Connect a cloud account

kaveo scans read-only. Pick a provider and register its read-only access — AWS via an assumed role, other clouds via a reference to a least-privilege credential in your secret store (never the secret itself).

Cloud providerYour AWS account idThat's all kaveo needs from you — the role name, ARN and ExternalId below are filled in automatically.

Create the read-only role — one command

Open AWS CloudShell ↗

This kaveo deployment hasn't published the identity it scans from, so the setup command can't be generated yet. Ask your admin to set KAVEO_PRINCIPAL_ARN to the ARN the kaveo containers run as (their EC2 instance role, ECS task role, or IAM user) and restart the API.

Advanced — custom name, role ARN, IaC templates, AI

Account nameOptional — defaults to the account id.Read-only role ARNOptional — only set this if you created the role under a different name.External idPre-generated for you — it must match the sts:ExternalId condition in the role trust policy.

Role trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<KAVEO_SCANNER_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<external-id>"
        }
      }
    }
  ]
}

Replace <KAVEO_SCANNER_ACCOUNT_ID> with the AWS account your kaveo deployment runs as.

Create the role — pick your tool

AWSTemplateFormatVersion: "2010-09-09"
Description: kaveo read-only scan role — cross-account, ExternalId-pinned, read-only.
Resources:
  KaveoReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: kaveo-readonly
      Description: Read-only role assumed by kaveo for security scanning.
      MaxSessionDuration: 3600
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::<KAVEO_SCANNER_ACCOUNT_ID>:root"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: "<external-id>"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Outputs:
  RoleArn:
    Description: Paste this into kaveo's "Connect AWS account" form as the Role ARN.
    Value: !GetAtt KaveoReadOnlyRole.Arn

The complete read-only role (trust + SecurityAudit / ViewOnlyAccess), pre-filled with your ExternalId. Copy → run → paste the role ARN above.

Or generate with AI

Describe any extra constraints and kaveo drafts a hardened role, then validates it is read-only before showing it.

Connect — kaveo verifies it can assume the role, then starts your first scan.

Cancel