> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Connect Tierity to AWS to discover cloud resources and identify security misconfigurations.

## Overview

The AWS integration lets you scan one or more AWS accounts from within Tierity. It discovers running resources, checks for security misconfigurations, and imports findings for review.

## Prerequisites

* An AWS account with permissions to create IAM roles and policies
* Manage access (or higher) in Tierity to configure the integration

## Connecting an AWS account

Tierity uses an IAM role with read-only permissions, following the AWS recommended cross-account access pattern.

**1. Open the AWS integration**

Go to **Config → Integrations → AWS** and click **Connect AWS Account**.

**2. Create the IAM role in AWS**

**Using CloudFormation (recommended):**

1. Click **Deploy CloudFormation Stack**.
2. You'll be redirected to the AWS CloudFormation console with the template pre-loaded.
3. Review the template — it creates a read-only IAM role with an external ID.
4. Click **Create Stack** and wait for completion (1–2 minutes).

**Manual setup:**

1. In AWS IAM, create a new role with **Another AWS account** as the trusted entity.
2. Enter the Tierity AWS account ID and External ID shown in the integration setup.
3. Attach the `SecurityAudit` and `ReadOnlyAccess` managed policies.
4. Create the role and copy its ARN.

**3. Enter the role ARN in Tierity**

Paste the IAM role ARN into the **Role ARN** field.

Select the AWS regions to include in scans.

Click **Test Connection** to verify, then **Save**.

## Running resource discovery

Once connected, discover resources:

1. Go to **Config → Integrations → AWS**.
2. Select the connected account.
3. Click **Run Discovery**.
4. Choose resource types and regions.
5. Click **Start**.

### Discoverable resource types

> **Compute**
>
> EC2 instances, Auto Scaling groups, ECS clusters and tasks, Lambda functions, Elastic Beanstalk environments.

> **Networking**
>
> VPCs, subnets, security groups, load balancers, CloudFront distributions, Route 53 zones.

> **Storage**
>
> S3 buckets (with public access status), EBS volumes, EFS file systems, RDS instances.

> **Identity and access**
>
> IAM users, roles, policies, and access keys; Cognito user pools.

> **Security services**
>
> GuardDuty findings, Security Hub findings, Inspector findings, CloudTrail trails, Config compliance status.

## Security findings

Tierity automatically checks for common security misconfigurations:

| Check | Description |
| - | - |
| Public S3 buckets | Buckets with public read or write access |
| Overly permissive security groups | Security groups allowing `0.0.0.0/0` on sensitive ports |
| Unencrypted storage | RDS instances, EBS volumes, and S3 buckets without encryption |
| Exposed IAM access keys | Access keys not rotated recently |
| MFA not enforced | IAM users without MFA |
| CloudTrail not enabled | Regions without active logging |
| GuardDuty/Security Hub findings | Active findings imported from AWS security services |

## Removing an AWS account

1. Go to **Config → Integrations → AWS**.
2. Click **Disconnect** next to the account.
3. Confirm the disconnection.

After disconnecting, delete the IAM role from your AWS account to fully revoke Tierity's access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.