AWS Scanner

The AWS Scanner is a native scanner type that inspects a connected AWS account, discovering the full inventory of identities such as IAM users, roles, and groups, secrets stored in AWS Secrets Manager, and certificates managed through AWS Certificate Manager, along with the relationships between them. Each discovered object is evaluated against Identity & Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 4.53.0 and later.
• A Gateway with Akeyless AI Insights configured.
• An AWS Target representing the AWS IAM Role that will scan the account.
• The AWS IAM Role used by the Target granted the permissions listed under AWS Service Account Permissions below.
• Access to configure and run the scanner, granted via:
  1. "Manage ISI Scanners" or "Admin" Gateway Permission.
  2. "Identity & Secrets Intelligence" Administrative Rule set to Scoped or All.
  3. "List" permission on the AWS Target.
     

Required AWS Permissions

The AWS IAM Role used by the Target needs read access to your AWS environment. There are two ways to grant it:

• Quick Setup - attach broad AWS-managed policies. Fastest to configure, but grants more access than the scanner actually uses.
• Granular Permissions - attach only the exact actions the scanner needs, following the principle of least privilege.

Both produce a complete scan, the difference is privilege scope, not scan coverage.

Quick Setup

Attach the AWS-managed policies IAMReadOnlyAccess and AWSCertificateManagerReadOnly, plus this custom read-only Secrets Manager policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:GetResourcePolicy"
      ],
      "Resource": "*"
    }
  ]
}

"Resource": "*" above gives full coverage but can be scoped down, anything out of scope is simply reported as a gap in the Access Status.

Granular Permissions

All permissions below are read-only. The scanner never requires write access to your AWS environment, and never reads secret values, only metadata.

Required Permissions

The permissions listed below are required for the scan to complete successfully. If any one of them is missing, the corresponding scan will fail.

Additional Permissions for Complete Coverage

These permissions are optional. If missing, the scan still completes, but with reduced visibility, and any gaps are reported in the Access Status field within the scan details.

Create an AWS Scanner in the Akeyless Console

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type AWS, then click Next.
3. Define a Name for the scanner.
4. Select the Target representing the AWS account to scan, and the Gateway that will execute the scans, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the AWS scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.