AWS Setup Guide

Use this guide to connect AWS to Cloudaware by using an IAM role (recommended method), validate the connection, and optionally enable multi-account onboarding with AWS Organizations.

Before You Begin

Make sure that:

• You have access to Admin Console in Cloudaware.
• You have permission in AWS to create IAM resources and deploy CloudFormation stacks.
• You know which AWS partition you need to use.
• If you plan to use AWS Organizations, you have access to the management account and permissions to deploy a StackSet.

note

If you are new to Cloudaware and don’t have the account yet, use the Get Started guide to add cloud accounts.

High-level Setup Flow

To integrate AWS with Cloudaware:

1. Enter an AWS account name.
2. Choose an authentication method:
   • IAM Role (recommended) — uses a cross-account role with an External ID.
   • Access & Secret Keys — uses a dedicated IAM user with access keys.
3. For IAM Role:
   • Select AWS partition.
   • Generate External ID.
   • Select the CloudFormation launch option:
     • Quick launch — uses a pre-generated CloudFormation template.
     • Manual creation — downloads the CloudFormation template with account data or placeholders.
4. For Access & Secret Keys, provide Access Key and Secret Key.
5. Validate credentials.
6. Save the configuration.

tip

Use IAM roles whenever possible, especially for new deployments and large environments.

Add an AWS Account in Cloudaware

In Cloudaware, open the AWS setup form:

1. Go to Admin.
2. Select Amazon Web Services.
3. Click + ADD to add the account.
   • If AWS is already configured, click CONFIGURED → select the Accounts tab and click + ADD AWS ACCOUNT.
4. Enter the AWS account name.

Configure an IAM Role

In the AWS setup form in Cloudaware:

1. Select IAM Role as the authentication type.
2. Select the AWS partition:
   • aws for the commercial AWS cloud.
   • aws-us-gov for AWS GovCloud.
3. Generate an External ID and copy it. You will need it later in AWS.
4. Under IAM Role, choose one of the CloudFormation launch methods.

Quick Launch

Use this option to open AWS CloudFormation with the Cloudaware template URL pre-filled.

In Cloudaware, click LAUNCH STACK to be redirected to the AWS console.

1. In the AWS console, review the CloudFormation stack page opened from Cloudaware.
2. Enter the required stack parameters:
   • Role name, for example, CloudawareRole.
   • The External ID generated in Cloudaware.
3. Acknowledge IAM resource creation and create the stack.
4. After the stack deployment completes, open the stack Outputs tab and copy the IAM Role ARN created for Cloudaware.
5. Go back to the AWS setup form in Cloudaware.
6. Paste the Role ARN into the form.
7. Click CHECK to verify that Cloudaware can assume the role and access the AWS account.
8. Click SAVE.

Manual Creation

Use this option if you want to download the Cloudaware CloudFormation template and upload it manually in AWS CloudFormation.

In Cloudaware, click TEMPLATE to download the CloudFormation template with your AWS account data or placeholders.

1. In the AWS console, open AWS CloudFormation.
2. Create a new stack by uploading the Cloudaware template file.
3. Enter the required stack parameters:
   • Role name, for example, CloudawareRole.
   • The External ID generated in Cloudaware.
4. Acknowledge IAM resource creation and create the stack.
5. After the stack deployment completes, open the stack Outputs tab and copy the IAM Role ARN created for Cloudaware.
6. Go back to the AWS setup form in Cloudaware.
7. Paste the Role ARN into the form.
8. Click CHECK to verify that Cloudaware can assume the role and access the AWS account.
9. Click SAVE.

note

Cloudaware starts discovery during the next discovery cycle.

Configure Access and Secret Keys (Optional)

The recommended method is to use IAM roles, which provide better security, easier credential rotation, and reduced risk of long-lived credential exposure. Use access and secret keys only if IAM roles cannot be used in your environment.

To add the AWS account using access and secret keys, start in the AWS console:

1. Create a dedicated IAM user for Cloudaware.
2. Attach the required Cloudaware collector policies and any optional feature policies needed for your setup.
3. Generate an access key ID and secret access key.
4. Store the credentials securely.

tip

The collector policy may exceed the 2,048-character limit for custom inline policies in AWS. As a workaround, use one of the following options:

• Create a managed policy for the IAM user. Managed policies allow JSON policy documents of up to 6,144 characters. For details, see the AWS documentation.
• Request a service quota increase for IAM policies by contacting AWS Support. For details, see the AWS documentation.

