AWS IAM
Description
AWS Identity and Access Management is the service that holds the users, groups, roles and policies of an AWS account — who can sign in, and what they are allowed to do once they have.
Connecting AWS IAM to Improvado brings two of those things into your warehouse: the list of IAM users in the account, and the metadata of their access keys — key ID, status and creation date. Held next to the rest of your business data, that is what makes questions like which keys have gone stale, or how account membership has drifted over a quarter, answerable from a report rather than from a console session.
Setup guide
Follow our setup guide to connect AWS IAM to Improvado.
Click the Connections in the left navigation bar.
Categories on the Data sources page group all available platforms. Use a search to find the required one.
Click on the AWS IAM tile.
Authorize your AWS account using the fields below:
- Access Key ID — required. The access key ID of the IAM user, for example
AKIAIOSFODNN7EXAMPLE. - Secret Access Key — required. The secret shown when that access key was created.
- AWS Region — optional, defaults to
us-east-1. IAM itself is global; the region only affects how the request is signed. - Session Token — optional. Fill this in only when you are using temporary credentials issued by AWS STS.
- Environment — optional. A label of your choice to tell one AWS environment from another, for example
production.
Open the AWS IAM console and choose Users in the navigation pane. Use an existing IAM user or create one for Improvado.
Give that user read access. The ReadOnlyAccess managed policy is enough; if you prefer a minimal policy, grant iam:GetUser, iam:ListUsers and iam:ListAccessKeys.
Open the user, go to the Security credentials tab, and in the Access keys section click Create access key.
On the Access key best practices & alternatives page, choose Other and click Next. A description tag on the next page is optional.
Click Show to reveal the secret access key, or Download .csv file, and enter both values into the Improvado authorization form.
iam:GetUser is called once to verify the credentials when you connect; iam:ListUsers and iam:ListAccessKeys are what the two report types use. Nothing in your AWS account is created, changed or deleted through this connection, and no secret access key of yours is ever read — the Access Keys report returns key IDs, status and dates only.
AWS describes the same flow in How an IAM administrator can manage IAM user access keys.
After completing the connection process, the AWS IAM connection will appear in your Connected sources list.
When the connection status is Active, and the account status column shows a number of accounts, you can move on to data extraction.
To extract data from the connected sources, check the instructions on how to set up data extraction.
Schema information
The schema information shows all report types you can use to extract data from AWS IAM.
Troubleshooting
The connection fails with a permission error. AWS answers 403 both when the key itself is wrong and when the policy is too narrow, so check the two in order: first that the Access Key ID and Secret Access Key were copied whole and belong to the same key, then that the user carries iam:GetUser, iam:ListUsers and iam:ListAccessKeys.
The connection worked and then stopped. An access key that has been deactivated or deleted in AWS stops working immediately. Check the key's status on the user's Security credentials tab; if it was rotated, create a new key and update the connection.
You are using temporary credentials. Credentials issued by AWS STS expire — usually within hours. Fill in Session Token for them to work at all, and expect to re-enter all three values each time they are reissued. A long-lived IAM user access key is the better fit for a scheduled extraction.
Release notes
You can find information about the latest changes in the AWS IAM document history.
Was this article helpful?
Thanks for the feedback!