Integrate with AWS

Before starting

Before starting, you should decide which parts of your AWS ecosystem you want to monitor. You may choose to monitor the entire AWS organization or single accounts. If you want SlashID to protect all the data in your AWS Organization, you must use an organization management account for setup. Otherwise, SlashID will monitor only the data in the specified AWS account.

The policy builder below is organized into four independent permission tiers so you can grant only what you need. They do not build on each other — only Tier 1 is required, and you can add any combination of the rest (for example, Tier 1 + 3 + 4 while skipping Tier 2 if you don't use AWS Identity Center):

• Tier 1 (required) — the minimum permissions for identity sync to work, including region discovery (ec2:DescribeRegions, called at connection start). Without these, the connection cannot operate.
• Tier 2 (required only if you use AWS Identity Center) — permissions for mapping permission sets and group memberships. SlashID detects Identity Center automatically via sso:ListInstances; once detected, these become required.
• Tier 3 (optional) — per-resource-type read permissions (EC2, S3, RDS, EKS, Lambda, Secrets Manager, KMS, DynamoDB, Bedrock). Grant only the resource types you want visible in SlashID. Withholding a type causes SlashID to skip it; everything else continues. SlashID reads resource metadata only — never your DynamoDB table contents or the prompts, payloads, and knowledge-base documents behind Bedrock resources.
• Tier 4 (optional) — permissions for CloudTrail-based activity monitoring and SlashID's automatic CloudFormation setup (management stack, member StackSet, event streaming infrastructure). Withholding these gives you a read-only integration: identity and resource data sync as normal, but SlashID will not automatically deploy infrastructure into your account.

Org customers — least-privilege option: Instead of granting Tier 4 permissions, you can deploy the member-account template (slashid-member-account-setup.yaml) yourself as a StackSet across your organization's member accounts. This establishes the cross-account trust SlashID needs for org-wide identity sync without requiring provisioning permissions in the management account.

Organization prerequisites

For org-wide setup, the management account must have AWS Organizations all features enabled and trusted access activated for service-managed CloudFormation StackSets. With Tier 4 granted, SlashID activates trusted access automatically; activate it manually if you use the least-privilege option above. Consolidated-billing-only organizations cannot use service-managed StackSets.

Set up the connection

1. Select the capability tiers you need in the builder below. Tier 1 is always included; add the other tiers for the capabilities you want SlashID to have. AWS caps a single managed policy at 6,144 characters, so the full grant is split into two policies — for each generated policy, go to your AWS Management Console > IAM > Policies, create a new policy, choose the JSON editor, and paste it in. Create all the generated policies; you attach them together in the next step.

SlashID's AWS permissions are split into tiers. Tier 1 is required. Tick the other tiers only for the capabilities you want — withholding a tier simply means SlashID skips that capability (the connection still works). The builder below merges your selection into the IAM policies to paste. AWS caps a single managed policy at 6,144 characters, so the full grant is split across two policies — create both and attach them to the same role or user. Narrowing your selection may reduce it to one.

• Tier 1 — Identity (required). Identity mapping and region discovery, the core of SlashID. Without these the connection cannot sync.
• Tier 2 — AWS Identity Center. Maps permission sets and group assignments. Required only if your organization uses AWS Identity Center; SlashID detects it via sso:ListInstances.
• Tier 3 — Resource coverage. Per-resource-type reads (EC2, S3, RDS, EKS, Lambda, Secrets Manager, KMS, DynamoDB, Bedrock, and OAuth/OIDC clients — Cognito user-pool app clients, IAM OIDC identity providers, and IAM Identity Center applications). Withholding a type causes SlashID to skip it; everything else continues. The OAuth/OIDC reads (cognito-idp:ListUserPools, cognito-idp:ListUserPoolClients, cognito-idp:DescribeUserPoolClient, iam:ListOpenIDConnectProviders, iam:GetOpenIDConnectProvider, sso:ListApplications) are optional and best-effort.
• Tier 4 — Activity monitoring & auto-setup. CloudTrail-based activity monitoring and SlashID's automatic CloudFormation setup (management stack, member StackSet, event streaming). Withhold these for a read-only integration — SlashID still syncs identity and resource data but will not automatically deploy infrastructure.

Select the capabilities to include

Identity (required)Core identity mapping and region discovery. The connection cannot sync without these.AWS Identity CenterMap permission sets and group assignments. Required only if you use AWS Identity Center.Resource coverageInventory EC2, S3, RDS, EKS, Lambda, Secrets Manager, KMS, DynamoDB and Bedrock resources.Activity monitoring & auto-setupCloudTrail activity monitoring plus SlashID's automatic CloudFormation setup. Withhold for a read-only integration.

