Skip to main content
Connecting an AWS Account lets Traversal query AWS to discover and inspect your AWS resources during investigations — describing resources, reading configuration, pulling logs, etc. — using a cross-account, read-only IAM role. Traversal assumes this role via STS, minting short-lived credentials rather than using long-lived AWS access keys. No secrets are ever accessible.

Setup

1

Download the CloudFormation template

In the Traversal Web UI, go to Company Knowledge > Integrations, select “AWS Account”, and download the CloudFormation template. It’s pre-filled with your external ID and Traversal’s AWS account ID so it’s ready to be deployed in your AWS account.
2

Deploy the role

Deploy the CFN template in your AWS account, either through the AWS console or using aws cloudformation deploy from the command line. This creates a single read-only IAM role that trusts Traversal’s AWS principal, with the sts:ExternalId condition pinned to traversal:<your_org_id>.
3

Copy the role details

Once the stack finishes, copy the role ARN from its outputs. Also copy the external ID embedded in the template — you’ll enter both in the Traversal Web UI.
4

Configure in Traversal

Back in the “AWS Account” integration form, enter:
  • AWS Account ID — the 12-digit account this integration represents
  • Role ARN
  • External ID — must match the value in the deployed role’s trust policy
  • Default Region — used by default; Traversal can inspect resources in other regions during an investigation
Traversal uses the account ID to select the right connection when multiple AWS accounts are configured, so it must be unique per AWS Account integration.
To connect additional AWS accounts, repeat these steps for each account — AWS Account supports multiple integration instances, one per account.

Required permissions

The CloudFormation template attaches AWS’s managed AIDevOpsAgentAccessPolicy policy — broad read-only Describe/Get/List access across AWS services, intended for AI agent tooling — plus sts:GetCallerIdentity. No write, delete, or modify permissions are granted.

More information