Choose how you connect#
CloudFormation is the preferred Managed Compliance path. Start from the customer-specific Quick Create link, not a generic template URL. The stack grants SecurityAudit plus the single Cost Explorer read action, and registers the connection with Transilience.
Prefer to approve each console action? The manual path creates the OIDC provider and audit role yourself. Its guide includes optional ECR read access when that evidence is in scope; it is not identical to the base CloudFormation profile.
Understand the identity model#
Customer AWS account → account-local OIDC provider → dedicated audit role → approved Transilience workload. The documented connector uses Modal-issued OIDC tokens exchanged for short-lived AWS credentials. Hosting these instructions on Cloudflare does not change that workload identity or its trust policy.
No IAM user or long-lived AWS access key is required for the automated assessment connector. Only the installer needs permissions to create the approved IAM, OIDC, Lambda, and CloudFormation resources. Transilience’s audit role does not inherit the installer’s administrative permissions.
One account or an organization?#
The base stack assesses the account where it is deployed. It does not silently enroll your AWS Organization. Read the multi-account design before deploying a central-security-account setup.
Need to give a person access too?#
Use Invite an engineer for an individual work-email invitation, account assignment, and permission-set selection. This is optional and separate from the platform connector.