Setup
1
Download the CloudFormation template
In the Traversal Web UI, go to Company Knowledge > Integrations, select “AWS Account”, and download the CloudFormation template. It’s pre-filled with your external ID and Traversal’s AWS account ID so it’s ready to be deployed in your AWS account.
2
Deploy the role
Deploy the CFN template in your AWS account, either through the AWS console or using
aws cloudformation deploy from the command line. This creates a single read-only IAM role that trusts Traversal’s AWS principal, with the sts:ExternalId condition pinned to traversal:<your_org_id>.3
Copy the role details
Once the stack finishes, copy the role ARN from its outputs. Also copy the external ID embedded in the template — you’ll enter both in the Traversal Web UI.
4
Configure in Traversal
Back in the “AWS Account” integration form, enter:
- AWS Account ID — the 12-digit account this integration represents
- Role ARN
- External ID — must match the value in the deployed role’s trust policy
- Default Region — used by default; Traversal can inspect resources in other regions during an investigation
Traversal uses the account ID to select the right connection when multiple AWS accounts are configured, so it must be unique per AWS Account integration.
Required permissions
The CloudFormation template attaches AWS’s managedAIDevOpsAgentAccessPolicy policy — broad read-only Describe/Get/List access across AWS services, intended for AI agent tooling — plus sts:GetCallerIdentity. No write, delete, or modify permissions are granted.