Skip to main content

Connect AWS to StackGuardian

Overview​

StackGuardian provides three main approaches for authenticating your workloads or running discovery against an AWS account:

RBAC​

This method uses cross-account IAM role assumption with an External ID. It is the recommended approach for securely granting StackGuardian access to your AWS account without storing long-lived credentials.

1. Create an IAM Role in AWS​

  1. Sign in to the AWS Management Console and navigate to IAM → Roles → Create role.
  2. Select Custom trust policy as the trusted entity type.
  3. Replace the contents of the trust policy editor with the following, substituting your own External ID: 
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": [
              "arn:aws:iam::476299211833:root",
              "arn:aws:iam::163602625436:root"
            ]
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "<org-name>:<random-string>"
            }
          }
        }
      ]
    }
    The External ID must follow the format <org-name>:<random-string> — for example, myorg:abc12345.
  4. Click Next and assign the required permissions policy:
    • For discovery/read-only access: attach ReadOnlyAccess
    • For deployment access: attach permissions tailored to the resources StackGuardian will manage
  5. Give the role a descriptive name such as StackGuardianIntegrationRole, then click Create Role.
  6. Copy the Role ARN — you will need it in the next step.

2. Create the Connector in StackGuardian​

  1. In StackGuardian, navigate to Organization settings → Connectors → Cloud providers.
  2. Click Connect with Cloud Provider.
  3. Add a Connector name.
  4. Input the AWS role ARN and External ID from Step 1.
  5. Select the Active regions.
  6. Click Connect & scan to finalize the connector.
Create RBAC connector

Create RBAC connector

This method uses OpenID Connect (OIDC) federation to allow StackGuardian to authenticate to AWS using temporary credentials — no long-lived secrets required.

important

For US Region, use https://api.us.stackguardian.io as Provider URL and Audience.

1. Create an OIDC Identity Provider in AWS​

  1. In the AWS Management Console, go to IAM → Identity Providers → Add provider.
  2. Select OpenID Connect as the provider type.
  3. Enter the Provider URL and Audience based on your region:
    • For EU Region: https://api.app.stackguardian.io
    • For US Region: https://api.us.stackguardian.io
  4. Click Add provider.

2. Create an IAM Role for the OIDC Provider​

  1. In IAM → Roles → Create role, select Web Identity as the trusted entity type.
  2. Choose the identity provider you just created
    • For EU Region: https://api.app.stackguardian.io
    • For US Region: https://api.us.stackguardian.io
  3. Select the audience:
    • For EU Region: https://api.app.stackguardian.io
    • For US Region: https://api.us.stackguardian.io
  4. Assign the required permissions:
    • For discovery/read-only access: attach ReadOnlyAccess
    • For deployment access: attach the least permissions required for your use case
  5. Name the role and click Create Role.
  6. Copy the Role ARN — you will need it for the final step.

3. Update the Trust Policy​

Navigate to your newly created role → Trust relationships → Edit trust policy and apply the following, replacing the placeholder values:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:oidc-provider/api.app.stackguardian.io"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "api.app.stackguardian.io:aud": "https://api.app.stackguardian.io"
        },
        "StringLike": {
          "api.app.stackguardian.io:sub": "/orgs/<YOUR_SG_ORG>"
        }
      }
    }
  ]
}
  • Replace <YOUR_AWS_ACCOUNT_ID> with your AWS account ID.
  • Replace <YOUR_SG_ORG> with your StackGuardian organization name.

4. Create the Connector in StackGuardian​

  1. In StackGuardian, navigate to Organization settings → Connectors → Cloud providers.
  2. Click Connect with Cloud Provider.
  3. Add a Connector name.
  4. Input the AWS role ARN from Step 2.
  5. Click Connect & scan to finalize the connector.
Create OIDC connector

Create OIDC connector

Multiple connectors​

You can connect multiple AWS accounts at once instead of creating individual connectors — ideal for organizations managing large numbers of accounts.

1. Begin multiple connectors setup​

  1. Log in to the StackGuardian Platform and navigate to Organization settings → Connectors → Cloud providers.
  2. Click Connect with Cloud Provider.
  3. In the connectors modal, select Multiple.
Create multiple connectors

Create multiple connectors

  1. Enter a Connector group name.
  2. Provide the AWS role ARN and External ID for the management role. Ensure the External ID matches the format <org-name>:<random-string> or <org-name>-<random-string>
  3. Click Next.

2. Select AWS accounts​

  1. Use the Select accounts dropdown to select individual accounts or All accounts. The list will include each account's Email and Account ID.
  2. Click Next.
Select AWS accounts

Select AWS accounts

3. Configure default settings and individual accounts​

  1. Under Default settings, set the IAM role name, External ID, and the Active regions — these apply to all connected accounts.
  2. Under Accounts settings, fill in the following for each account:
    • AWS role ARN — the role ARN for that account
    • External ID — the external ID associated with the role
    • Active regions
  3. Click Connect & scan to complete the setup.
Configure default settings and individual accounts

Configure default settings and individual accounts