Connect AWS
You create a read-only IAM role that only Averil's broker can assume, with an ExternalId unique to your workspace.
What Averil uses it for
- Investigating GuardDuty and Security Hub findings, with CloudTrail as evidence.
- Checking that GuardDuty and Security Hub are on, a multi-region trail exists, and root and console users have MFA.
- Finding public or unencrypted RDS databases, and old or unused access keys.
- Listing Secrets Manager secret names, to show where each secret lives.
- Checking that a spend alert covers AI services such as Amazon Bedrock.
Read access
The role is called Averil-Reader. It has the AWS managed policies SecurityAudit and ViewOnlyAccess, plus findings, audit and identity reviews. The broker allows only these 14 operations, at most 120 calls a minute.
| Service | Operations | Why |
|---|---|---|
| GuardDuty | ListDetectors, GetDetector, ListFindings, GetFindings | Find detectors, check they are on, read active findings |
| Security Hub | DescribeHub, GetFindings | Check it is on, read active findings |
| CloudTrail | LookupEvents, DescribeTrails | Read recent management events, check a multi-region trail |
| IAM | GenerateCredentialReport, GetCredentialReport | Users, MFA, access key age and last use (no secrets) |
| Tagging | GetResources | Inventory of tagged resources |
| RDS | DescribeDBInstances | Find public or unencrypted databases |
| Secrets Manager | ListSecrets | Secret names and rotation status, never values |
| Budgets | DescribeBudgets | Check a spend alert covers AI services |
kms:Decrypt, table rows, image layers and console output, and it cannot chain into other roles.Write access
Writes need a second, optional role, Averil-Responder, that only Averil's executor can assume. It is off by default.
| Action | Verified by | Reversible |
|---|---|---|
| Set an IAM access key to inactive | The credential report | Yes |
| Create and enable a GuardDuty detector in a region | Listing detectors | Yes |
| Turn off public access on an RDS instance | Describing the instance | Yes |
Review the exact permissions in the Averil-Responder part of the template before you turn it on. It never touches any Averil-* role.
How to connect
- 1Get your ExternalId and Averil's broker account ID from us during onboarding. The ExternalId is at least 32 characters and unique to your workspace.
- 2Deploy the Averil CloudFormation template (
averil-access.yaml) as a stack. SetExternalIdandAverilBrokerAccountId, and leaveEnableResponderset tofalseto start. - 3Copy the
ReaderRoleArnoutput back to us, with your account ID and the regions to cover. The first region you list is the home region.
If you manage AWS with OpenTofu or Terraform, we share a module with exactly the same permissions. CI checks that the two stay identical.
averil- plus the case ID, so you can see which case made every call.How to revoke
Delete the CloudFormation stack (or destroy the module). Averil can no longer assume the role. Any session already issued expires within the hour. Averil marks the integration as access revoked.
What's next
Google Cloud (workload identity federation) and Azure (federated credential) are coming soon.
Stuck? Email averil@averil.ai or ask me in Slack.