# Connect an AWS account

Deploy a read-only AWS role to inventory cloud resources and import Security Hub findings.

> **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform.

## Prerequisites

- Be an organization administrator in CISAPP.
- Be able to create a CloudFormation stack and an IAM role in the target AWS account.
- For security findings: AWS Security Hub enabled in the regions to scan.

## Deploy the role

1. Open **My company → Connectors**, then **Connect** on the AWS card.
2. **Deploy the role** step: CISAPP shows its principal and an **ExternalId** unique to this connection.
3. Click **Deploy with CloudFormation**, or copy the template and deploy it yourself with these two values.
4. The role is read-only (SecurityAudit and Security Hub read access): CISAPP never changes your account.

## Verify and connect

1. Click **I deployed the role**.
2. Paste the **Role ARN** (RoleArn output of the stack).
3. Optionally list **Regions**; leave empty for every enabled region.
4. **Verify and connect**: CISAPP tests access, activates the connection and starts the first synchronization.

If you close the wizard before verification, the connection stays **Pending**: use **Resume setup** from its record.

## Track synchronization

The record shows the last synchronization and, if needed, an incomplete one (for example an unreachable region). **Synchronize** starts a new scan; an automatic synchronization also runs every night. Resources appear in **View inventory** and **View map**, Security Hub findings in security findings.

## Common issues

| Message | What to do |
| --- | --- |
| AWS connector is not configured | The connector is not available on your platform yet: contact support. |
| AWS refused access | Check that the stack is deployed and that principal and ExternalId match the displayed values. |
| Security Hub is not enabled in any scanned region | Enable Security Hub or adjust the regions. |

## Disconnect

**Disconnect** deletes the connection and its cloud inventory, and resolves its Security Hub findings. Then delete the CloudFormation stack in your AWS account.

## Expected result

The connection is active, the cloud inventory is populated and Security Hub findings appear in CISAPP.

See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors).