Security

What ezGRC can see in your AWS account

You connect AWS by deploying our CloudFormation template, which creates one read-only IAM role in your account. This page shows exactly what that role allows. The policy below is generated by the same code our collectors use, so it can't drift from what we actually call.

ezGRC can read

Configuration metadata: IAM users, roles, policies, MFA and access-key age; EC2, VPC, security groups and volumes; RDS instances and snapshots; S3 bucket settings (encryption, versioning, public-access block, policy).
Security findings and status from Security Hub, AWS Config rules and CloudTrail (trail status and event history).
AWS Artifact compliance reports and agreements, and your Organization's account list if you connect the management account.

ezGRC cannot

Create, change or delete anything. Every permission is a Describe, Get, List or Lookup call.
Read your data: no S3 object contents, database rows, secret or parameter values, KMS decryption, function code or log contents.
Act outside your account or assume any other role. The role trusts only ezGRC's service principal, and only with your External ID.

The External ID

Each connection gets its own random External ID. Your role only lets ezGRC in when the request carries that ID, so nobody else using ezGRC can trick our service into reading your account (the "confused deputy" problem). When you launch the stack from ezGRC's one-click setup, the ID is filled in for you.

Revoking access

Delete the CloudFormation stack and the role is gone; ezGRC loses access immediately. Removing the integration in ezGRC also stops all collection on our side.

aws cloudformation delete-stack --stack-name ezGRC-Scanning

The exact policy

Loading policy