AWS Integration Overview

How CloudWrangler Accesses Your AWS Account

CloudWrangler uses IAM role assumption to access your AWS resources. This is the recommended AWS best practice for cross-account access.

Key Concepts

IAM Role Assumption

Instead of using access keys, CloudWrangler assumes an IAM role in your account:

1. You create an IAM role with read-only permissions
2. The role trusts CloudWrangler's AWS account
3. CloudWrangler assumes the role when needed
4. Sessions expire after 15 minutes

External ID

An External ID is required for all role assumptions to prevent "confused deputy" attacks:

• Your Project ID is used as the External ID
• It's a UUID like 550e8400-e29b-41d4-a716-446655440000
• Must match exactly for role assumption to succeed

Security Model

CloudWrangler's security approach:

• Read-Only: Uses AWS managed ReadOnlyAccess policy
• No Write Access: Cannot modify your infrastructure
• No Credentials Stored: Never stores access keys or secrets
• Session-Based: Temporary 15-minute sessions
• External ID Required: Prevents confused deputy attacks
• Audit Trail: All API calls appear in CloudTrail

What CloudWrangler Can See

With the ReadOnlyAccess policy, CloudWrangler can:

✅ Discover Resources:

• EC2 instances, AMIs, snapshots
• RDS databases, clusters, snapshots
• ElastiCache clusters, replication groups
• Load Balancers (ALB, NLB, Classic)
• VPC components (subnets, route tables, gateways)
• S3 buckets (metadata only, not contents)

✅ Query Flow Logs:

• Read VPC Flow Logs from S3 (Parquet format)
• Query via Athena
• Aggregate traffic statistics

What CloudWrangler Cannot Do

With read-only access, CloudWrangler cannot:

❌ Create, modify, or delete resources ❌ Stop or terminate instances ❌ Modify security groups or NACLs ❌ Access S3 bucket contents (only metadata) ❌ Read RDS data ❌ Execute commands via SSM ❌ Modify IAM policies

Integration Steps

1. Account Setup: Deploy IAM role and connect account
2. VPC Flow Logs: Enable traffic analysis (optional)

Multi-Region Support

CloudWrangler discovers resources across all AWS regions:

• Automatically discovers resources in all enabled regions
• You can select which regions to scan
• Defaults to all commercial regions

Troubleshooting

Role Assumption Failed

Check these common issues:

1. Wrong External ID: Ensure you used your Project ID
2. Trust Policy: Verify CloudWrangler account ID is 119632503960
3. Policy Attached: Confirm ReadOnlyAccess policy is attached
4. Role Name: Default is CloudWranglerAccessRole

Verification Status Shows "Pending"

CloudWrangler verifies the role every hour:

• Green = Verified (last hour)
• Yellow = Pending (not checked yet)
• Red = Failed (cannot assume role)

Clicking "Refresh" manually triggers verification.

Next Steps