How to Connect Your AWS Account

Create a read-only IAM role, paste two policies, and you're connected. Takes about 5 minutes.

Printable — use Ctrl+P / Cmd+P to save as PDF.

How it fits together

☁️

Your AWS Account

IAM Role

Trust Policy + Read-only Policy

No resources modified

STS AssumeRole

+ External ID

STS AssumeRole + External ID

🔍

Platform

BaselineSentinel

Scans, reports & Terraform

Read-only — no write access

Results

Alerts, reports, TF

Results — alerts, reports, Terraform

📊

You

Dashboard

XLSX exports & compliance scores

Scheduled reports

You create a read-only role → BaselineSentinel assumes it to scan → you get results. Nothing is changed in your account.

Before you begin

BaselineSentinel Account ID

The 12-digit AWS account ID used to build the BaselineSentinel role principal ARN. Find it in Settings → AWS Accounts → Add Account, listed as BaselineSentinel Account ID.

External ID

Auto-generated per organization, visible in Settings → Organization. Same External ID for all your AWS accounts.

Create an IAM Policy

Sign in to IAM Console.
Go to Policies → Create policy.
Click the JSON tab and paste one of the policies below.
Name the policy BaselineSentinelReadOnlyPolicy.
Description: "Read-only permissions for BaselineSentinel cloud monitoring and compliance."
Click Create policy.

Which policy should I use?

We recommend the full policy (Compliance Aid) for all plans. It is read-only and safe. If you upgrade your plan later, your role will already have the right permissions — no IAM changes needed.

Full Policy Recommended

Covers Inventory, Monitoring, Security, Cost, Drift, Backup, Compliance, and CloudTrail.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ec2:Describe*",
      "rds:Describe*",
      "s3:ListAllMyBuckets",
      "s3:GetBucket*",
      "s3:GetObject",
      "sns:Publish",
      "ssm:DescribeInstanceInformation",
      "ssm:ListInventoryEntries",
      "elasticloadbalancing:Describe*",
      "ecs:List*",
      "ecs:Describe*",
      "lambda:List*",
      "lambda:GetFunction*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "iam:List*",
      "iam:Get*",
      "iam:GenerateCredentialReport",
      "iam:GetCredentialReport",
      "tag:GetResources",
      "config:Describe*",
      "config:Get*",
      "config:List*",
      "backup:List*",
      "backup:Describe*",
      "backup:Get*",
      "cloudtrail:LookupEvents",
      "cloudtrail:GetTrailStatus",
      "cloudtrail:DescribeTrails",
      "logs:Describe*",
      "logs:Get*",
      "logs:FilterLogEvents",
      "kms:List*",
      "kms:Describe*",
      "kms:GetKeyPolicy",
      "kms:GetKeyRotationStatus",
      "securityhub:Get*",
      "securityhub:List*",
      "guardduty:List*",
      "guardduty:Get*",
      "access-analyzer:List*",
      "ce:GetCostAndUsage",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansUtilization",
      "acm:ListCertificates",
      "acm:DescribeCertificate",
      "acm:ListTagsForCertificate"
    ],
    "Resource": "*"
  }]
}

Minimal policy for Base plan only

Covers Inventory, Monitoring, and Security scanning.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ec2:Describe*",
      "rds:Describe*",
      "s3:ListAllMyBuckets",
      "s3:GetBucket*",
      "elasticloadbalancing:Describe*",
      "ecs:List*",
      "ecs:Describe*",
      "lambda:List*",
      "lambda:GetFunction*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "iam:List*",
      "iam:Get*",
      "tag:GetResources",
      "ssm:DescribeInstanceInformation",
      "ssm:ListInventoryEntries"
    ],
    "Resource": "*"
  }]
}

Minimal policy for Base+Drift+Backup plan

Adds Cost Explorer, AWS Backup, Config, and CloudWatch Logs to the Base policy.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ec2:Describe*",
      "rds:Describe*",
      "s3:ListAllMyBuckets",
      "s3:GetBucket*",
      "s3:GetObject",
      "sns:Publish",
      "ssm:DescribeInstanceInformation",
      "ssm:ListInventoryEntries",
      "elasticloadbalancing:Describe*",
      "ecs:List*",
      "ecs:Describe*",
      "lambda:List*",
      "lambda:GetFunction*",
      "cloudwatch:Get*",
      "cloudwatch:List*",
      "iam:List*",
      "iam:Get*",
      "tag:GetResources",
      "config:Describe*",
      "config:Get*",
      "config:List*",
      "backup:List*",
      "backup:Describe*",
      "backup:Get*",
      "logs:Describe*",
      "logs:Get*",
      "ce:GetCostAndUsage",
      "ce:GetCostForecast",
      "ce:GetReservationUtilization",
      "ce:GetSavingsPlansUtilization"
    ],
    "Resource": "*"
  }]
}

Create a Role with Trust Policy

In IAM, go to Roles → Create role.
Choose "Custom trust policy".
Paste the trust policy below, replacing the two placeholders.
Click Next.

Trust policy JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::BASELINESENTINEL-ACCOUNT-ID:role/BaselineSentinelAssumeRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

Replace the placeholders:

BASELINESENTINEL-ACCOUNT-ID: Find it in Settings → AWS Accounts → Add Account, listed at top as BaselineSentinel Account ID.
YOUR_EXTERNAL_ID → your organization's External ID (from Settings → Organization).

What is the External ID?

The External ID prevents the confused deputy problem. It is auto-generated when your organization is created and is the same for all AWS accounts you add. Find it in Settings → Organization.

Attach the Policy to the Role

On the "Add permissions" page, search for BaselineSentinelReadOnlyPolicy.
Select it and click Next.
Name the role BaselineSentinelReadOnlyRole.
Description: "Read-only role for BaselineSentinel cloud monitoring and compliance."
Click Create role.
Open the role and copy the Role ARN (e.g. arn:aws:iam::123456789012:role/BaselineSentinelReadOnlyRole).

Add the Account in BaselineSentinel

In BaselineSentinel, go to Settings → AWS Accounts → Add Account.
Enter your 12-digit AWS Account ID and the Role ARN from Step 3.
The External ID is pre-filled with your organization's External ID.
Select the regions you want to scan (IAM is global — one role covers all regions).
Click Add Account.
Click the signal icon (Test Connection) to verify BaselineSentinel can assume the role.
Run your first scan.

Multi-Account (Higher Plans)

Repeat Steps 1–4 in each AWS account. Use the same External ID for all accounts — it is tied to your organization. Each account gets its own IAM role with the same policies.

Base+Drift+Backup: up to 5 • Compliance Aid: up to 10 • Enterprise: configurable

Multi-Region

IAM roles are global. You do not need to add the same account twice for different regions. Select all regions to scan when adding the account. BaselineSentinel iterates through each region using the same role.

Troubleshooting

"AccessDenied" on scan

Verify the trust policy has the correct BaselineSentinel account ID and External ID values.

"Role cannot be assumed"

Check the Role ARN is correct and the External ID matches exactly (case-sensitive).

Missing resources

Ensure the policy includes permissions for the services you want (e.g. Lambda, Backup). Use the Full Policy to cover everything.

Cost data shows $0

The ce:* permissions are only in the Drift+Backup and Full policies. Upgrade your IAM policy if using the minimal Base policy.