Skip to main content

Connecting AWS

Amnify supports two methods for connecting your AWS environment:

MethodBest for
Static CredentialsSimple setups where the IAM user has direct read access
Assume RoleCross-account scanning, least-privilege setups, or when you prefer short-lived credentials

Both methods require an IAM user with an access key. The difference is whether Amnify scans directly with that user's permissions, or uses the user to assume a role in the target account.

Method 1: Static Credentials​

Use this when your IAM user has the scanning permissions attached directly.

Prerequisites​

  • An AWS account with permission to create IAM users
  • The following values ready:
    • Access Key ID — 20-character alphanumeric key (e.g., AKIAIOSFODNN7EXAMPLE)
    • Secret Access Key — the corresponding secret (minimum 40 characters)

Step 1: Create an IAM User​

  1. Go to AWS Console → IAM → Users
  2. Click Create user
  3. Name it (e.g., amnify-scanner)
  4. Do not enable console access — this user only needs programmatic access

Step 2: Attach Read-Only Policies​

Attach the following managed policies to the user:

  1. In the user's Permissions tab, click Add permissions → Attach policies directly
  2. Search for and attach:
    • SecurityAudit
    • ViewOnlyAccess
tip

These two policies together provide the read-only access needed for comprehensive security scanning. Amnify does not require write access to your AWS resources.

Step 3: Create Access Keys​

  1. In the user's Security credentials tab, click Create access key
  2. Select Third-party service as the use case
  3. Copy both the Access Key ID and Secret Access Key — the secret won't be shown again

Step 4: Add the Integration in Amnify​

  1. Navigate to Integrations and click Create integration
  2. Select AWS as the provider
  3. Choose Static Credentials as the authentication method
  4. Fill in:
    • Display Name (optional) — a friendly label
    • Access Key ID — the 20-character key
    • Secret Access Key — the secret value
  5. Click Next
  6. Toggle on the accounts you want to scan
  7. Click Finish

Method 2: Assume Role​

Use this when you want Amnify to assume a role in the target AWS account. This is the recommended approach for production environments because:

  • The scanning role uses short-lived temporary credentials
  • The IAM user only needs sts:AssumeRole permission — no direct access to resources
  • You can scan accounts other than the one the IAM user lives in (cross-account)

Prerequisites​

  • An AWS account with permission to create IAM users and roles
  • The following values ready after completing the steps below:
    • Access Key ID and Secret Access Key of the IAM user
    • Role ARN of the scanning role (e.g., arn:aws:iam::123456789012:role/AmnifyProwlerScanRole)
    • External ID (optional, if configured in the role's trust policy)

Step 1: Create an IAM User​

  1. Go to AWS Console → IAM → Users
  2. Click Create user (e.g., amnify-scanner)
  3. Do not enable console access

Step 2: Create Access Keys for the User​

  1. In the user's Security credentials tab, click Create access key
  2. Copy both the Access Key ID and Secret Access Key

Step 3: Create the Scanning Role​

Create an IAM role in the target AWS account that the IAM user will assume:

  1. Go to AWS Console → IAM → Roles → Create role
  2. Select Custom trust policy and use:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::CALLER_ACCOUNT_ID:user/amnify-scanner"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Replace CALLER_ACCOUNT_ID with the AWS account ID where the IAM user lives.

  1. Name the role (e.g., AmnifyProwlerScanRole)
  2. Leave Maximum session duration at the default (1 hour). If you have a very large AWS account where scans may exceed 1 hour, increase this to 2 hours (7200 seconds) or more to prevent credentials from expiring mid-scan.
External ID (optional)

To add an extra layer of security, you can require an External ID in the trust policy by adding a condition:

"Condition": {
  "StringEquals": {
    "sts:ExternalId": "your-chosen-external-id"
  }
}

If you add this condition, you must provide the same External ID when creating the integration in Amnify.

Step 4: Attach Scan Permissions to the Role​

Attach these managed policies to the role:

  1. SecurityAudit
  2. ViewOnlyAccess

Step 5: Grant the IAM User Permission to Assume the Role​

Attach an inline policy to the IAM user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::TARGET_ACCOUNT_ID:role/AmnifyProwlerScanRole"
    }
  ]
}

Step 6: Add the Integration in Amnify​

  1. Navigate to Integrations and click Create integration
  2. Select AWS as the provider
  3. Choose Assume Role as the authentication method
  4. Fill in:
    • Display Name (optional)
    • Access Key ID — the IAM user's key
    • Secret Access Key — the IAM user's secret
    • Role ARN — the full ARN of the scanning role
    • External ID — only if your trust policy requires it
  5. Click Next — Amnify validates by assuming the role
  6. Toggle on the accounts you want to scan
  7. Click Finish

What Happens Next​

Once connected, you can:

Troubleshooting​

IssueCauseSolution
No accounts discoveredIAM user lacks permissionsVerify SecurityAudit policy is attached (static) or the role has it (assume role)
Authentication failedIncorrect credentialsVerify Access Key ID and Secret Access Key
AccessDenied on AssumeRoleTrust policy mismatchVerify the role's trust policy references the correct IAM user ARN
"Roles may not be assumed by root accounts"Using root credentialsCreate a dedicated IAM user — root accounts cannot assume roles
External ID mismatchExternalId in trust policy doesn't matchEnsure the External ID in Amnify matches the one in the role's Condition block
Session expired during scanScan ran longer than the role's Maximum session durationIncrease the role's Maximum session duration (e.g., to 2 hours / 7200 seconds) for large accounts