> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hirosecure.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Connect AWS for cloud infrastructure security

The AWS integration provides visibility into cloud infrastructure activity and enables response to cloud-based threats.

## Capabilities

### Query Tools

| Tool                        | What It Does                                                       |
| --------------------------- | ------------------------------------------------------------------ |
| **CloudTrail search**       | Search API activity by username, access key, IP, event type        |
| **IAM role analysis**       | Scan all roles for over-privileged access                          |
| **Single role analysis**    | Deep security analysis of a specific role                          |
| **Auth model discovery**    | Identify how users authenticate (Identity Center, SAML, IAM, etc.) |
| **Identity mapping**        | Map user email to AWS role sessions                                |
| **CrowdStrike correlation** | Find AWS sessions related to endpoint alerts                       |

### Action Tools

| Action                  | Description                                                |
| ----------------------- | ---------------------------------------------------------- |
| Terminate EC2 instances | Stop and remove compromised instances                      |
| Disable IAM user        | Deactivate all access keys for a user                      |
| Delete IAM user         | Remove user, keys, policies, group memberships, MFA        |
| Delete access key       | Remove a specific compromised access key                   |
| Detach admin policies   | Remove AdministratorAccess, PowerUserAccess, IAMFullAccess |
| Block IP in WAF         | Add IP to WAF IP set to block traffic                      |

<Warning>
  All actions require explicit approval before execution.
</Warning>

## Setup

### Connection Method

Hiro connects via **IAM AssumeRole** with temporary credentials. You create an IAM role in your AWS account that Hiro can assume.

<Steps>
  <Step title="Create an IAM role">
    Create a new IAM role in your AWS account:

    1. Go to **IAM > Roles > Create role**
    2. Select **Custom trust policy**
    3. Use this trust policy (replace `YOUR_EXTERNAL_ID` with a unique identifier):

    ```json theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::605862532274:root"
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "YOUR_EXTERNAL_ID"
            }
          }
        }
      ]
    }
    ```

    <Tip>
      The External ID can be any unique string (e.g., your organization ID, a UUID, or a random string). It prevents confused deputy attacks by ensuring only authorized parties can assume the role.
    </Tip>
  </Step>

  <Step title="Attach permissions">
    Attach the AWS managed policy for your desired access level:

    **For investigations (recommended):**

    * `arn:aws:iam::aws:policy/ReadOnlyAccess` - Full read access across all AWS services

    **Alternative options:**

    * `arn:aws:iam::aws:policy/SecurityAudit` - Security-focused read access
    * `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess` - Limited read access (not recommended - missing IAM visibility)

    **For remediation actions (optional):**

    Create a custom policy with:

    ```json theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "IAMRemediation",
          "Effect": "Allow",
          "Action": [
            "iam:UpdateAccessKey",
            "iam:DeleteAccessKey",
            "iam:DeleteUser",
            "iam:DetachUserPolicy",
            "iam:RemoveUserFromGroup",
            "iam:DeleteLoginProfile"
          ],
          "Resource": "*"
        },
        {
          "Sid": "EC2Remediation",
          "Effect": "Allow",
          "Action": [
            "ec2:TerminateInstances"
          ],
          "Resource": "*"
        },
        {
          "Sid": "WAFRemediation",
          "Effect": "Allow",
          "Action": [
            "wafv2:UpdateIPSet"
          ],
          "Resource": "*"
        }
      ]
    }
    ```
  </Step>

  <Step title="Connect in Hiro">
    In Hiro, go to [**Settings > Integrations > AWS**](https://app.hiro.is/settings/integrations/aws):

    1. Enter the **Role ARN** (e.g., `arn:aws:iam::123456789012:role/HiroSecurityRole`)
    2. Enter the **External ID** (must match what you configured in the trust policy)
    3. Click **Connect**
  </Step>
</Steps>

## Investigation Examples

### Search CloudTrail

```
Show me all API calls by john@company.com in the last 24 hours
```

Hiro searches CloudTrail and returns:

* API actions performed
* Source IP addresses
* Success/failure status
* Request parameters

### Investigate an access key

```
What has access key AKIA... done in the last week?
```

### Analyze IAM permissions

```
What permissions does the AdminRole have? Is it over-privileged?
```

Hiro analyzes the role and reports:

* Attached policies
* Effective permissions
* Security issues and risk score
* Recommendations

### Discover auth patterns

```
How do users authenticate to AWS in this account?
```

Hiro analyzes CloudTrail to identify:

* Identity Center
* SAML federation
* OIDC federation
* IAM users
* Access keys

## Remediation Actions

Example action proposal:

```
PROPOSED ACTION: Delete AWS Access Key
──────────────────────────────────────
Access Key: AKIA...XYZ
Owner: john@company.com
Reason: Key used from suspicious IP after Okta compromise
Evidence:
  • Key used from 185.220.101.1 (Tor exit node)
  • 47 API calls in 5 minutes (unusual volume)
  • Attempted AssumeRole to AdminRole
Confidence: High (94%)

[Approve]  [Reject]
```

## Multi-Account Support

To monitor multiple AWS accounts:

1. Create the IAM role in each account
2. Add each Role ARN in Hiro's AWS integration settings
3. Hiro will aggregate activity across all accounts during investigations

## What's Not Supported

* S3-specific tools
* RDS, Lambda, DynamoDB tools
* CloudFormation management

## Troubleshooting

### "Access Denied" on AssumeRole

If you see errors like `User is not authorized to perform: sts:AssumeRole`:

1. **Verify the trust policy** - Ensure Hiro's account (`605862532274`) is in the Principal
2. **Check the External ID** - The External ID in Hiro must exactly match your trust policy condition
3. **Confirm the Role ARN** - Double-check for typos in the role name or account ID

### "Access Denied" on specific actions

If AssumeRole succeeds but queries fail (e.g., `iam:GetRole` denied):

* Your role is missing permissions. Attach `ReadOnlyAccess` for full read access
* `ViewOnlyAccess` is **not sufficient** - it lacks IAM visibility

### Missing events

CloudTrail events can take up to 15 minutes to appear. Recent activity may not show immediately.

### Multi-account issues

When monitoring multiple accounts, ensure the IAM role exists in **each** account with the same trust policy pointing to Hiro's account.

## Next Steps

<CardGroup cols={2}>
  <Card title="Okta" icon="key" href="/integrations/okta">
    Connect identity management.
  </Card>

  <Card title="CrowdStrike" icon="shield" href="/integrations/crowdstrike">
    Connect endpoint protection.
  </Card>
</CardGroup>