment/azure-blob-connection)             | A Local App Registration created in your tenant; Greenpixie authenticates with its client ID/secret      | Storage Blob Data Reader (input), plus Storage Blob Data Contributor for output            |
| [Google Cloud Storage](/reference/cur-enrichment/google-cloud-storage-connection) | A per-customer Greenpixie service account (`{customer-name}@client-data-access.iam.gserviceaccount.com`) | Storage Object Viewer (input) or Storage Object User (output) on the bucket                |

## Recommended storage settings [#recommended-storage-settings]

The platform guides include hardening settings as part of setup:

* **S3:** ACLs disabled and all public access blocked
* **Google Cloud Storage:** public access prevention enforced, uniform access control

## Revoking access [#revoking-access]

Remove the bucket policy statement (S3), the role assignments or the Local App Registration (Azure), or the service account's role on the bucket (GCS). Access stops immediately; no action from Greenpixie is required.

If you have questions about the access model or need to review it with your security team, contact your Greenpixie representative.