SETUP GUIDE
AWS Cloud Intelligence
Connect a customer-owned AWS account with a read-only cross-account role. AntOps never requests access keys and never changes AWS resources.
Before you start
- Workspace owner access
- An AWS account administrator
- An AntOps-approved read-only role setup
Setup
- Open Cloud Intelligence and choose Connect AWS account.
- Use the AntOps-approved read-only IAM role setup for the AWS account you want AntOps to inspect.
- Paste only the resulting role ARN in AntOps, then choose Verify connection.
- Wait for the first inventory. The first successful observation establishes a baseline; it is not an incident.
Verify and expected result
Verification checks that AntOps can assume the submitted read-only role and read the supported inventory. It does not read object contents or make writes. Customer-generated trust-policy templates are not published until AntOps has a dedicated stable cross-account principal.
A verified connection begins a baseline inventory. An account with no supported resources is still a successful connection.
Common safe checks
Verification failed
Confirm the role ARN and approved trust setup with your AWS administrator. Do not attach broad managed policies, add access keys or guess a trust principal.
Utilization is unavailable
Core inventory can remain healthy. Utilization-backed review is optional and requires separately approved CloudWatch permissions.
Security and revocation
AntOps uses temporary STS access for the role. Do not put access keys or role secrets in AntOps, GitHub or a ticket.
Disable the AntOps monitor, then remove the approved AntOps trust relationship from the customer-owned IAM role. Remove the AntOps connection in the app when that control is available for your workspace.