> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Account

> Let Traversal's agent run read-only queries against a single AWS account via a cross-account IAM role.

Connecting an AWS Account lets Traversal query AWS to discover and inspect your AWS resources during investigations — describing resources, reading configuration, pulling logs, etc. — using a cross-account, read-only IAM role. Traversal assumes this role via STS, minting short-lived credentials rather than using long-lived AWS access keys. No secrets are ever accessible.

## Setup

<Steps>
  <Step title="Download the CloudFormation template">
    In the Traversal Web UI, go to **Company Knowledge > Integrations**, select "AWS Account", and download the CloudFormation template. It's pre-filled with your external ID and Traversal's AWS account ID so it's ready to be deployed in your AWS account.
  </Step>

  <Step title="Deploy the role">
    Deploy the CFN template in your AWS account, either through the [AWS console](https://console.aws.amazon.com/console/home/?nc2=h_si\&src=header-signin) or using `aws cloudformation deploy` from the command line. This creates a single read-only IAM role that trusts Traversal's AWS principal, with the `sts:ExternalId` condition pinned to `traversal:<your_org_id>`.
  </Step>

  <Step title="Copy the role details">
    Once the stack finishes, copy the role ARN from its outputs. Also copy the external ID embedded in the template — you'll enter both in the Traversal Web UI.
  </Step>

  <Step title="Configure in Traversal">
    Back in the "AWS Account" integration form, enter:

    * **AWS Account ID** — the 12-digit account this integration represents
    * **Role ARN**
    * **External ID** — must match the value in the deployed role's trust policy
    * **Default Region** — used by default; Traversal can inspect resources in other regions during an investigation

    <Note>
      Traversal uses the account ID to select the right connection when multiple AWS accounts are configured, so it must be unique per AWS Account integration.
    </Note>
  </Step>
</Steps>

<Tip>
  To connect additional AWS accounts, repeat these steps for each account — AWS Account supports multiple integration instances, one per account.
</Tip>

## Required permissions

The CloudFormation template attaches AWS's managed **`AIDevOpsAgentAccessPolicy`** policy — broad read-only `Describe`/`Get`/`List` access across AWS services, intended for AI agent tooling — plus `sts:GetCallerIdentity`. No write, delete, or modify permissions are granted.

## More information

* [IAM roles with external ID conditions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)
* [AIDevOpsAgentAccessPolicy's permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AIDevOpsAgentAccessPolicy.html)