Skip to main content
Connect an AWS account so Enclave can map its resources and identities and tell which findings are reachable. Access is read-only.

​
What Enclave needs

A cross-account IAM role named EnclaveScanner with read-only permissions. A CloudFormation template creates it for you. The role’s trust policy lets only Enclave’s principal assume it, and only with an external ID generated for your organization. The role’s EnclaveScannerReadOnly policy allows Describe, List, and Get actions on:
  • Compute: EC2, ECS, EKS, Lambda, Batch, and Step Functions.
  • Networking: VPC resources through EC2, Elastic Load Balancing, Route 53, CloudFront, and API Gateway.
  • Data: RDS, DynamoDB, ElastiCache, and the names of SQS queues, SNS topics, Kinesis streams, and MSK clusters.
  • Storage: S3 bucket configuration, policies, ACLs, and public access settings. No object reads.
  • Containers: ECR repositories.
  • Identity: IAM roles, users, groups, instance profiles, and their policies.
No mutating actions, no data access beyond metadata.

​
Before you start

  • You need the Owner or Admin role in Enclave.
  • In AWS, you need permission to create CloudFormation stacks and IAM roles in the account you connect.
The stack creates an IAM role, so CloudFormation asks you to acknowledge that it creates IAM resources. If your AWS user can’t create IAM roles, the stack fails. Click Copy link and send it to someone who can.

​
Connect an AWS account

Open Settings → Integrations and click Connect next to Amazon Web Services.
1

Open CloudFormation

Click Open CloudFormation. AWS opens a quick-create page for the EnclaveScanner stack in us-east-1, with your organization’s external ID and Enclave’s principal ARN prefilled. Review the stack and create it.To have someone else run it, click Copy link and send them the link.
2

Copy RoleArn from Outputs

When the stack finishes, open CloudFormation → Stacks → EnclaveScanner → Outputs. Copy the Value in the row where Key is RoleArn.
3

Validate the role

Paste the ARN into RoleArn output and click Validate role. Enclave assumes the role to confirm the trust relationship works. On success, the account is connected and Enclave starts scanning it.
Click Finish later to save your progress. Finish setup from Settings → Integrations → Amazon Web Services when the stack is ready.

​
Add more accounts

You can connect more than one AWS account, for example prod and staging. Click Add account, launch the EnclaveScanner stack in the other account, and validate its RoleArn. Every connected account is available to your whole organization.

​
Manage a connection

From Settings → Integrations → Amazon Web Services, click an account to see its account ID, role ARN, and regions.
  • Re-validate checks that Enclave can still assume the role.
  • Delete removes one account from the connection.
  • Disconnect AWS removes the whole connection. Enclave stops using these accounts.
Under CloudTrail notifications, you can optionally connect a CloudTrail trail. Enclave then refreshes an account’s inventory when its resources change, instead of waiting for the daily scan. To revoke access from AWS, delete the EnclaveScanner stack or the role. Enclave can no longer scan the account.

​
What Enclave will and won’t do

  • Will: call the read-only actions in the EnclaveScannerReadOnly policy.
  • Won’t: mutate anything, read data payloads, hold long-lived credentials, or run agents inside your account.
Enclave assumes the role with short-lived STS credentials, scoped to the role and external ID you set up. The role can be revoked at any time from your AWS account.

​
Troubleshooting

  • AWS STS could not assume the role: the stack is missing, or its external ID doesn’t match this Enclave connection. Click Open CloudFormation again. Recreate the EnclaveScanner stack if it was deleted, or update it if it exists. Then copy the new RoleArn and validate again.
  • “That ARN is the Enclave principal”: you pasted Enclave’s principal ARN instead of your role’s ARN. Paste the RoleArn value from the stack’s Outputs tab.
  • Assets don’t appear in Coverage: Enclave scans when an account connects and once a day after that. To scan now, click Analyze Environment in Coverage.