Skip to main content
The AWS Account integration lets Traversal use the AWS CLI to inventory resources and inspect configuration across AWS services. It is designed for broad account-level investigation. This integration is separate from Amazon CloudWatch, which exposes CloudWatch metrics and logs as native telemetry. Configure both when you want broad AWS resource context together with region-specific telemetry. Traversal assumes a role in your account through AWS STS. It mints short-lived credentials for commands and does not require long-lived access keys.

​
Example prompts

  • Inventory the compute, database, and networking resources in this AWS account.
  • Investigate which AWS resources could be contributing to this incident.
  • Summarize the recent AWS cost trend and identify the largest cost drivers.
Cost analysis requires Cost Explorer to be enabled and available to the role in the connected account.

​
Setup

1

Download the CloudFormation template

In Traversal, go to Company Knowledge > Integrations, select “AWS Account”, and download the CloudFormation template. It’s pre-filled with your external ID and Traversal’s AWS account ID so it’s ready to be deployed in your AWS account.
2

Deploy the role

Deploy the CFN template in your AWS account, either through the AWS console or using aws cloudformation deploy from the command line. This creates an IAM role that uses AWS’s managed investigation policy and trusts Traversal’s AWS principal, with the sts:ExternalId condition pinned to traversal:<your_org_id>.
3

Copy the role details

Once the stack finishes, copy the role ARN from its outputs. Also copy the external ID embedded in the template — you’ll enter both in Traversal.
4

Configure in Traversal

Back in the “AWS Account” integration form, enter:
  • AWS Account ID — the 12-digit account this integration represents
  • Role ARN
  • External ID — must match the value in the deployed role’s trust policy
  • Default Region — used for STS and as the AWS CLI default; commands can target another region explicitly
Traversal uses the account ID to select the right connection when multiple AWS accounts are configured, so it must be unique per AWS Account integration.
To connect additional AWS accounts, repeat these steps for each account — AWS Account supports multiple integration instances, one per account.

​
Required permissions

The CloudFormation template attaches AWS’s managed AIDevOpsAgentAccessPolicy as the baseline. It provides broad investigative access across AWS services, including resource discovery, configuration inspection, CloudWatch data, and Cost Explorer data. The policy is predominantly investigative, but it is not exclusively read-only. AWS may version this policy, so review its current permissions before deploying the stack. Do not assume that all secret-related services are inaccessible: the policy’s exact Describe, Get, and List permissions determine what Traversal can inspect.

​
More information