Sign in to the https://app.icompaas.com portal.
On the left pane, click on Account settings & Onboarding, then select AWS(Amazon Web Services).
Give your AWS environment a meaningful name, enter the AWS cloud Account ID (12-digit AWS Account ID), and click Launch CloudFormation stack.
Note: The 12-digit AWS Account ID is found by clicking your account name in the top-right corner of the AWS Management Console.
Note: As a Next Step, you need Administrator permissions to create a CloudFormation template in your Cloud account. This will help create an Auditor Role with Read-Only access to your cloud metadata. No data within your environment will be accessed or exposed as part of this process.
Follow the instructions in the AWS Console, select the checkbox “I acknowledge that AWS CloudFormation may create IAM resources with custom names”, then click “Create Stack” and wait until the stack status changes to CREATE_COMPLETE.
Return to the Icompaas app and click Finish.
Note:
We have defaulted the IAM role name being created as
arn:aws:iam::********7861:role/IndependentAuditorAccessRole.
How the CloudFormation Template Works:
This CloudFormation stack creates the IndependentAuditorAccessRole IAM Role, secured with an ExternalId condition, and attaches ReadOnlyAccess and SecurityAudit policies granting temporary, read-only visibility into the AWS environment.
Permissions as part of the icompass app integration
ReadOnlyAccess grants full read/list/describe access across all AWS services, while SecurityAudit provides deeper visibility into security configurations, compliance, IAM policies, CloudTrail logs, and GuardDuty findings.
STS (Security Token Service)
AWS STS grants temporary, limited access to AWS resources without creating permanent IAM users or sharing long-term credentials. In this role, the auditor's account calls sts: AssumeRole with a verified AccountId + ExternalId, receiving temporary credentials valid for 1 hour that automatically expire after use.