Your selection is larger than a single AWS managed policy allows, so it is split into 2 policies. Create all 2 and attach every one to the same IAM role or user.

slashid-aws-policy-1-of-2.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "STSIdentity",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "sts:AssumeRole"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IAMIdentityRead",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountAuthorizationDetails",
        "iam:GetUser",
        "iam:GetGroup",
        "iam:GetRole",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListPolicies",
        "iam:ListSAMLProviders",
        "iam:ListMFADevices",
        "iam:ListAccessKeys",
        "iam:GetAccessKeyLastUsed",
        "iam:GenerateCredentialReport",
        "iam:GetCredentialReport"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2RegionDiscovery",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsEnumeration",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListDelegatedServicesForAccount",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListRoots",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSODetect",
      "Effect": "Allow",
      "Action": [
        "sso:ListInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSOPermissionSets",
      "Effect": "Allow",
      "Action": [
        "sso:ListPermissionSets",
        "sso:DescribePermissionSet",
        "sso:ListAccountsForProvisionedPermissionSet",
        "sso:ListAccountAssignments"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IdentityStorePrincipals",
      "Effect": "Allow",
      "Action": [
        "identitystore:ListUsers",
        "identitystore:ListGroups",
        "identitystore:ListGroupMemberships"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ResourceReads",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:GetObject",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketAcl",
        "s3:GetEncryptionConfiguration",
        "s3:GetBucketVersioning",
        "s3:GetBucketLogging",
        "s3:GetBucketTagging",
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeContinuousBackups",
        "dynamodb:ListTagsOfResource",
        "dynamodb:GetResourcePolicy",
        "dynamodb:DescribeStream",
        "rds:DescribeDBInstances",
        "eks:ListClusters",
        "lambda:ListFunctions",
        "secretsmanager:ListSecrets",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockResourceReads",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:ListCustomModels",
        "bedrock:ListImportedModels",
        "bedrock:ListProvisionedModelThroughputs",
        "bedrock:ListInferenceProfiles",
        "bedrock:ListGuardrails",
        "bedrock:ListAgents",
        "bedrock:GetAgent",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:ListKnowledgeBases",
        "bedrock:GetKnowledgeBase",
        "bedrock:ListDataSources",
        "bedrock:ListPrompts"
      ],
      "Resource": "*"
    }
  ]
}

