# Connect Amazon Web Services

> Connect an AWS account to Vigilbase OS by launching a CloudFormation stack that creates a read-only role, and optionally a responder role.

Source: https://docs.vigilbase.com/os/integrations/aws

The Amazon Web Services connector reads IAM principals and policies, EC2 and VPC inventory, security-group rules, the S3 account public-access block, CloudTrail management events and Security Hub findings. With a separate responder role it can propose revoking security-group ingress, deactivating an IAM access key, revoking role sessions and blocking S3 public access. Every change still needs an approved plan.

> [!NOTE]
> This connector is **Alpha**: built and tested in isolation, not yet proven against a live account.

## Before you start

- You need permission in AWS to create a CloudFormation stack and an IAM role in the account.
- In Vigilbase OS you need the `integration.manage` and `credential.manage` permissions.

## Connect with a CloudFormation stack

You launch a stack in your AWS account that creates one read-only role for Vigilbase. There are no access keys to copy.

:::steps
1. **Open Integrations, choose Add connection and select Amazon Web Services.**
2. **Enter the AWS account ID.** It is the 12-digit number in the AWS console account menu. Optionally give the connection a name; it is shown in feeds, evidence and notifications.
3. **Choose Continue.** Preparing your stack can take up to a minute.
4. **Create the role in AWS.** Choose **Open AWS CloudFormation** and create the stack. Do not edit it.
5. **Come back here.** Once the stack is created, Vigilbase finishes setup on its own. You can also choose **Check again**.
:::

If Vigilbase finds the role but cannot confirm it requires the external ID, make sure the stack was not edited, then check again. To use another account, choose **Use a different AWS account**.

If you prefer to create the role yourself, choose **Set up the role yourself instead**.

## Add response actions (optional)

On the connection, choose **Add write access**, then **Get the responder stack**. Vigilbase gives you a second stack that creates a separate responder role. It can only make the changes you approve, one plan at a time. All four AWS actions are marked critical, so the person who proposes them can never approve them.

## What is not collected

VPC flow logs are not collected yet.