Skip to content

Update AWS config #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mindymo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update AWS config #23

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 36 additions & 17 deletions baton/aws-v2.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: "Set up an AWS connector"
description: "ConductorOne provides identity governance for AWS. Integrate your AWS instance with ConductorOne to run user access reviews (UARs) and enable just-in-time (JIT) access requests."
og:title: "Set up an AWS connector"
og:description: "ConductorOne provides identity governance for AWS. Integrate your AWS instance with ConductorOne to run user access reviews (UARs) and enable just-in-time (JIT) access requests."

Check warning on line 5 in baton/aws-v2.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/aws-v2.mdx#L5 

Did you really mean 'UARs'?
sidebarTitle: "AWS"
---

Expand Down Expand Up @@ -30,10 +30,6 @@

[This connector can sync secrets](/product/admin/inventory) and display them on the **Inventory** page.

### Known limitations

- Cross-account Assume Role is not currently supported

## Gather AWS credentials

Configuring the connector requires you to pass in credentials generated in AWS. Gather these credentials before you move on.
Expand Down Expand Up @@ -71,27 +67,50 @@
Navigate to the [IAM Dashboard](https://us-east-1.console.aws.amazon.com/iamv2/home?) and select **Roles** > **Create Role**.
</Step>
<Step>
Select **Custom Trust Policy** and paste the following into the Trust Policy JSON editor, replacing `{ROOT_ID}` with the root ID from the main account, `ConductorOneService` with the role name from the root account, and `EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE` with the External ID from ConductorOne.
Select **Custom Trust Policy** and paste the following into the Trust Policy JSON editor:

```json
{
"Version": "2012-10-17",
"Statement": [
"Version": "2012-10-17",
"Statement": [
{
// The minimum permissions required for the connector to sync. This will sync IAM Users, Groups, and Roles
"Sid": "MinimumRequiredPermissionsSyncIAMUsersGroupsRoles",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:ListGroups",
"iam:ListRoles",
"iam:GetGroup",
"iam:GetRole",
// The following two permissions are only needed if you want ConductorOne to sync access key secret data
"iam:ListAccessKeys",
"iam:GetAccessKeyLastUsed"
],
"Resource": "*"
},
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::{ROOT_ID}:role/ConductorOneService"
// Optional: Include this statement if you enable "Enable support for AWS Organizations" checkbox in the ConductorOn e UI
Copy link
Contributor

@coderabbitai coderabbitai bot Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Typo: "ConductorOn e UI" should be "ConductorOne UI".

There's an errant space in the middle of "ConductorOne".

Suggested fix 
-          // Optional: Include this statement if you enable "Enable support for AWS Organizations" checkbox in the ConductorOn e UI
+          // Optional: Include this statement if you enable "Enable support for AWS Organizations" checkbox in the ConductorOne UI
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Optional: Include this statement if you enable "Enable support for AWS Organizations" checkbox in the ConductorOn e UI
// Optional: Include this statement if you enable "Enable support for AWS Organizations" checkbox in the ConductorOne UI
🤖 Prompt for AI Agents 
In @baton/aws-v2.mdx at line 93, Fix the typo in the documentation string that
currently reads "ConductorOn e UI" by removing the stray space and changing it
to "ConductorOne UI" wherever that exact phrase appears (e.g., the comment line
containing "// Optional: Include this statement if you enable "Enable support
for AWS Organizations" checkbox in the ConductorOn e UI"); update the text to
read "// Optional: Include this statement if you enable "Enable support for AWS
Organizations" checkbox in the ConductorOne UI".

"Sid": "OrganizationsSupport",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts",
"organizations:DescribeOrganization"
],
"Resource": "*"
},
"Action": "sts:AssumeRole"
{
// Optional: Include this statement if you want to use account aliases instead of numeric IDs
"Sid": "UseMoreDescriptiveAccountAliases",
"Effect": "Allow",
"Action": [
"iam:ListAccountAliases"
],
"Resource": "*"
}
]
]
}
```
Comment on lines +70 to 113
Copy link
Contributor

@coderabbitai coderabbitai bot Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Invalid JSON: Comments are not allowed in standard JSON.

The JSON block contains JavaScript-style comments (//), which are not valid JSON syntax. When users paste this directly into the AWS IAM Trust Policy JSON editor, it will fail to parse and be rejected.

Additionally, this appears to be structured as a Permissions Policy (with iam:List*, iam:Get* actions) rather than a Trust Policy. A Trust Policy should define who can assume the role using a Principal element and sts:AssumeRole action, similar to the SSO setup example at lines 246-264.

Consider:

  1. Moving the comments outside the JSON block as markdown explanations (like the notes section at lines 167-172)
  2. Providing the correct Trust Policy structure with Principal for cross-account access, then adding these permissions as an inline policy in the subsequent step
Example of valid Trust Policy structure (from SSO section) 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::765656841499:role/ConductorOneService"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE"
        }
      }
    }
  ]
}
🤖 Prompt for AI Agents 
In @baton/aws-v2.mdx around lines 70 - 113, The JSON shown is invalid because it
contains JavaScript-style comments and is the wrong type of policy: it lists
permissions (iam:List*, iam:Get*, etc.) which belong in an inline permissions
policy, not a Trust Policy; replace the code block with a valid Trust Policy
that includes a Principal and sts:AssumeRole (similar to the example using
"Principal": {"AWS": "arn:aws:iam::...:role/ConductorOneService"} and a
Condition for "sts:ExternalId"), move the iam:* actions out of the Trust Policy
and instead show them as a separate inline permissions policy in the next step,
and remove all // comments from any JSON blocks (put explanatory notes as
markdown text before/after the JSON instead).


**Notes on the Trust Policy:**
**"Action": "sts:AssumeRole"**: This is the core permission. It's the only action allowed by this policy, and it specifically allows the ConductorOne role in your root account to temporarily assume this role in the child account. Think of it like a temporary key that only the main account can use.
**"Principal": "arn:aws:iam::`{ROOT\_ID}`:role/ConductorOneService"**: This is the trusted entity. It specifies that only the ConductorOne role in your main root account is allowed to assume this role. This ensures that no other account can use this trust policy.
</Step>
<Step>
Click **Next**.
Expand Down