slashid-aws-policy-2-of-2.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudFormationStackSetManagement",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DeleteStackInstances",
        "cloudformation:UpdateStackInstances",
        "cloudformation:ListStackSetOperations",
        "cloudformation:CreateStack",
        "cloudformation:DescribeStackSetOperation",
        "cloudformation:DeleteStack",
        "cloudformation:UpdateStack",
        "cloudformation:CreateStackSet",
        "cloudformation:UpdateStackSet",
        "cloudformation:DeleteStackSet",
        "cloudformation:CreateStackInstances"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stackset/slashid-*:*",
        "arn:aws:cloudformation:*:*:stack/slashid-*/*"
      ]
    },
    {
      "Sid": "CloudFormationDescribe",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStackSet",
        "cloudformation:ListStackInstances",
        "cloudformation:DescribeStacks"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudTrail",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:PutEventSelectors",
        "cloudtrail:StopLogging",
        "cloudtrail:StartLogging",
        "cloudtrail:ListTrails",
        "cloudtrail:AddTags",
        "cloudtrail:DeleteTrail",
        "cloudtrail:UpdateTrail",
        "cloudtrail:CreateTrail",
        "cloudtrail:ListTags",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:RemoveTags",
        "cloudtrail:DescribeTrails"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EventBridgeGlobal",
      "Effect": "Allow",
      "Action": [
        "events:DeleteRule",
        "events:ListApiDestinations",
        "events:DeleteApiDestination",
        "events:ListConnections",
        "events:CreateApiDestination",
        "events:DescribeConnection",
        "events:DeleteConnection",
        "events:ListRules",
        "events:ListEventBuses",
        "events:ListTargetsByRule"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EventBridgeBus",
      "Effect": "Allow",
      "Action": [
        "events:DescribeEventBus",
        "events:CreateEventBus",
        "events:DeleteEventBus"
      ],
      "Resource": "arn:aws:events:*:*:event-bus/slashid-*"
    },
    {
      "Sid": "EventBridgeConnection",
      "Effect": "Allow",
      "Action": [
        "events:CreateConnection",
        "events:DeleteConnection"
      ],
      "Resource": "arn:aws:events:*:*:connection/slashid-*"
    },
    {
      "Sid": "EventBridgeRules",
      "Effect": "Allow",
      "Action": [
        "events:DeleteRule",
        "events:PutTargets",
        "events:DescribeRule",
        "events:PutRule",
        "events:RemoveTargets",
        "events:ListTargetsByRule"
      ],
      "Resource": [
        "arn:aws:events:*:*:rule/slashid-*",
        "arn:aws:events:us-east-1:*:rule/SlashIDS3LogDelivery"
      ]
    },
    {
      "Sid": "IAMProvisioningScoped",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole",
        "iam:PutRolePolicy",
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/slashid-*",
        "arn:aws:iam::*:role/SlashID*",
        "arn:aws:iam::*:role/AWSCloudFormationStackSet*",
        "arn:aws:iam::*:role/service-role/AWSCloudFormationStackSet*",
        "arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*",
        "arn:aws:iam::*:role/aws-service-role/stacksets.cloudformation.amazonaws.com/*",
        "arn:aws:iam::*:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/*"
      ]
    },
    {
      "Sid": "IAMPolicySlashID",
      "Effect": "Allow",
      "Action": [
        "iam:CreatePolicy",
        "iam:DeletePolicy"
      ],
      "Resource": "arn:aws:iam::*:policy/SlashID*"
    },
    {
      "Sid": "IAMRoleAndPolicySlashID",
      "Effect": "Allow",
      "Action": [
        "iam:DetachRolePolicy",
        "iam:ListPolicyVersions",
        "iam:DeleteRolePolicy",
        "iam:DeletePolicy",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:AttachRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:policy/SlashID*",
        "arn:aws:iam::*:policy/slashid-*",
        "arn:aws:iam::*:role/slashid-*",
        "arn:aws:iam::*:role/SlashID*",
        "arn:aws:iam::*:role/AWSCloudFormationStackSet*",
        "arn:aws:iam::*:role/service-role/AWSCloudFormationStackSet*",
        "arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*"
      ]
    },
    {
      "Sid": "LambdaSlashID",
      "Effect": "Allow",
      "Action": [
        "lambda:CreateFunction",
        "lambda:UpdateFunctionCode",
        "lambda:AddPermission",
        "lambda:RemovePermission",
        "lambda:GetFunction",
        "lambda:GetPolicy",
        "lambda:DeleteFunction"
      ],
      "Resource": "arn:aws:lambda:us-east-1:*:function:*"
    },
    {
      "Sid": "OrganizationsProvisioning",
      "Effect": "Allow",
      "Action": [
        "organizations:EnableAWSServiceAccess",
        "organizations:RegisterDelegatedAdministrator",
        "organizations:DeregisterDelegatedAdministrator",
        "organizations:EnablePolicyType"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsSCPManagementUnscoped",
      "Effect": "Allow",
      "Action": [
        "organizations:CreatePolicy",
        "organizations:ListPolicies"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsSCPManagementScoped",
      "Effect": "Allow",
      "Action": [
        "organizations:DescribePolicy",
        "organizations:UpdatePolicy",
        "organizations:DeletePolicy",
        "organizations:AttachPolicy",
        "organizations:DetachPolicy",
        "organizations:ListTargetsForPolicy",
        "organizations:ListPoliciesForTarget"
      ],
      "Resource": [
        "arn:aws:organizations::*:policy/*",
        "arn:aws:organizations::*:root/*",
        "arn:aws:organizations::*:ou/*",
        "arn:aws:organizations::*:account/*"
      ]
    },
    {
      "Sid": "S3SlashIDBucketManagement",
      "Effect": "Allow",
      "Action": [
        "s3:PutEncryptionConfiguration",
        "s3:PutBucketNotification",
        "s3:PutBucketLogging",
        "s3:PutBucketAcl",
        "s3:PutBucketPolicy",
        "s3:CreateBucket",
        "s3:DeleteBucketPolicy",
        "s3:GetBucketLocation",
        "s3:DeleteBucket",
        "s3:GetBucketPolicy"
      ],
      "Resource": "arn:aws:s3:::slashid-*"
    },
    {
      "Sid": "S3SlashIDBucketObjects",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::slashid-*/*"
    },
    {
      "Sid": "SecretsManagerEventConnection",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:228209566706:secret:events!connection/*"
    },
    {
      "Sid": "SSMSlashID",
      "Effect": "Allow",
      "Action": [
        "ssm:PutParameter",
        "ssm:DeleteParameter",
        "ssm:GetParameter"
      ],
      "Resource": "arn:aws:ssm:*:*:*/slashid/*"
    }
  ]
}

Chained role assumption

If you configure a chain of IAM roles, the generated policies above go on the final role only. Each non-final role needs just two things: a trust policy that allows its predecessor in the chain to assume it, and a permissions policy granting sts:AssumeRole on its successor. SlashID is authorized only for the first role.

Org customers — least-privilege option

Instead of selecting Tier 4, you can deploy the member-account template (slashid-member-account-setup.yaml) yourself as a StackSet across your organization's member accounts. This establishes the cross-account trust SlashID needs for org-wide identity sync without granting provisioning permissions in the management account.

