AWS API

Connect Radiant to your AWS account via the AWS API connector to query live resource configurations during Enrichment.

The AWS API connector lets Radiant query your AWS account directly during the Enrichment stage of alert triage. Unlike AWS CloudTrail, which records past API activity, the AWS API connector returns the current state of resources at investigation time. This includes active S3 bucket permissions, IAM policy attachments, EC2 security group rules, and GuardDuty findings.

Configuring this connector takes three phases: create a credential in Radiant, add the data connector, and create an IAM role in AWS that Radiant can assume. You can create the IAM role manually or deploy it across multiple accounts with a CloudFormation StackSet.

Prerequisites

• AWS account access with permission to create IAM policies and IAM roles
• If you use AWS Organizations and plan to deploy with a StackSet, permission to create StackSets in your management account
• If your organization requires change request approval before modifying AWS configurations, initiate that process before you begin

Add the credential in Radiant Security

1. Log in to Radiant Security.
2. From the navigation menu, select Settings > Credentials and click + Add Credential.
3. Select Amazon Web Services API from the list and click Configure Credential.
4. Under Credential Name, give the credential an identifiable name (e.g. AWS API Credentials).
5. Under AWS Accounts, choose one of the following:

   • AWS Organizations users: export a .csv file containing all your AWS account IDs by following the AWS Organizations export instructions, then drag and drop the file into the upload box.
   • All other users: click + Add Manually and enter each account ID.
6. Click Add Credential to save the changes.

Add the AWS API data connector in Radiant Security

1. From the navigation menu, select Settings > Data Connectors and click + Add Connector.
2. Search for and select the Amazon Web Services API option and then click Data Feeds.
3. Under Select your data feeds, select AWS HTTP API and click Credentials.
4. From the drop-down menu, select the Amazon Web Services API credential that you created in the previous section.
5. Click Add Connector to save the changes.
6. In the Data Connectors page, find the AWS API connector and click View Details.
7. Copy the AWS External Role ID. You'll use this value for the creation of the IAM role in the upcoming steps.

If you use AWS Organizations, configure the IAM role with a StackSet to deploy it across all member accounts in one operation. For a single account or a small number of accounts, configure the role manually.

Configure the IAM Role manually

1. Sign in to the AWS Management Console on your main account and navigate to IAM > Policies > Create Policy.
2. Under Specify permissions, select the JSON format and paste the following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3Api",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketAcl",
                "s3:GetEncryptionConfiguration",
                "s3:GetBucketLogging",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketTagging",
                "s3:GetBucketWebsite",
                "s3:GetObjectAcl",
                "s3:GetObjectAttributes",
                "s3:GetAccountPublicAccessBlock",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket"
            ],
            "Resource": ["arn:aws:s3:::*", "arn:aws:s3:::*/*"]
        },
        {
            "Sid": "EC2Api",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAddresses",
                "ec2:DescribeImageAttribute",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeSecurityGroupRules",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeVolumes",
                "ec2:DescribeVolumesModifications"
            ],
            "Resource": ["*"]
        },
        {
            "Sid": "GuarddutyApi",
            "Effect": "Allow",
            "Action": ["guardduty:ListFindings", "guardduty:GetFindings"],
            "Resource": ["arn:*:guardduty:*:*:*"]
        },
        {
            "Sid": "IAMApi",
            "Effect": "Allow",
            "Action": [
                "iam:GetAccessKeyLastUsed",
                "iam:GetAccountAuthorizationDetails",
                "iam:GetAccountSummary",
                "iam:GetGroup",
                "iam:GetGroupPolicy",
                "iam:GetInstanceProfile",
                "iam:GetLoginProfile",
                "iam:GetMFADevice",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:GetSAMLProvider",
                "iam:GetServiceLastAccessedDetails",
                "iam:GetServiceLastAccessedDetailsWithEntities",
                "iam:GetUser",
                "iam:GetUserPolicy",
                "iam:ListAccessKeys",
                "iam:ListAccountAliases",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListGroupPolicies",
                "iam:ListGroups",
                "iam:ListGroupsForUser",
                "iam:ListInstanceProfileTags",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicies",
                "iam:ListPoliciesGrantingServiceAccess",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:ListUserTags",
                "iam:ListUsers",
                "iam:ListVirtualMFADevices"
            ],
            "Resource": [
                "arn:aws:iam::*:role/*",
                "arn:aws:iam::*:saml-provider/*",
                "arn:aws:iam::*:instance-profile/*",
                "arn:aws:iam::*:user/*",
                "arn:aws:iam::*:group/*",
                "arn:aws:iam::*:policy/*"
            ]
        },
        {
            "Sid": "AccountApi",
            "Effect": "Allow",
            "Action": [
                "account:GetAccountInformation"
            ],
            "Resource": ["*"]
        }
    ]
}

1. Enter a policy name, review the settings, and click Create policy.

Create the IAM role

1. Navigate to Roles > Create role.
2. For Trusted entity type, select Custom trust policy. Paste the following JSON into the text box:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:sts::649384204969:assumed-role/tenant-aws-access-role/radiant-security"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "${RS_CREDENTIAL_ID}"
                }
            }
        }
    ]
}

Replace ${RS_CREDENTIAL_ID} with the AWS External Role ID you copied from the Radiant connector details page.

Attach the policy

1. On the Add permissions page, find and select the policy you created in step 1.

Name and create the role

1. Set the role name to radiant-aws-api-access-role, review the settings, and click Create role.

Configure the IAM Role using StackSets

Use this method to deploy the IAM role across multiple AWS accounts in a single operation. This is the recommended approach for AWS Organizations.

1. In your main AWS Organization account, navigate to CloudFormation > StackSets and click Create StackSet.
2. Download the CloudFormation template:

4KB

rs_iam_role-2026-03-31.yml

Open

1. Open the file and replace ${RS_CREDENTIAL_ID} with the AWS External Role ID you copied from the Radiant connector details page.
2. In the Permissions section, select Service-managed permissions.
3. In the Prerequisite - Prepare template section, select Template is ready.
4. In Specify template, click Upload a template file and upload your edited CloudFormation file.
5. In the StackSet name section, enter a name for the StackSet.
6. In the Capabilities section, acknowledge that IAM resources will be created.

Choose deployment targets

1. In Deployment targets, choose one of the following:

   • To deploy to all accounts in your organization, select Deploy to organization.
   • To deploy to specific accounts, select Deploy to organizational units (OUs). Enter the AWS OU IDs for the target accounts, then select the Intersection filter and add the account numbers.

Specify regions and submit

1. In Specify regions, enter all regions where the StackSet should deploy. Review the configuration and click Submit.

Verify ingestion

After AWS API begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"aws_http_api_read".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.