Docs · Connect your tools
Connect Amazon Web Services
StackWeaver reads, and never changes, your AWS account once a day, through a read-only credential you create yourself: either an IAM user's access keys, or a role StackWeaver's own IAM user assumes. This guide says what is read, which permissions the credential needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls AWS's API with the credential you provide. Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail.
| Check (as shown in the portal) | What it looks at |
|---|---|
| Root account has MFA | Whether the AWS account root user has a multi-factor authentication device |
| Console users have MFA | Whether every IAM user with console access has at least one MFA device |
| Multi-region CloudTrail is logging | Whether at least one multi-region CloudTrail trail is actively logging |
| S3 buckets have default encryption | Whether every S3 bucket in the account has a default encryption configuration |
2. What it does not do
- It does not read the contents of any S3 bucket, CloudTrail log, or any other AWS resource beyond the settings above.
- It cannot change any setting: every API call it makes is a Get, List or Describe call, and the credential it uses carries read permissions only.
- It does not say your account meets any standard. A result is what AWS returned at a certain time.
- It does not store IAM user names: results keep opaque IAM user ids, never names or e-mail addresses.
3. The access it needs
Four read-only IAM actions (AWS), each used by one or more checks. `sts:GetCallerIdentity` needs no permission at all.
| Permission | Used for |
|---|---|
| iam:GetAccountSummary | Root account MFA status |
| iam:ListUsers, iam:GetLoginProfile, iam:ListMFADevices | Which console IAM users have an MFA device |
| cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus | Whether a multi-region trail is logging |
| s3:ListAllMyBuckets, s3:GetEncryptionConfiguration | Whether each bucket has default encryption (bucket contents are never read) |
Who can connect. In StackWeaver, a workspace owner or admin saves the credential. On AWS's side, the IAM user or role is created by whoever has IAM permissions in your account; AWS does not tell StackWeaver who that person is or what role they hold, so give the credential only the permissions above and nothing else.
4. Connect steps
Two ways to connect, depending on how much you want to share: IAM access keys (simpler) or a role StackWeaver's own AWS account assumes (no long-lived key leaves your account).
- In the AWS Console, go to IAM, Policies, Create policy, and paste a policy with exactly the permissions listed above and nothing else.
- Create either an IAM user with that policy attached and generate an access key for it, or a role with that policy and a trust policy that allows StackWeaver's IAM user (ask StackWeaver for the account to trust, and set an external ID of your choosing as a condition).
- In StackWeaver, open Evidence, the Amazon Web Services section, and paste the credential as JSON: access keys as `{"access_key_id","secret_access_key","region"}`, or a role as `{"role_arn","external_id","region"}`.
- Press Test connection. StackWeaver records the result and fills in the 12-digit account id.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check (for example, no IAM users or no buckets) |
| Could not check | StackWeaver could not read the data, or only part of a large account was sampled |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Amazon Web Services section. StackWeaver deletes the stored credential.
- In AWS, delete the IAM user's access key, or delete the role (or remove StackWeaver's IAM user from its trust policy) yourself — StackWeaver has no way to revoke an AWS credential on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| AWS did not accept the credential | The access key is wrong or has been deleted; create a new one |
| belong to AWS account X, but this connection is for Y | The pasted key is for a different AWS account than the one already connected |
| AWS refused AssumeRole (AccessDenied) | The role's trust policy does not allow StackWeaver's IAM user, or the external ID is wrong |
| the credential needs the IAM read permissions | Attach the policy listed above to the IAM user or role |
| Only N of M IAM users/buckets could be checked | The account is over StackWeaver's per-run limit; the result is reported as incomplete rather than a false pass |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.