Skip to main content

​
How Amnify authenticates

You connect AWS with an IAM identity that you create in your own AWS account and grant read-only access. There are two ways to do it, and you choose in the Connect Amazon Web Services dialog.

Assume role

Recommended. An IAM user with a read-only access key, plus a dedicated scan role that user may assume, gated by an external ID. The access key is used only to call STS AssumeRole and take on the scan role for the duration of a scan.

Access key

Simpler. A read-only access key that Amnify uses directly, with no role to assume. Fewer steps to set up, but it keeps one long lived credential in play, which is why assume role is the better default.
With assume role, the scan role’s trust policy is authored by you and names your own IAM user as the trusted principal. The external ID is a condition on that trust, so the role cannot be assumed without the value Amnify generates for you, even by someone holding the key. Either way, the access key is validated once with an STS GetCallerIdentity call, then stored encrypted at rest. Amnify never returns the secret back through its API, and it scrubs the stored credentials when you disconnect. You supply a credential you control and can rotate or revoke in IAM at any time. After rotating the key in IAM, open the connection’s menu on Sources and choose Rotate credentials to give Amnify the new one. The connection, its selected account, schedules and findings are kept. You can change the mode or the scan role at the same time. With assume role, enter the external ID from the role’s trust policy again: Amnify does not show or reuse the stored one. The new credentials must resolve to the same AWS account; another account is connected as its own source.

​
Steps to connect

1

Create a read-only IAM user and access key

In the AWS console, create an IAM user (or reuse a dedicated one) and attach read-only access, described in Tier 1 below. Create an access key for it; you will paste the access key ID and secret into Amnify.
2

Copy the external ID from Amnify

In Amnify, click Connect on the AWS card (or Connect more in the Amazon Web Services section once an account is connected) and choose Assume a scan role. Amnify pre-fills an external ID. Copy this value, because you will reference it in the scan role’s trust policy in the next step.
3

Create the scan role

Create an IAM role in the target account and attach the same read-only access from Step 1. Set its trust policy to allow the IAM user from Step 1 to assume it, with a condition requiring the external ID from Step 2 (sts:ExternalId). Copy the role’s ARN.
4

Save the connection in Amnify

Back in the dialog, paste the access key ID, secret access key and the scan role ARN, keep the external ID from Step 2, then click Connect. Amnify validates the credentials against STS and connects the account.

​
Tier 1: Account read access (required)

What: read-only access to the AWS account, attached to the IAM user and scan role above. Amnify does not require a specific named policy. It needs read-only visibility sufficient for its posture checks. The AWS-managed SecurityAudit policy is the standard, least-privilege way to grant this, as it is purpose-built for read-only security review; pair it with the managed ViewOnlyAccess policy if a check needs to read additional resource metadata. Why: Amnify runs read-only posture checks across the account (networking, storage, compute, IAM, logging, and more) to flag insecure settings. Read-only access grants visibility into that configuration only: no ability to change, create, or delete resources, and no access to the data held inside them, such as S3 object contents, database rows, or Secrets Manager values. Scanning is scoped to a single AWS account per connection. Amnify does not enumerate or scan an entire AWS Organization from one connection. Connect each account you want assessed, each with its own scan role and the external ID Amnify pre-fills for it. One IAM user and access key can serve every account, as long as the user may assume each account’s scan role (sts:AssumeRole on the role’s ARN). An account that is already connected cannot be connected again, through another role or an access key. Unlike Azure, there is no separate identity tier; IAM configuration is read as part of this same read-only access.
What Amnify never asks for on AWS
  • No write, modify, or delete permissions. Read-only access only.
  • No access to data-plane contents (S3 object contents, database rows, Secrets Manager values).
  • With assume role, no way to assume the scan role without the external ID you set.
  • No credential Amnify generated. In both modes it holds only the read-only key you created, stored encrypted, and you can rotate or revoke it in IAM at any time.