Skip to main content

AWS Prerequisites

Cloudaware connects to AWS using either a cross‑account IAM role (recommended) or an IAM user with access keys. Before you start the setup steps, make sure the following prerequisites are in place.

Cloudaware Prerequisites​

  • Access to a Cloudaware account.
  • A user with access to the Admin Console and permissions to manage cloud accounts, organizations, and integrations (Cloudaware Administrator).

AWS Accounts & Organizations​

  • One or more AWS accounts to onboard.
  • Permissions in those accounts to:
    • Launch CloudFormation stacks and (optionally) StackSets.
    • Create IAM roles and, if needed, IAM users.
    • Attach or modify IAM policies attached to those identities.
  • (Optional but recommended) AWS Organizations with All features enabled if you want Cloudaware to auto‑discover and onboard member accounts via StackSets.

Identity & Authentication Choices​

Decide which integration pattern you will use:

  • IAM role (recommended):
    • A cross‑account role in each onboarded account that Cloudaware assumes using an External ID.
    • Typically created via a Cloudaware‑provided CloudFormation template.
  • Access & secret keys:
    • A dedicated IAM user with attached read‑only policies.
    • Access key ID and secret access key are stored in Cloudaware.

For new integrations and large environments, prefer IAM roles for stronger isolation and easier rotation.

Logging, Billing, and Advanced Features​

To fully use Cloudaware’s security and cost capabilities, plan for:

  • CloudTrail and Config enabled according to your organization’s standards.
  • (Optional) Centralized CloudTrail and configuration logs in S3 if you want Cloudaware to analyze aggregated logs.
  • (Optional) AWS billing reports (CUR 2.0/CUR/DBR) exported to S3 and shared with Cloudaware for FinOps features.

These are not strictly required for basic inventory but are recommended for richer analytics and compliance.

Network & Connectivity​

  • Cloudaware connects to AWS public (or GovCloud) APIs over the internet; no inbound connectivity from AWS to Cloudaware is required.
  • Ensure that your security policies allow outbound access from Cloudaware to the relevant AWS API endpoints for the partitions and regions you use.

Compliance & Approvals​

  • Internal approval to grant the required read‑only IAM access and any optional extended permissions described in the Least-Privilege Policies guide.
  • Any change‑management tickets or reviews required to create CloudFormation stacks, IAM roles, or IAM users for Cloudaware.

Once these prerequisites are met, continue with Setup to configure IAM roles or access keys and onboard AWS accounts and organizations into Cloudaware.