> ## Documentation Index > Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg. > People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files. > Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it. # AWS > Connect an AWS account with a read-only IAM role so Enclave can map your cloud and check whether findings are reachable. Connect an AWS account so Enclave can map its resources and identities and tell which findings are reachable. Access is read-only. ## What Enclave needs A cross-account IAM role named `EnclaveScanner` with **read-only** permissions. A CloudFormation template creates it for you. The role's trust policy lets only Enclave's principal assume it, and only with an external ID generated for your organization. The role's `EnclaveScannerReadOnly` policy allows `Describe`, `List`, and `Get` actions on: * **Compute**: EC2, ECS, EKS, Lambda, Batch, and Step Functions. * **Networking**: VPC resources through EC2, Elastic Load Balancing, Route 53, CloudFront, and API Gateway. * **Data**: RDS, DynamoDB, ElastiCache, and the names of SQS queues, SNS topics, Kinesis streams, and MSK clusters. * **Storage**: S3 bucket configuration, policies, ACLs, and public access settings. No object reads. * **Containers**: ECR repositories. * **Identity**: IAM roles, users, groups, instance profiles, and their policies. No mutating actions, no data access beyond metadata. ## Before you start * You need the **Owner** or **Admin** role in Enclave. * In AWS, you need permission to create CloudFormation stacks **and IAM roles** in the account you connect. > [!WARNING] > > The stack creates an IAM role, so CloudFormation asks you to acknowledge that it creates IAM resources. If your AWS user can't create IAM roles, the stack fails. Click **Copy link** and send it to someone who can. ## Connect an AWS account Open **Settings → Integrations** and click **Connect** next to **Amazon Web Services**. **1. Open CloudFormation** Click **Open CloudFormation**. AWS opens a quick-create page for the `EnclaveScanner` stack in `us-east-1`, with your organization's external ID and Enclave's principal ARN prefilled. Review the stack and create it. To have someone else run it, click **Copy link** and send them the link. **2. Copy RoleArn from Outputs** When the stack finishes, open **CloudFormation → Stacks → EnclaveScanner → Outputs**. Copy the **Value** in the row where **Key** is `RoleArn`. **3. Validate the role** Paste the ARN into **RoleArn output** and click **Validate role**. Enclave assumes the role to confirm the trust relationship works. On success, the account is connected and Enclave starts scanning it. > [!TIP] > > Click **Finish later** to save your progress. Finish setup from **Settings → Integrations → Amazon Web Services** when the stack is ready. ## Add more accounts You can connect more than one AWS account, for example `prod` and `staging`. Click **Add account**, launch the `EnclaveScanner` stack in the other account, and validate its `RoleArn`. Every connected account is available to your whole organization. ## Manage a connection From **Settings → Integrations → Amazon Web Services**, click an account to see its account ID, role ARN, and regions. * **Re-validate** checks that Enclave can still assume the role. * **Delete** removes one account from the connection. * **Disconnect AWS** removes the whole connection. Enclave stops using these accounts. Under **CloudTrail notifications**, you can optionally connect a CloudTrail trail. Enclave then refreshes an account's inventory when its resources change, instead of waiting for the daily scan. To revoke access from AWS, delete the `EnclaveScanner` stack or the role. Enclave can no longer scan the account. ## What Enclave will and won't do * **Will**: call the read-only actions in the `EnclaveScannerReadOnly` policy. * **Won't**: mutate anything, read data payloads, hold long-lived credentials, or run agents inside your account. Enclave assumes the role with short-lived STS credentials, scoped to the role and external ID you set up. The role can be revoked at any time from your AWS account. ## Troubleshooting * **AWS STS could not assume the role**: the stack is missing, or its external ID doesn't match this Enclave connection. Click **Open CloudFormation** again. Recreate the `EnclaveScanner` stack if it was deleted, or update it if it exists. Then copy the new `RoleArn` and validate again. * **"That ARN is the Enclave principal"**: you pasted Enclave's principal ARN instead of your role's ARN. Paste the `RoleArn` value from the stack's **Outputs** tab. * **Assets don't appear in Coverage**: Enclave scans when an account connects and once a day after that. To scan now, click **Analyze Environment** in [Coverage](https://docs.enclave.ai/onboarding/coverage.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.