Connect your AWS accounts

Aletheia reads your AWS accounts through an IAM role you create. It holds no long-lived credentials and never calls a mutating API.

How the connection works

1. You start a connection in Aletheia. It gives you a CloudFormation template and an external ID unique to your organization.
2. You deploy the template in your AWS account. It creates one read-only role whose trust policy names Aletheia’s account and requires that external ID.
3. Aletheia validates the connection by assuming the role.
4. You trigger a scan, and the inventory populates.

One connection can cover many AWS accounts. Each account can carry a default environment, which seeds the environment on resources discovered in it.

What Aletheia can and cannot do

Aletheia can read the configuration of the resource types it supports, in the regions you enable.

Aletheia cannot create, modify, or delete anything in your account. The role grants read access only, so this is enforced by IAM rather than by Aletheia’s own behavior — a bug on our side still cannot mutate your infrastructure.

Caution

The external ID is what prevents another party from assuming your role even if they learn its ARN. Treat it as a secret, and do not reuse one role across organizations.

In this section

Detailed pages on connecting with CloudFormation and with Terraform, the exact permission list, multi-account setups, discovery and scans, the supported resource type registry, and troubleshooting a failed connection.

Where to go next

• Quickstart if you have not connected an account yet.
• Connect your code to map resources back to the Terraform that declares them.