> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/cloud-and-infrastructure/aws/aws-api.md).
# AWS API
The AWS API connector lets Radiant query your AWS account directly during the Enrichment stage of alert triage. Unlike [AWS CloudTrail](/radiant-connectors/cloud-and-infrastructure/aws/aws-cloudtrail-and-guardduty.md), which records past API activity, the AWS API connector returns the current state of resources at investigation time. This includes active S3 bucket permissions, IAM policy attachments, EC2 security group rules, and GuardDuty findings.
Configuring this connector takes three phases: create a credential in Radiant, add the data connector, and create an IAM role in AWS that Radiant can assume. You can create the IAM role manually or deploy it across multiple accounts with a CloudFormation StackSet.
### Prerequisites
* [ ] AWS account access with permission to create IAM policies and IAM roles
* [ ] If you use AWS Organizations and plan to deploy with a StackSet, permission to create StackSets in your management account
* [ ] If your organization requires change request approval before modifying AWS configurations, initiate that process before you begin
### Add the credential in Radiant Security
1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, select **Settings > Credentials** and click + **Add Credential**.
3. Select **Amazon Web Services API** from the list and click **Configure Credential**.
4. Under **Credential Name**, give the credential an identifiable name (e.g. `AWS API Credentials`).
5. Under **AWS Accounts**, choose one of the following:
* **AWS Organizations users**: export a `.csv` file containing all your AWS account IDs by following the [AWS Organizations export instructions](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_export.html), then drag and drop the file into the upload box.
* **All other users**: click **+ Add Manually** and enter each account ID.
6. Click **Add Credential** to save the changes.
### Add the AWS API data connector in Radiant Security
1. From the navigation menu, select **Settings > Data Connectors** and click **+ Add Connector**.
2. Search for and select the **Amazon Web Services API** option and then click **Data Feeds**.
3. Under Select your data feeds, select **AWS HTTP API** and click **Credentials**.
4. From the drop-down menu, select the **Amazon Web Services API** credential that you created in the previous section.
5. Click **Add Connector** to save the changes.
6. In the **Data Connectors** page, find the AWS API connector and click **View Details**.
7. Copy the **AWS External Role ID**. You'll use this value for the creation of the IAM role in the upcoming steps.
{% hint style="info" %}
If you use **AWS Organizations**, [configure the IAM role with a StackSet](#configure-the-iam-role-using-stacksets) to deploy it across all member accounts in one operation. For a single account or a small number of accounts, [configure the role manually](#configure-the-iam-role-manually).
{% endhint %}
### Configure the IAM Role manually
1. Sign in to the **AWS Management Console** on your main account and navigate to **IAM > Policies > Create Policy**.
2. Under **Specify permissions**, select the JSON format and paste the following:
{% code overflow="wrap" %}
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3Api",
"Effect": "Allow",
"Action": [
"s3:GetBucketAcl",
"s3:GetEncryptionConfiguration",
"s3:GetBucketLogging",
"s3:GetBucketPolicy",
"s3:GetBucketPolicyStatus",
"s3:GetBucketTagging",
"s3:GetBucketWebsite",
"s3:GetObjectAcl",
"s3:GetObjectAttributes",
"s3:GetAccountPublicAccessBlock",
"s3:GetBucketPublicAccessBlock",
"s3:GetObject",
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource": ["arn:aws:s3:::*", "arn:aws:s3:::*/*"]
},
{
"Sid": "EC2Api",
"Effect": "Allow",
"Action": [
"ec2:DescribeAddresses",
"ec2:DescribeImageAttribute",
"ec2:DescribeImages",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications"
],
"Resource": ["*"]
},
{
"Sid": "GuarddutyApi",
"Effect": "Allow",
"Action": ["guardduty:ListFindings", "guardduty:GetFindings"],
"Resource": ["arn:*:guardduty:*:*:*"]
},
{
"Sid": "IAMApi",
"Effect": "Allow",
