Skip to main content

​
Overview

The AWS integration lets you scan one or more AWS accounts from within Tierity. It discovers running resources, checks for security misconfigurations, and imports findings for review.

​
Prerequisites

  • An AWS account with permissions to create IAM roles and policies
  • Manage access (or higher) in Tierity to configure the integration

​
Connecting an AWS account

Tierity uses an IAM role with read-only permissions, following the AWS recommended cross-account access pattern.
1

Open the AWS integration

Go to Config → Integrations → AWS and click Connect AWS Account.
2

Create the IAM role in AWS

Using CloudFormation (recommended):
  1. Click Deploy CloudFormation Stack.
  2. You’ll be redirected to the AWS CloudFormation console with the template pre-loaded.
  3. Review the template — it creates a read-only IAM role with an external ID.
  4. Click Create Stack and wait for completion (1–2 minutes).
Manual setup:
  1. In AWS IAM, create a new role with Another AWS account as the trusted entity.
  2. Enter the Tierity AWS account ID and External ID shown in the integration setup.
  3. Attach the SecurityAudit and ReadOnlyAccess managed policies.
  4. Create the role and copy its ARN.
3

Enter the role ARN in Tierity

Paste the IAM role ARN into the Role ARN field.Select the AWS regions to include in scans.Click Test Connection to verify, then Save.

​
Running resource discovery

Once connected, discover resources:
  1. Go to Config → Integrations → AWS.
  2. Select the connected account.
  3. Click Run Discovery.
  4. Choose resource types and regions.
  5. Click Start.

​
Discoverable resource types

EC2 instances, Auto Scaling groups, ECS clusters and tasks, Lambda functions, Elastic Beanstalk environments.
VPCs, subnets, security groups, load balancers, CloudFront distributions, Route 53 zones.
S3 buckets (with public access status), EBS volumes, EFS file systems, RDS instances.
IAM users, roles, policies, and access keys; Cognito user pools.
GuardDuty findings, Security Hub findings, Inspector findings, CloudTrail trails, Config compliance status.

​
Security findings

Tierity automatically checks for common security misconfigurations:

​
Removing an AWS account

  1. Go to Config → Integrations → AWS.
  2. Click Disconnect next to the account.
  3. Confirm the disconnection.
After disconnecting, delete the IAM role from your AWS account to fully revoke Tierity’s access.