Connect an AWS account

Deploy the read-only role, run a scan, get your report.

Two steps, both in your control

Step 1 · Deploy the read-only role

A CloudFormation Quick-Create link, your external ID pre-filled. Creates one read-only IAM role.

Region to open AWS in

AWS shows the full template before you create the stack.

CloudFormation link ready

Deploy the stack in the account you want reviewed, then come back with its 12-digit account ID.

Open AWS CloudFormation

External ID: Generated after account sign-in
Template: View role template

See the exact read-only permissions

The stack attaches the AWS-managed ViewOnlyAccess policy (list/describe metadata only) plus the inline read policy below. No write, delete, stop/start, secrets, or object-data access.

What this can and cannot do

The role can

List and describe resource metadata
Read billing and CloudWatch cost signals
Check budgets, retention, and lifecycle settings

It can never

Delete, stop, resize, create, or change anything
Read S3 objects, databases, logs, or secrets
Act without the external ID unique to you

One IAM role you own; delete the stack anytime to revoke access. Findings are review candidates, not instructions. Every permission and why.

Create your free account

Two steps, both in your control

No scans yet

Findings