Securitain Docs
On this page

Connect an AWS account

Connect an AWS account to Securitain using a customer-controlled, read-oriented cross-account IAM role.

Securitain does not require you to create or provide a permanent AWS access key and secret key. The recommended connection process uses AWS CloudFormation to establish the required trust and assessment permissions in your AWS account.

Before you begin

You need:

  • access to your Securitain organization
  • the AWS account you want to assess
  • sufficient AWS permission to deploy the Securitain CloudFormation stack or create the required role
  • permission within Securitain to manage AWS accounts

Connection overview

Securitain
  │
  │ Create connection
  ▼
CloudFormation configuration
  │
  ▼
Customer AWS Account
  │
  │ Creates customer-controlled
  │ assessment IAM role
  ▼
Securitain Audit Role
  ▲
  │ STS AssumeRole
  │ + External ID
  │
Securitain
Securitain creates a connection request, you deploy a CloudFormation stack in your account, and Securitain assumes the resulting role using STS with an External ID.

The IAM role exists inside your AWS account. You can inspect the role and its policies before completing the connection.

Connect an AWS account

  1. 1

    Add an AWS account

    From Securitain, open your AWS account management area and choose Add AWS Account. Securitain creates a connection request containing the information required to establish the cross-account relationship, including a unique External ID associated with the connection.

  2. 2

    Review the AWS configuration

    Securitain provides the CloudFormation-based setup for the connection. Before deploying it, you can review what the template creates and what AWS permissions are requested. The primary resource is a cross-account IAM role used by Securitain for security assessment.

    Where supported, additional assessment capabilities may provide context for areas such as IAM inventory, IAM authorization, credential security, service-last-accessed information, policy analysis, AWS Organizations, IAM Identity Center, AWS activity evidence and supported resource exposure analysis.

    The exact assessment capability available to an account depends on the permissions enabled for that connection.

  3. 3

    Deploy the role in AWS

    Launch the configuration in the AWS account you want Securitain to assess. AWS creates the Securitain audit role inside the customer account. The trust relationship allows the designated Securitain AWS principal to assume the role only according to the configured trust conditions, protected by an External ID.

  4. 4

    Complete the connection

    After the AWS role has been created, return to Securitain and complete the account registration process. Securitain validates the role by attempting to establish a temporary AWS STS session, then determines which assessment capabilities are available.

  5. 5

    Review connection status

    A successfully validated account becomes available for security assessment. See connection status below for what each state means.

  6. 6

    Run an assessment

    Once connected, run an IAM/security assessment. Securitain uses temporary credentials obtained through STS to collect the permitted security information, populating IAM Overview, Inventory, Findings, Credentials, Policies, Exposure, Escalation, the Relationship Graph, Governance and Reports.

What is an External ID?

Concept

An External ID is an additional value used when one AWS account assumes a role in another AWS account. It helps protect cross-account integrations from a class of issue commonly referred to as the confused deputy problem. Securitain uses a connection-specific External ID so that simply knowing the role ARN is not sufficient to establish the intended Securitain session.

Review connection status

Depending on the available AWS capabilities, the account can appear in states such as:

  • Connected — the required connection is available.
  • Degraded — the role can be assumed, but one or more expected assessment capabilities are unavailable. This does not necessarily mean the AWS account is insecure — it means some Securitain analysis may have incomplete coverage.
  • Failed — Securitain cannot establish the required AWS session or access the minimum information required for the assessment.

What Securitain can access

Securitain's AWS access is intended for security assessment, using read-oriented AWS operations to inspect identity and security configuration. Depending on enabled capabilities, Securitain can inspect information related to:

  • IAM — identities, roles, groups, policies, credential security and authorization relationships.
  • Organizations — organization and policy context where the connected account and AWS permissions allow it.
  • Identity Center — supported permission-set and assignment context.
  • Activity evidence — supported AWS activity information used to add context to security or least-privilege analysis.
  • Resource exposure — supported policy and security information for AWS resources used in exposure and identity-to-resource analysis.

What Securitain does not require

Connecting AWS does not require:

  • installing software on EC2 instances
  • deploying an agent into workloads
  • sharing IAM user access keys
  • sharing root credentials
  • granting Securitain automatic remediation authority

Securitain remediation is advisory unless a separately documented capability explicitly states otherwise.

Connection security

  • Temporary credentials — AWS STS issues temporary session credentials when Securitain assumes the customer role.
  • Customer-controlled role — the IAM role is created in and controlled from the customer's AWS account.
  • External ID protection — the trust relationship includes the External ID associated with the connection.
  • Auditable AWS activity — role assumption and supported AWS API activity can be reviewed through appropriate AWS logging controls.
  • Revocable access — the customer can disable or remove the AWS role to prevent future Securitain sessions.

Troubleshooting

Securitain cannot assume the role

  • the IAM role still exists
  • the configured role ARN is correct
  • the trust relationship allows the expected Securitain principal
  • the External ID has not been changed
  • organization-level restrictions are not blocking role assumption

Account shows degraded coverage

A degraded connection usually means Securitain can access the account but cannot access one or more additional sources required for complete analysis. Review the capability information shown for the account before interpreting missing results as a security pass.

A scan contains no IAM information

Confirm that the required IAM inventory capability is available and review the scan-status information for collection errors.

Next: IAM & Identity Overview →