Skip to main content

​
AWS Connector

Flare connects to AWS by assuming a read-only IAM role in your account. The role uses a connector-specific ExternalId and short-lived credentials. You never create or share an AWS access key.

​
Current coverage

The live connector reads recent regional CloudTrail management event history through cloudtrail:LookupEvents.
The live connector does not currently query CloudTrail Lake, S3 trail files, data events, or organization-wide trails. You can still analyze exported CloudTrail files through File Upload.

​
Required AWS permission

The customer role needs one action:
LookupEvents does not support resource-level permissions, so AWS requires "Resource": "*". The policy grants no write actions.

​
Connecting

  1. Go to Connectors in Flare
  2. Select Amazon Web Services
  3. Click Generate role instructions
  4. Keep the Flare page open; it displays a unique ExternalId and generated policies for this connector
  5. In AWS, open IAM > Roles > Create role and create the recommended read-only role
  6. Use Flare’s generated trust policy as the role’s trust relationship
  7. Attach Flare’s generated CloudTrail permissions policy
  8. Copy the completed role ARN from AWS
  9. In Flare, paste the role ARN, select the CloudTrail event-history Region, and click Test and connect AWS
Copy the policies generated for your connector. Do not reuse an ExternalId from another account or connector.

​
Trust relationship

The generated trust policy allows Flare’s AWS runtime role to call sts:AssumeRole only when it supplies your connector’s ExternalId. It follows this structure:
The trust relationship answers who may assume the role and under what conditions. The permissions policy answers what the assumed role may do. They are separate IAM documents and both are required.

​
Running an analysis

  1. Go to Analyses > New Analysis
  2. Select AWS CloudTrail
  3. Choose Fetch live
  4. Confirm the connected account and Region
  5. Select a time window
  6. Click Fetch & Analyze
Flare shows a truncation notice if more events were available than the analysis fetched.

​
Disconnecting

Disconnecting the AWS connector removes the stored role ARN, ExternalId, Region, and account metadata from Flare. Your existing analysis history remains. For immediate revocation in AWS, delete the customer role or remove Flare’s principal from its trust relationship.

​
Troubleshooting

Confirm that you pasted the full ARN for the role you just created, not the Flare runtime role. Then verify that the role trust relationship contains Flare’s generated principal, sts:AssumeRole, and the exact connector ExternalId.
Check both sides of the role chain: the customer role must trust Flare’s runtime role, and the Flare runtime role must be allowed to assume the exact customer role ARN. If the AWS role name changed, update the connector with the new ARN.
Verify the selected AWS Region and try a wider time window. CloudTrail event history is regional and contains management events, so activity in another Region or data-event-only activity will not appear.
The role may have been deleted, renamed, or had its trust or permissions policy changed. Restore the generated policies or reconnect AWS with the current role ARN.
Need more help? Visit Flare Support and include the AWS account ID, Region, role name, and exact error message. Never send access keys or session credentials.