> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inframap.cloud/llms.txt
> Use this file to discover all available pages before exploring further.
# Connection
> Connect your AWS account to InfraMap using our secure CloudFormation template. No credentials required.
# Connecting Your AWS Account
InfraMap connects to your AWS account using a secure, read-only IAM role. We **never require or store your AWS credentials**. Instead, you deploy a CloudFormation template that creates a transparent IAM role with explicit read-only permissions that you can inspect before creation.
## How It Works
InfraMap uses a **cross-account IAM role** that you create in your AWS account. This role has:
* **Read-only access** to the AWS services InfraMap needs to discover your resources
* **Explicit permissions** that you can review before deployment
* **No write or delete permissions** - InfraMap can only read your infrastructure
* **Transparent configuration** - you see exactly what permissions are granted
InfraMap never stores your AWS credentials. All access is through the IAM role you create, which you can revoke or delete at any time.
## Prerequisites
Before connecting your AWS account, ensure you have:
* An AWS account with appropriate permissions to create IAM roles and CloudFormation stacks
* Access to the AWS Console
## Step-by-Step Connection
### Step 1: Navigate to Connection Settings
After signing up, go to your account settings and click **"Connect AWS Account"** or navigate to the connection page.
### Step 2: Launch CloudFormation Stack
InfraMap provides a pre-configured CloudFormation template that you'll deploy in your AWS account. Click the **"Launch CloudFormation Stack"** button, which will:
1. Open the AWS CloudFormation Console in a new tab
2. Pre-fill the stack template URL
3. Pre-populate the necessary parameters
### Step 3: Review the CloudFormation Template
Before creating the stack, you can review the CloudFormation template to see exactly what will be created:
* **IAM Role**: A read-only role that InfraMap will assume
* **IAM Policy**: Explicit read-only permissions for AWS services
* **Trust Policy**: Allows InfraMap's AWS account to assume the role
```yaml theme={null}
AWSTemplateFormatVersion: '2010-09-09'
Description: InfraMap read-only role for mapping AWS infrastructure
Parameters:
InfraMapAccountId:
Type: String
Description: AWS Account ID of InfraMap (the external account that will assume this role)
ExternalId:
Type: String
Description: External ID used by InfraMap when assuming this role
Resources:
InfraMapReadOnlyRole:
Type: AWS::IAM::Role
Properties:
RoleName: InfraMapReadOnlyRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
AWS: !Sub "arn:aws:iam::${InfraMapAccountId}:root"
Action: "sts:AssumeRole"
Condition:
StringEquals:
sts:ExternalId: !Ref ExternalId
Policies:
- PolicyName: InfraMapReadOnlyPolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: EC2ReadOnly
Effect: Allow
Action:
- "ec2:Describe*"
- "ec2:DescribeVolumes"
- "ec2:DescribeVolumeStatus"
- "ec2:DescribeVolumeAttribute"
- "ec2:DescribeSnapshots"
- "tag:GetResources"
- "tag:GetTagKeys"
- "tag:GetTagValues"
Resource: "*"
- Sid: CloudWatchMetrics
Effect: Allow
Action:
- "cloudwatch:GetMetricStatistics"
- "cloudwatch:GetMetricData"
Resource: "*"
- Sid: S3ReadOnly
Effect: Allow
Action:
- "s3:ListAllMyBuckets"
- "s3:GetBucketLocation"
- "s3:GetBucketTagging"
- "s3:GetEncryptionConfiguration"
- "s3:GetBucketVersioning"
- "s3:GetBucketLogging"
- "s3:GetBucketPublicAccessBlock"
- "s3:GetBucketAcl"
- "s3:GetBucketPolicy"
- "s3:GetBucketObjectLockConfiguration"
- "s3:GetReplicationConfiguration"
- "s3:GetLifecycleConfiguration"
Resource: "*"
- Sid: IAMReadOnly
Effect: Allow
Action:
- "iam:ListRoles"
- "iam:GetRole"
