Connect an AWS account

Deploy a read-only AWS role to inventory cloud resources and import Security Hub findings.

Access: organization administrator. Beta feature; the connector must be enabled on your platform.

Prerequisites

• Be an organization administrator in CISAPP.
• Be able to create a CloudFormation stack and an IAM role in the target AWS account.
• For security findings: AWS Security Hub enabled in the regions to scan.

Deploy the role

1. Open My company → Connectors, then Connect on the AWS card.
2. Deploy the role step: CISAPP shows its principal and an ExternalId unique to this connection.
3. Click Deploy with CloudFormation, or copy the template and deploy it yourself with these two values.
4. The role is read-only (SecurityAudit and Security Hub read access): CISAPP never changes your account.

Verify and connect

1. Click I deployed the role.
2. Paste the Role ARN (RoleArn output of the stack).
3. Optionally list Regions; leave empty for every enabled region.
4. Verify and connect: CISAPP tests access, activates the connection and starts the first synchronization.

If you close the wizard before verification, the connection stays Pending: use Resume setup from its record.

Track synchronization

The record shows the last synchronization and, if needed, an incomplete one (for example an unreachable region). Synchronize starts a new scan; an automatic synchronization also runs every night. Resources appear in View inventory and View map, Security Hub findings in security findings.

Common issues

Message	What to do
AWS connector is not configured	The connector is not available on your platform yet: contact support.
AWS refused access	Check that the stack is deployed and that principal and ExternalId match the displayed values.
Security Hub is not enabled in any scanned region	Enable Security Hub or adjust the regions.

Disconnect

Disconnect deletes the connection and its cloud inventory, and resolves its Security Hub findings. Then delete the CloudFormation stack in your AWS account.

Expected result

The connection is active, the cloud inventory is populated and Security Hub findings appear in CISAPP.

See also: Configure connectors.