Connecting a cloud infrastructure scanner to your production environments shouldn't feel like a leap of faith. In this tutorial, we will walk you through setting up cross-account auditing in AWS securely using our pre-compiled CloudFormation or Terraform blueprints.
The Trust Relationship Design
Verallax does **not** ask for your AWS root credentials, usernames, or access keys. Instead, we use standard AWS cross-account delegation. This setup employs a trusted trust relationship with a unique **External ID** generated for your organization, mitigating the “Confused Deputy” vulnerability.
Step-by-Step Onboarding Guide
Initiate Connection in Verallax Dashboard
Navigate to the **AWS Accounts** page in your Verallax dashboard and click **Connect AWS Account**. The platform will display your organization's unique **External ID** and the **SaaS Account ID** (e.g., "111111222222"). Keep this tab open.
Select and Download Onboarding Template
Choose between deploying via **AWS CloudFormation** (recommended for Console users) or **Terraform** (recommended for GitOps organizations). Download the JSON or TF template block.
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Cross-Account Audit Role Configuration",
"Parameters": {
"verallaxAccountId": {
"Type": "String",
"Default": "111111222222"
},
"verallaxExternalId": {
"Type": "String"
}
}
}Deploy the Role in AWS Console or CLI
* **CloudFormation**: Navigate to AWS CloudFormation Service, select **Create Stack (with new resources)**, upload the template file, and paste the **External ID** parameter. * **Terraform**: Append the downloaded terraform module block to your main codebase file and run `terraform apply`.
Finalize and Run First Scan
Once stack creation completes, copy the generated Role ARN from the stack outputs. Paste this ARN back in the Verallax connection page and click **Confirm Connection**. Our worker will immediately run a connection test and launch your first read-only security scan.
Security Verification Note
The role permissions mapped in the template are strictly read-only (`arn:aws:iam::aws:policy/SecurityAudit`). Verallax will never request write or delete capabilities. If your organizational controls enforce custom boundaries, you can review the specific JSON actions mapped in the onboarding templates before deployment.