In Cloudaware:

1. Select Access & Secret Keys as the authentication type.
2. Select the AWS partition.
3. Enter:
   • Access key ID.
   • Secret access key.
4. Click CHECK to validate keys.
5. When validation succeeds, click SAVE.

note

Cloudaware starts discovery during the next discovery cycle.

Add an AWS Organization

Use AWS Organizations to discover and onboard member accounts automatically.

Before you start, make sure that:

• The AWS management account is already onboarded in Cloudaware by using the IAM role method.
• You have the External ID that was used for the AWS management account setup.
• You are ready to deploy a StackSet to the target Organizational Units (OUs).

Create a StackSet in AWS

1. Sign in to the AWS Management Console and open CloudFormation.

2. Choose the AWS Region that you want to manage the StackSet from.

3. In the navigation pane on the left, select StackSets. Click Create stack set:

   • Under Permissions, select Service-Managed Permissions.
   • Under Prerequisite - Prepare template, select Template is ready → Upload a template file.
   • Under Specify template, click Choose file and upload the Cloudaware CloudFormation template used when adding the AWS Organization Management account and creating a stack.

   Click Next.

4. Enter the required parameters for the stack set:

   • CloudAware Role ARN: A meaningful name for the stack set, e.g., CloudAware.aws.
   • CloudAware Role Name: The same role that was used when onboarding the AWS management account to Cloudaware.
   • External ID: The same External ID that was used when onboarding the AWS management account to Cloudaware.

   Click Next.

5. Enable the required policies. Click Next.

6. Configure StackSet options, tags, execution settings, and IAM capabilities if required. Click Next.

7. Under Deployment targets, select one of the following:

   • Deploy to organization, or
   • Deploy to organizational units (OUs) and add the target OU IDs
   note

   If you need to edit the StackSet later, you will not be able to select the option to deploy it to the entire organization again. You will need to manually specify the root OU ID, or all OUs where you want to deploy the StackSet, and specify the region as well.

8. Configure automatic deployment and account removal behavior if needed.

9. Under Specify regions, select one Region where the stack must be deployed (e.g., the region that contains the largest number of resources).

10. Configure deployment options, such as maximum concurrent accounts, failure tolerance, region concurrency, concurrency mode, StackSet dependencies, if required. Click Next.

11. On the Review page, verify the target accounts and Region. Click Create StackSet.

12. On the StackSet details page, monitor the stack creation status.

For more information about creating a StackSet with service-managed permissions, see the AWS documentation.

Add the AWS Organization Details in Cloudaware

1. In Cloudaware, go to Admin.
2. Select Amazon Web Services.
3. Click CONFIGURED → select the Organizations tab. Click + ADD AWS ORGANIZATION.
4. Fill out the setup form:
   • Name: Enter the AWS Organization name.
   • Partition: Select the partition of AWS Organization Management Account (aws for public AWS cloud, aws-us-gov for AWS GovCloud).
   • IAM Role Name: Enter the name of the IAM role that was used when onboarding the AWS management account to Cloudaware and is created by the StackSet in member accounts.
   • External ID: Enter the External ID used in the StackSet (created when onboarding the AWS management account to Cloudaware).
   • Management Account: Select the AWS Organization Management Account from the list.
5. Click CHECK to validate the connection.
6. When validation succeeds, click SAVE.

Cloudaware discovers and adds member accounts from the targeted OUs over time.

Update External ID for AWS Accounts Moved Between Organizations

If you have moved an AWS account from one AWS Organization to another, update the External ID in Cloudaware as follows:

1. Log in to Cloudaware → Admin.
2. Select Amazon Web Services → CONFIGURED.
3. Locate the affected AWS account in the list. Click the three-dot menu → Edit.
4. Update the External ID and Role ARN using the values from the CloudFormation stack in the new AWS Organization.
5. Click CHECK to test the connection.
6. Click SAVE.

Verify the Connection

After setup:

• Confirm that the AWS account or organization shows a healthy status (green) in Cloudaware.
• Confirm that resources begin to appear in CMDB after discovery starts.
• If the connection validates successfully but no resources appear yet, wait for the next discovery cycle and check again.

For detailed steps, see Verification.

Next Steps

• Review AWS Services Coverage and AWS Resource Coverage to understand which AWS services and objects Cloudaware discovers.
• If any accounts remain unhealthy (red) or empty (no data) after the first discovery cycle, check Troubleshooting or contact Cloudaware Support at support@cloudaware.com.

Related

• Cloudaware AWS CloudFormation template
• Cloudaware AWS IAM policies