Amazon Web Services

Purpose

The AWS connector assumes a read-only cross-account IAM role to inventory EC2 instances, security groups, IAM configuration and public exposure across one or more AWS accounts, without requiring long-lived access keys.

Requirements

• An AWS account (or AWS Organizations management account for multi-account setups)
• Ability to create an IAM role with a trust policy for cross-account access
• AWS Config or Security Hub enabled, optionally, for richer compliance evidence

Permissions

• A managed policy equivalent to ReadOnlyAccess, or a scoped policy covering ec2:Describe*, iam:Get*/List*, s3:GetBucketPolicy/GetBucketAcl, and config:Get*/Describe* actions
• sts:AssumeRole trust relationship scoped to AssurIQ's external account ID and a unique external ID

Setup

1. 1
   Create the cross-account IAM role

   Create an IAM role with a trust policy that allows AssurIQ's AWS account to assume it, using the external ID AssurIQ provides.
2. 2
   Attach a read-only policy

   Attach ReadOnlyAccess or an equivalent scoped read-only policy to the role.
3. 3
   Provide the role ARN to AssurIQ

   In Integrations, enter the role ARN and external ID; no access keys are needed.
4. 4
   Enable for additional accounts

   For AWS Organizations, repeat the role creation via StackSet or a single management-account role with organization read access.
5. 5
   Verify inventory

   Confirm EC2 instances, security groups and IAM users populate under Asset Inventory and Attack Surface.

Verification

• AWS accounts and regions appear with resource counts in Asset Inventory
• Security group rules and public-facing EC2/ELB resources populate under Attack Surface
• IAM user and role inventory populates under Identity Security

Data collected

• EC2, S3, RDS and VPC resource inventory
• Security group and network ACL rules, including public exposure
• IAM users, roles, policies and access key age
• AWS Config/Security Hub findings, where enabled

Security model

AssurIQ never stores long-lived AWS access keys; it assumes a cross-account role using STS with an external ID, and that role is restricted to read-only actions. Assumed sessions are temporary and expire automatically, and AssurIQ cannot create, modify or delete any AWS resource.

Common errors

• AIQ-INT-001Integration disconnected
  The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

• If only the management account's own resources appear, confirm member-account roles were created for every account you want inventoried.
• If IAM data looks incomplete, confirm the attached policy includes iam:Get*/List* actions.

Disconnect

1. Disconnect AWS from AssurIQ Integrations.
2. Delete the cross-account IAM role, or remove AssurIQ's account ID and external ID from its trust policy.