Environment Setup
AWS setup guide
IAM user with IAMReadOnlyAccess
Create an IAM user with read-only access so IntegraTrace can analyze your AWS IAM posture. Nothing in your account is ever modified.
Data source
AWS management APIs using an IAM user's access keys. IntegraTrace reads configuration and resource metadata only, with no writes to your account.
What we read
Inventory and posture data across your account: IAM, compute, storage, networking, and other services covered by the AWS managed IAMReadOnlyAccess policy.
Required permissions
IAMReadOnlyAccess on an IAM user.
Identity types
IAM users, assumed roles, the root account, AWS service accounts, and federated users (SAML, OIDC).
Connect your AWS account
1
Open IAM in AWS
- ✓Log into the AWS Management Console.
- ✓In the top search bar, type IAM and open IAM.
2
Create the user
- ✓In the left sidebar, click Users, then Create user.
- ✓Enter a username that follows your company naming convention.
- ✓Leave “Provide user access to the AWS Management Console” unchecked, then click Next.
- ✓Select Attach policies directly.
- ✓Search for IAMReadOnlyAccess and check the box next to it.
- ✓Click Next, review, and click Create user.
3
Create access keys
- ✓Click the new user, then open the Security credentials tab.
- ✓Under Access keys, click Create access key.
- ✓Choose Application running outside AWS, then click Next.
- ✓Copy the Access Key ID and Secret Access Key (or download the .csv), then click Done.
Important
After you leave this page, AWS will never show the Secret Access Key again. Store it securely.
4
Enter credentials in IntegraTrace
In IntegraTrace, open the Add Cloud Environment dialog and provide:
- Environment Name: anything you want.
- Cloud Provider: AWS.
- Capture interval: leave the default or change as needed.
- Access Key ID and Secret Access Key: paste from AWS.
- Click Save Environment.
Optional: agent trails (CloudTrail)
Only needed if you enable Agent trails for this environment in IntegraTrace. Use the same IAM user you created above and add the optional cloudtrail:LookupEvents permission via an inline policy.
5
Add CloudTrail access for agent trails
- ✓Open IAM → Users and click your IntegraTrace user.
- ✓On the Permissions tab, click Add permissions → Create inline policy.
- ✓In the Visual editor, choose the CloudTrail service.
- ✓Under Actions allowed, expand Read and check LookupEvents.
- ✓Leave Resources set to All resources, then click Next.
- ✓Name the policy (e.g. IntegraTrace-CloudTrailLookup) and click Create policy.
Read-only
The permissions in this walkthrough are read-only. IntegraTrace will never make changes to your AWS environment.