---
title: "Amazon Web Services (AWS) Connector Guide"
slug: "amazon-web-services-aws-v2"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/amazon-web-services-aws-v2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Web Services (AWS) Connector Guide

Amazon Web Services (AWS) is one of the most comprehensive and broadly adopted public cloud platforms that enables users to easily deploy virtual machines and networks, as well as access over 200 native AWS services.

The **Balbix integration with AWS** ingests data from core services such as Amazon Elastic Compute Cloud (Amazon EC2), Amazon Simple Storage Service (Amazon S3) and AWS Identity and Access Management (IAM); database services such as Amazon Relational Database Service (Amazon RDS), container services such as Amazon Elastic Kubernetes Service (Amazon EKS) and analytics services such as the Amazon OpenSearch Service.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

### Integration summary

This table provides a summary of the Balbix integration for the AWS connector.

| **Integration Type** | **Fetch**: An inbound API integration used to fetch cloud assets, misconfigurations, and tags. |
| --- | --- |
| **Types of Assets Fetched** | Infrastructure cloud resources such as virtual machines, databases, containers, serverless functions, identity & access management resources. |
| **Types of Data Fetched** | Asset names, configurations, hardware information, interface information (MAC address, IP address), OS information, system information, all relevant timestamps (e.g., first observed, last observed), tags. |

## Prerequisites

To configure the Balbix connector, you must first create AWS API credentials with the appropriate permissions. These credentials are required for completing the configuration process.

**Create a role and assign permissions**

To access AWS, an ARN value is required. Follow these steps to create a role and assign a permissions policy.

**For master accounts**

1. Log in to the AWS management console and select **IAM Service**.
2. In the left navigation pane, select **Access management > Roles**.
3. Click **Create role**. On the Role Creation screen:
  - Select **AWS account** as the trusted identity type.
  - Choose **Another AWS Account** and enter the following details from the Balbix connector configuration screen:
    - **Balbix AWS Account ID:** 022653893069
    - **External ID**: Leave this field blank for now. This value is typically your organization's domain name with periods replaced by hyphens (for example, corp.test..com becomes corp-test-com). The exact value will be confirmed in the Balbix connector configuration.
4. Click **Next**.
5. Add the **Security Audit** policy.
6. Create a new policy with the following permission:

```json
jsonCopy code{
  "Effect": "Allow",
  "Action": "sts:AssumeRole",
  "Resource": "*"
}
```
  - Attach this newly created policy to the role.
7. For a Master Account: Add the newly created policy to the role.
8. Click **Next**.
9. Enter a **role name** and description, then click **Create Role**.
10. Copy the **Role ARN** and securely store it for later use when configuring the Balbix connector.

**For linked accounts**

1. **Log in to the AWS Management Console** for the linked account and select the **IAM Service**.
2. In the left navigation pane, go to **Access Management > Roles**.
3. Check if the **OrganizationAccountAccessRole** already exists
  - Ensure the role has the following trust relationship:

```json
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::[Master AWS Account ID]:root"
  },
  "Action": "sts:AssumeRole"
}
```
  - If the trust relationship is correct, no further action is needed.
4. **If the role does not exist or the trust relationship is incorrect:**
  - Click **Create Role**.
  - On the role creation screen, select **AWS account** as the trusted identity type.
  - Choose **Another AWS account** and enter the following details from the Balbix connector configuration screen:
    - Balbix AWS Account ID: `[Master AWS Account ID]`
  - Click **Next** twice.
  - Name the role **OrganizationAccountAccessRole** and click **Create Role**.
5. Confirm that the trust relationship for the new role matches the one shown above.

## Set up your AWS connector

After completing the prerequisites, follow these steps to configure your Balbix connector for AWS.

### Step 1: Select the connector

Start by selecting a connector using the steps outlined below:

1. Go to **Data Sources** from the left navigation bar.
2. In the Connectors table, click **+ Add Connector**.
3. Click **Select a Connector to Configure** to expand the window and view the list of available connectors.
4. Click the **+** icon on the **Amazon Web Services (AWS)** tile.
5. Click **Next** to configure the connector.

### Step 2: Configure the connector

Configure the connector using the steps outlined below.

[Embedded content](https://scribehow.com/embed/AWS_Connector_Guide__Dce1A1YWRZufXKTK9sEIcg?as=scrollable)

## AWS Cloud Services Supported

The following cloud services are ingested as assets via this connector:

| Amazon Elastic Compute Cloud (EC2) |
| --- |
| Amazon Elastic Kubernetes Service (EKS) |
| Amazon Simple Notification Service (SNS) |
| Amazon Simple Queue Service (SQS) |
| Amazon ElastiCache |
| Amazon DynamoDB |
| Amazon Relational Database Service (RDS) |
| Amazon Route 53 |
| AWS CloudTrail |
| AWS Secrets Manager |
| AWS Simple Storage Service (S3) |
| AWS Lambda |
| Amazon CloudFront |
| Amazon EFS |
| Amazon Opensearch |

## API reference documentation

For more information about the AWS API, see the following references:

- [AWS Documentation](https://docs.aws.amazon.com/)
- [What is an Amazon Gateway?](https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html)
- [SecurityAudit AWS Managed Policy Reference](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.html)
- [IAM Role Creation User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html)