AWS: Inventory
Adding an AWS account gives Connect read access to it through an IAM role you create in the account, so Connect can discover its resources into Inventory and keep them current. The same setup can forward CloudTrail and Security Hub events to Connect, so changes show up in near real time instead of waiting for the daily discovery.
Everything is created by a CloudFormation stack (or the equivalent Terraform) whose parameters Connect fills in for you. You always own the role; it exists in your account and you can review or remove it at any time.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| The 12-digit AWS account ID | It identifies the account in Connect | AWS console, account menu (top right) |
| Permission to create a CloudFormation stack that creates IAM resources in that account | The stack creates the role and its policies | Your IAM permissions in the account |
For an AWS Organizations rollout, access to the organization's management account and the root ID (r-…) or the OU IDs (ou-…) to cover | The StackSet is created from the management account | AWS Organizations in the console |
Set up an AWS account
- In Connect, go to Settings > Accounts and add a new account.
- Cloud Provider: AWS. Enter the AWS Account ID, a name, and a project. If a Connect Access choice is shown, AWS accounts use Read Only.
- Save. You land on the Provision page, which offers three ways to create the role. Pick one:
- CloudFormation, for a single account. Sign in to that AWS account in the console, then open the Quick create stack link. The parameters are pre-filled from your account; leave them as they are, tick I acknowledge that AWS CloudFormation might create IAM resources, and create the stack.
- AWS Organizations CloudFormation, for many accounts at once. Sign in to the organization's management account, open the Quick create stack link, and enter the root ID or a comma-separated list of OU IDs to cover. Everything else is pre-filled.
- Terraform. Download the template from the link, copy the tfvars text, and apply the template with those variables.
- Once the stack has finished creating, click Verify Account Access in Connect. It reports Access to this account has been successfully verified. when Connect can assume the role. Discovery starts on its own from there.
If you'd rather review what the stack does before creating it, open the template URL shown on the quick-create page, or choose Create change set so CloudFormation lists the resources first.
What the stack creates
| Resource | Purpose |
|---|---|
An IAM role under the path /CloudDefense/ | The role Connect assumes. Only Connect can assume it, and only with an external ID. It carries the AWS-managed SecurityAudit policy plus a custom policy with a few additional read-only permissions that SecurityAudit lacks |
| A small function that runs once while the stack is created | Registers the role with Connect |
| A StackSet that adds an event rule in each selected region | Forwards CloudTrail events and Security Hub findings to Connect for near-real-time updates. Not created for free-tier clients |
The region list for the StackSet defaults to every AWS region. If some regions are disabled in your account, remove them from the EventRegions parameter before creating the stack; a disabled region makes the StackSet fail.
Verify it landed
| What to check | Where to look |
|---|---|
| Connect can assume the role | The Provision page shows This account has been provisioned. and no Resource Errors |
| The account has no discovery errors | Settings > Accounts: no warning icon on the AWS account |
| The resources themselves | Inventory > Resources, filtered by Vendor > AWS and, if you like, by account. The supported AWS resource types page lists what discovery covers |
| Events are arriving | Make a change in the account (for example, tag an instance) and watch it appear in Inventory within a few minutes, rather than after the next daily discovery |
Keeping the stack current
The template is updated as discovery covers more services. Once the account is provisioned, the CloudFormation tab on the Provision page switches to showing an AWS CLI command that updates your existing stack to the latest template. You can run it from AWS CloudShell. To preview the changes first, download the template at the --template-url in the command, or update the stack with a change set.
Resource Errors on the Provision page whose message mentions Access Denied or not authorized usually mean the stack is behind the template; updating it adds the missing permissions.
Details and edge cases
Deleting the stack removes the role, and discovery stops at the next run with permission errors. Delete the account in Connect as well, so it doesn't keep reporting errors.
Free-tier clients don't receive events. The stack is created without the event StackSet, and inventory updates only on the daily discovery.
For common issues, see Troubleshooting.
AWS documentation
- Creating a stack from a quick-create link: what the Quick create stack page is
- Updating stacks using change sets: previewing a template update before applying it
- SecurityAudit managed policy: the bulk of what the role can read
- Working with StackSets: how the Organizations rollout and the per-region event rules are deployed