Skip to main content
The AWS integration discovers IAM users, S3 buckets, and your account identity via STS. Use it to maintain a complete cloud infrastructure inventory and generate compliance evidence for access-control and asset-management controls in Axiom Codex.

​
What you’ll need

  • AWS account with permission to create an IAM user (or IAM role for cross-account access).
  • Three minutes.

​
Set it up

1

Create an IAM user in AWS

In the AWS Console, go to IAM → Users → Add users.
  • Name: axiom-layer-readonly
  • Access type: Programmatic access
On the permissions step, attach the AWS-managed policy ReadOnlyAccess (or use the trimmed policy below if you want least privilege).
2

Save the access key

On the final step, copy the Access key ID and Secret access key. The secret is only shown once.
3

Paste into Layer

In Layer, go to Integrations, find AWS, and click Connect. Paste the Access Key ID, Secret Access Key, and your default region (e.g. us-east-1). Click Connect.
4

Wait for the first sync

The initial sync pulls your account identity, IAM users, and S3 bucket inventory. Typically finishes in under 10 minutes.

​
Least-privilege policy

If you don’t want to grant ReadOnlyAccess, attach this trimmed policy instead: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "iam:ListUsers",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    }
  ]
}

​
What gets synced

ObjectFieldsRefresh cadence
Account identityaccount ID, regionDaily
IAM usersusernameDaily
S3 bucketsbucket nameDaily

​
Compliance evidence

AWS data generates evidence records for the following SOC 2 controls:
EvidenceControls
IAM user inventoryCC6.1, CC6.2, CC6.3
S3 bucket inventoryCC6.6, CC6.7
See the SOC 2 evidence catalog for full control descriptions.

​
Troubleshooting

Verify the IAM user has the permissions listed in the least-privilege policy above. If you’re using a more restrictive policy, confirm that sts:GetCallerIdentity, iam:ListUsers, and s3:ListAllMyBuckets are all allowed.
Cross-account role support is on the roadmap. Email support@axiomancer.io to be notified when it ships.