AWS connector

Connect your AWS account.

Trailbrace reads your AWS account via a cross-account IAM role — read-only, scoped to the services that produce evidence, and revocable from your side whenever you want. Below is the full setup: the values to paste, the IAM policy to attach, the trust policy to replace, and the click-by-click walkthrough.

Mint your External ID + run Test connection

one-time

Saving or validating settings in Trailbrace does not create AWS resources. You must create the IAM role, attach its permissions policy, and add the trust policy in your AWS account. Then sign in and run Test connection to confirm AWS accepts the role.

Step-by-step setup

What to paste into AWS.

Trailbrace reads from IAM, CloudTrail, AWS Config, S3, EC2 security groups, and KMS — and uses sts:GetCallerIdentity to confirm the role itself. Every read is covered by the least-privilege policy below; the trust policy pins sts:AssumeRole to your account with a per-customer External ID condition.

Confirm

Run Test connection.

Trailbrace assumes your role via STS and probes each intended read service. Every line turns green when AWS accepts the read; a red line carries the AWS error code and a one-line hint for the fix.

Test connection

Confirm AWS accepts the role

Checking sign-in status…