> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an AWS Account to InfraAudit

> Create an IAM policy and user or role, enter your credentials in InfraAudit, and start syncing EC2, S3, RDS, Lambda, and billing data.

InfraAudit connects to AWS using IAM credentials and discovers resources across all enabled regions in your account. Once connected, it monitors EC2 instances, S3 buckets, RDS instances, Lambda functions, CloudFront distributions, VPCs, security groups, and billing data from Cost Explorer.

## Credential options

InfraAudit supports three ways to authenticate with AWS. All three require the same IAM policy — they differ only in how credentials are stored and rotated.

<AccordionGroup>
  <Accordion title="Option 1: IAM user access keys (simplest)">
    Create a dedicated IAM user with read-only permissions and generate a long-lived access key pair.

    <Steps>
      <Step title="Create an IAM user">
        In the AWS console, go to **IAM → Users → Create user**. Give the user a descriptive name such as `infraudit-reader`.
      </Step>

      <Step title="Attach the InfraAudit policy">
        Attach the policy from the [Required IAM policy](#required-iam-policy) section below, either directly or via a policy attached to a group.
      </Step>

      <Step title="Generate an access key">
        Go to **Security credentials → Create access key**. Choose **Other** as the use case. Copy the **Access Key ID** and **Secret Access Key** — you'll need both when connecting.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Option 2: IAM role with AssumeRole (recommended for production)">
    Create an IAM role that InfraAudit can assume. This avoids long-lived user credentials.

    <Steps>
      <Step title="Create the IAM role">
        In the AWS console, go to **IAM → Roles → Create role**. Set the trust policy to allow your InfraAudit service account or IAM user to call `sts:AssumeRole`.
      </Step>

      <Step title="Attach the InfraAudit policy">
        Attach the policy from the [Required IAM policy](#required-iam-policy) section to the role.
      </Step>

      <Step title="Note the role ARN">
        Copy the role ARN (format: `arn:aws:iam::123456789012:role/infraudit-reader`). Pass it when connecting.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Option 3: IAM Identity Center (SSO)">
    For organizations using AWS IAM Identity Center (formerly SSO), use the SSO portal to generate temporary credentials and pass them to InfraAudit. Temporary credentials expire, so you'll need to refresh them periodically.
  </Accordion>
</AccordionGroup>

## Required IAM policy

Attach this policy to the IAM user or role InfraAudit will use. All actions are read-only.

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InfraAuditReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeRegions",
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:GetBucketEncryption",
        "s3:GetBucketVersioning",
        "s3:GetBucketPublicAccessBlock",
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters",
        "lambda:ListFunctions",
        "lambda:GetFunctionConfiguration",
        "cloudfront:ListDistributions",
        "iam:GetAccountPasswordPolicy",
        "iam:ListUsers",
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetDimensionValues"
      ],
      "Resource": "*"
    }
  ]
}
```

If you also want to enable vulnerability scanning of EC2 instances, add these two actions to the statement above:

```json theme={null}
"ec2:DescribeImages",
"ec2:DescribeSnapshots"
```

## Connect your AWS account

<Tabs>
  <Tab title="UI">
    <Steps>
      <Step title="Open the connection dialog">
        In the sidebar, click **Cloud Providers → Connect AWS**.
      </Step>

      <Step title="Enter your credentials">
        Fill in:

        * **Access Key ID**
        * **Secret Access Key**
        * **Region** — the primary region for API calls (resources in other regions are also discovered automatically)
        * **Display name** — a label for this account in the InfraAudit UI
      </Step>

      <Step title="Connect">
        Click **Connect**. InfraAudit validates the credentials and starts an initial resource sync.
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    infraudit provider connect aws
    # Access Key ID: AKIA...
    # Secret Access Key: ••••••••
    # Region [us-east-1]: us-east-1
    # Display name: Production
    ```

    Or pass all values as flags:

    ```bash theme={null}
    infraudit provider connect aws \
      --access-key-id AKIAIOSFODNN7EXAMPLE \
      --secret-access-key "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" \
      --region us-east-1 \
      --name "Production"
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST http://localhost:8080/api/v1/providers/aws/connect \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "name": "Production",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
        "region": "us-east-1"
      }'
    ```
  </Tab>
</Tabs>

## What gets synced

After connecting, InfraAudit discovers and continuously monitors the following resource types:

| Resource type            | Internal type name        |
| ------------------------ | ------------------------- |
| EC2 instances            | `ec2_instance`            |
| S3 buckets               | `s3_bucket`               |
| RDS instances            | `rds_instance`            |
| RDS clusters             | `rds_cluster`             |
| Lambda functions         | `lambda_function`         |
| CloudFront distributions | `cloudfront_distribution` |
| VPCs                     | `vpc`                     |
| Security groups          | `security_group`          |

Billing data is ingested from Cost Explorer daily. AWS Cost Explorer has a 24-hour lag — data for a given day is available by approximately 08:00 UTC the following day.

## Multi-region and multi-account support

InfraAudit discovers resources across all enabled regions in your AWS account automatically. The **Region** field in the connection form sets the primary region for API calls, not a filter.

To monitor multiple AWS accounts, connect each as a separate provider. All accounts appear together in the unified resource inventory. The number of accounts you can connect depends on your plan.

## Security notes

* Credentials are encrypted at rest using AES-GCM with the server's `ENCRYPTION_KEY`.
* InfraAudit never writes to your AWS account. Every API call is read-only.
* For tighter security, you can scope the IAM policy to specific regions or resource ARN prefixes.

<Warning>
  Rotate your IAM access keys periodically and update the credentials in InfraAudit under **Cloud Providers → Edit** when you do. Stale credentials will cause sync failures.
</Warning>