"Action": [
"iam:GetAccessKeyLastUsed",
"iam:GetAccountAuthorizationDetails",
"iam:GetAccountSummary",
"iam:GetGroup",
"iam:GetGroupPolicy",
"iam:GetInstanceProfile",
"iam:GetLoginProfile",
"iam:GetMFADevice",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetSAMLProvider",
"iam:GetServiceLastAccessedDetails",
"iam:GetServiceLastAccessedDetailsWithEntities",
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAccessKeys",
"iam:ListAccountAliases",
"iam:ListAttachedGroupPolicies",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedUserPolicies",
"iam:ListEntitiesForPolicy",
"iam:ListGroupPolicies",
"iam:ListGroups",
"iam:ListGroupsForUser",
"iam:ListInstanceProfileTags",
"iam:ListInstanceProfiles",
"iam:ListInstanceProfilesForRole",
"iam:ListPolicies",
"iam:ListPoliciesGrantingServiceAccess",
"iam:ListPolicyVersions",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListUserPolicies",
"iam:ListUserTags",
"iam:ListUsers",
"iam:ListVirtualMFADevices"
],
"Resource": [
"arn:aws:iam::*:role/*",
"arn:aws:iam::*:saml-provider/*",
"arn:aws:iam::*:instance-profile/*",
"arn:aws:iam::*:user/*",
"arn:aws:iam::*:group/*",
"arn:aws:iam::*:policy/*"
]
},
{
"Sid": "AccountApi",
"Effect": "Allow",
"Action": [
"account:GetAccountInformation"
],
"Resource": ["*"]
}
]
}
```
{% endcode %}
5. Enter a policy name, review the settings, and click **Create policy**.
#### Create the IAM role
6. Navigate to **Roles > Create role**.
7. For **Trusted entity type**, select **Custom trust policy**. Paste the following JSON into the text box:
{% code overflow="wrap" %}
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:sts::649384204969:assumed-role/tenant-aws-access-role/radiant-security"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "${RS_CREDENTIAL_ID}"
}
}
}
]
}
```
{% endcode %}
{% hint style="info" %}
Replace `${RS_CREDENTIAL_ID}` with the **AWS External Role ID** you copied from the Radiant connector details page.
{% endhint %}
#### Attach the policy
8. On the **Add permissions** page, find and select the policy you created in step 1.
#### Name and create the role
9. Set the role name to `radiant-aws-api-access-role`, review the settings, and click **Create role**.
### Configure the IAM Role using StackSets
Use this method to deploy the IAM role across multiple AWS accounts in a single operation. This is the recommended approach for AWS Organizations.
1. In your main AWS Organization account, navigate to **CloudFormation > StackSets** and click **Create StackSet**.
2. Download the CloudFormation template:
{% file src="/files/3NkwLX3iSDNoz0cGuaWU" %}
3. Open the file and replace `${RS_CREDENTIAL_ID}` with the **AWS External Role ID** you copied from the Radiant connector details page.
4. In the **Permissions** section, select **Service-managed permissions**.
5. In the **Prerequisite - Prepare template** section, select **Template is ready**.
6. In **Specify template**, click **Upload a template file** and upload your edited CloudFormation file.
7. In the **StackSet name** section, enter a name for the StackSet.
8. In the **Capabilities** section, acknowledge that IAM resources will be created.
#### Choose deployment targets
9. In **Deployment targets**, choose one of the following:
* To deploy to all accounts in your organization, select **Deploy to organization**.
* To deploy to specific accounts, select **Deploy to organizational units (OUs)**. Enter the **AWS OU IDs** for the target accounts, then select the **Intersection** filter and add the account numbers.
#### Specify regions and submit
10. In **Specify regions**, enter all regions where the StackSet should deploy. Review the configuration and click **Submit**.
### Verify ingestion
After AWS API begins forwarding, confirm events are reaching Radiant.
1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"aws_http_api_read"`.
3. Confirm recent events appear.
{% hint style="info" %}
Allow several minutes for events to be parsed, indexed, and available for search.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.radiantsecurity.ai/radiant-connectors/cloud-and-infrastructure/aws/aws-api.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.