- "iam:ListRolePolicies"
- "iam:GetRolePolicy"
- "iam:ListAttachedRolePolicies"
- "iam:ListPolicies"
- "iam:GetPolicy"
- "iam:GetPolicyVersion"
- "iam:ListPolicyVersions"
- "iam:ListEntitiesForPolicy"
- "iam:ListInstanceProfilesForRole"
- "iam:GetInstanceProfile"
- "iam:ListInstanceProfiles"
Resource: "*"
- Sid: LambdaReadOnly
Effect: Allow
Action:
- "lambda:ListFunctions"
- "lambda:GetFunction"
- "lambda:GetFunctionConfiguration"
- "lambda:ListTags"
- "lambda:GetPolicy"
- "lambda:ListEventSourceMappings"
- "lambda:ListProvisionedConcurrencyConfigs"
- "lambda:GetFunctionConcurrency"
Resource: "*"
- Sid: CloudFrontReadOnly
Effect: Allow
Action:
- "cloudfront:ListDistributions"
- "cloudfront:GetDistribution"
- "cloudfront:GetDistributionConfig"
- "cloudfront:ListTagsForResource"
Resource: "*"
- Sid: APIGatewayReadOnly
Effect: Allow
Action:
- "apigateway:GET"
Resource: "*"
- Sid: ELBReadOnly
Effect: Allow
Action:
- "elasticloadbalancing:DescribeLoadBalancers"
- "elasticloadbalancing:DescribeListeners"
- "elasticloadbalancing:DescribeTargetGroups"
- "elasticloadbalancing:DescribeLoadBalancerAttributes"
- "elasticloadbalancing:DescribeTags"
Resource: "*"
- Sid: ExplicitDeny
Effect: Deny
Action:
- "kms:Decrypt"
- "ssm:GetParameter"
- "ssm:GetParameters"
- "secretsmanager:GetSecretValue"
- "logs:GetLogEvents"
Resource: "*"
Outputs:
RoleArn:
Description: ARN of the InfraMap read-only role
Value: !GetAtt InfraMapReadOnlyRole.Arn
```
### Step 4: Create the Stack
1. Review the stack configuration. All fields are pre-filled.
2. Acknowledge that CloudFormation may create IAM resources
3. Click **"Create stack"**
The stack creation typically takes less than a minute.
### Step 5: Copy the IAM Role ARN
Once the CloudFormation stack is created successfully:
1. Go to the **Outputs** tab of your CloudFormation stack
2. Copy the **IAM Role ARN** (it will look like: `arn:aws:iam::123456789012:role/inframap-readonly-role`)
3. Return to the InfraMap connection page
4. Paste the IAM Role ARN into the connection form
### Step 6: Complete the Connection
After pasting the IAM Role ARN:
1. Enter a connection name of your choice
2. Select regions you wish to cover (1 region for Free plan)
3. Click **"Connect"**
4. InfraMap will verify the connection by assuming the role and will then kick off a scan of your infrastructure.
## Next Steps
Once your AWS account is connected and first scan completed, [Explore your infrastructure map](/features/maps) to see your resources visualized.
After signing up, go to your account settings and click **"Connect AWS Account"** or navigate to the connection page.
### Step 2: Launch CloudFormation Stack
InfraMap provides a pre-configured CloudFormation template that you'll deploy in your AWS account. Click the **"Launch CloudFormation Stack"** button, which will:
1. Open the AWS CloudFormation Console in a new tab
2. Pre-fill the stack template URL
3. Pre-populate the necessary parameters
### Step 3: Review the CloudFormation Template
Before creating the stack, you can review the CloudFormation template to see exactly what will be created:
* **IAM Role**: A read-only role that InfraMap will assume
* **IAM Policy**: Explicit read-only permissions for AWS services
* **Trust Policy**: Allows InfraMap's AWS account to assume the role
### Step 6: Complete the Connection
After pasting the IAM Role ARN:
1. Enter a connection name of your choice
2. Select regions you wish to cover (1 region for Free plan)
3. Click **"Connect"**
4. InfraMap will verify the connection by assuming the role and will then kick off a scan of your infrastructure.
## Next Steps
Once your AWS account is connected and first scan completed, [Explore your infrastructure map](/features/maps) to see your resources visualized.