At this point you choose the authentication method that SlashID will use to access your AWS ecosystem:

• Assume role: create a role with the policies above and a trust statement that allows the SlashID AWS account to assume the role
• (Legacy) Access key: create an AWS access key ID/secret pair belonging to an IAM user that has been assigned the policies above

Assume role

SlashID accesses your AWS environment by assuming an IAM role. Most customers use a single role — follow Single role below. Only if your security setup requires SlashID to reach the target through one or more intermediate roles (for example, a standardized federation role you maintain across accounts or organizations) do you need Chained role assumption.

Single role

2. In your AWS Management Console > IAM > Roles, create a role following the wizard for a role accessed by a third-party AWS account, and attach the policies from step 1:

• The account ID that should be allowed access is 469725248735
• Set the external ID field to your SlashID organization ID, found in the SlashID console

3. Copy the role ARN, which you will need in the next step.

4. In the SlashID console, paste the relevant attributes

SlashID Console field	Description
Name of the connection	Arbitrary name you give to this connection
Authoritative status	Decide whether AWS identities are the primary (or secondary) source of truth when reconciling identities across providers
Account ID [or Organization ID]	Your AWS account ID or AWS organization ID
Region	The region that the API calls target; for best performance, this should be the same region as the S3 bucket where historical log data is stored
Authentication method	Assume role
IAM role assumption chain	The ARN of the IAM role SlashID assumes. For most setups this is your single role. If you use chained role assumption, enter all role ARNs in order — entry-point role first, target-account role last.
CloudTrail S3 bucket (optional)	To pull historical log data, specify the name of the S3 bucket where CloudTrail logs are stored
Days of CloudTrail logs to retrieve (optional)	Specify how many days of historical data should be retrieved (defaults to 90 days, max 3650). This operation will take time.
CloudTrail digest path prefix (optional)	Prefix for the Cloudtrail logs digest objects within the CloudTrail S3 bucket where historical logs can be found (default is AWSLogs)

Chained role assumption (advanced)

Use this only if SlashID cannot assume your target role directly and must pass through one or more intermediate roles, which may live in different AWS accounts or organizations. You authorize SlashID to assume only the first role; each subsequent role is trusted by the role before it, reusing your own internal federation. Order matters — the roles are assumed top to bottom.

1. Create the first role (the entry point) exactly as in Single role above — trusting the SlashID account 469725248735 with your SlashID organization ID as the external ID. This is the only role you authorize SlashID to assume.

2. Create each subsequent role so that its trust policy allows the previous role in the chain to assume it (sts:AssumeRole). Attach the connection policies (the JSON from step 1) to the final role — the one that reaches the account or organization you want SlashID to read.

3. In the SlashID console, enter every role ARN in the IAM role assumption chain field in the order they must be assumed — the entry-point role first, the target-account role last.

(Legacy) Access key

danger

This approach is not recommended as it generates static, long-lived credentials.

2. In your AWS Management Console > IAM > Users, create a new user:

• Set permissions: Attach policies directly and select the policies created in step 1.

3. Open the new user page. In the Security credentials tab, scroll down to Access keys and click on Create access key:

• Access key best practices & alternatives: Third-partyAuthentication method Access key service
• Retrieve access keys: copy and store the Access key and Secret access key which you will need in the next step.

4. In the SlashID console, paste the relevant attributes

SlashID Console field	Description
Name of the connection	Arbitrary name you give to this connection
Authoritative status	Decide whether AWS identities are the primary (or secondary) source of truth when reconciling identities across providers
Account ID [or Organization ID]	Your AWS account ID or AWS organization ID
Region	The region that the API calls target; for best performance, this should be the same region as the S3 bucket where historical log data is stored
Authentication method	Access key
Access key ID	The ID of the access key you created in step 3
Access key secret	The secret of the access key you created in step 3
CloudTrail S3 bucket (optional)	To pull historical log data, specify the name of the S3 bucket where CloudTrail logs are stored
Days of CloudTrail logs to retrieve (optional)	Specify how many days of historical data should be retrieved (defaults to 90 days, max 3650). This operation will take time.
CloudTrail digest path prefix (optional)	Prefix for the Cloudtrail logs digest objects within the CloudTrail S3 bucket where historical logs can be found (default is AWSLogs)

Troubleshooting

• Health check never finishes, or provisioning reports "You must enable organizations access to operate a service managed stack set": the management account is missing an Organizations prerequisite — see Organization prerequisites above and enable all features + activate trusted access, then reconnect.
• CloudFormation stack slashid-organization-setup stuck in DELETE_FAILED on a lambda:RemovePermission error: regenerate and reattach the policies from step 1 (they now include lambda:RemovePermission), delete the failed stack, and reconnect.