Connect your AWS account.
Trailbrace reads your AWS account via a cross-account IAM role — read-only, scoped to the services that produce evidence, and revocable from your side whenever you want. Below is the full setup: the values to paste, the IAM policy to attach, the trust policy to replace, and the click-by-click walkthrough.
Sign in to finish
Step-by-step setup
What to paste into AWS.
Trailbrace reads from IAM, CloudTrail, AWS Config, S3, EC2 security groups, and KMS — and uses sts:GetCallerIdentity to confirm the role itself. Every read is covered by the least-privilege policy below; the trust policy pins sts:AssumeRole to your account with a per-customer External ID condition.
Confirm
Run Test connection.
Trailbrace assumes your role via STS and probes each intended read service. Every line turns green when AWS accepts the read; a red line carries the AWS error code and a one-line hint for the fix.
Test connection