Set up an AWS Account Access Manager connector

Capabilities

The AWS Account Access Manager connector syncs the following resources:

Resource	Sync	Provision
Applications
Roles

This connector emits Role grants whose principal is an AWS Identity Center user or group, but it has no Identity Center sync of its own — so those grants carry an ExternalResourceMatchID annotation and the platform correlates them against whatever other connector (for example, an AWS Identity Center connector) already syncs that same identity. Once correlation runs, every grant principal is that connector’s own user or group resource.The two placeholder resource types this uses are declared internally only to supply the principal resource-type IDs, and have no syncer, so they are not capabilities and do not appear above.An Identity Center connector is a prerequisite, not an optimisation. This connector declares that it requires an external connector, so a ConductorOne-hosted sync with none configured fails outright rather than completing with unresolved principals. If a sync errors saying an external connector is required, pair this connector with one that syncs the same IAM Identity Center instance.

Stale access can linger in AWS after you remove something. Account Access Manager does not clean entitlements up on its own, so an assignment survives the deletion of the IAM role it points at, and the removal of the user or group from IAM Identity Center. Those rows keep appearing in synced grants until someone revokes them. Renaming an AWS account is not reflected either — the account name captured when the assignment was created is the one you will see.

Gather AWS Account Access Manager credentials

To configure the AWS Account Access Manager connector, you need IAM administrator permissions in the AWS account or organization where Account Access Manager is enabled.

C1 reaches your AWS account through an IAM role that you create and that trusts ConductorOne. You hand over no long-lived credentials, and you revoke access by editing that one trust policy. This is the only option for a C1-hosted connector — the access key fields are not offered there.

In C1, open the connector’s Settings and copy the value of AWS Role External ID. You will paste it into the trust policy below.

Navigate to the IAM Dashboard and select Roles > Create role.

Select Custom trust policy and paste the following into the trust policy JSON editor, replacing EXTERNAL_ID_FROM_C1 with the External ID you copied from C1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::765656841499:role/ConductorOneService"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "EXTERNAL_ID_FROM_C1"
        }
      }
    }
  ]
}

Notes on the trust policy:"Principal": arn:aws:iam::765656841499:role/ConductorOneService is ConductorOne’s isolated AWS service account. It is the only entity this policy trusts, so no other account can assume the role."Action": "sts:AssumeRole": the only action allowed, and it lets ConductorOne take a temporary session in your account rather than hold a standing credential."Condition" on sts:ExternalId: a shared identifier confirming which trust relationship is in use, which is what prevents the confused deputy problem. It must match character for character.

Click Next, then attach the permissions policy from the next step (or skip Add permissions and attach it afterwards).

Give the role a name, add any tags relevant to your organization, and click Create role. Open the new role and copy its ARN — that is the value for AWS Role ARN in C1.

Attach a policy granting account-access:ListApplications, account-access:GetApplication, account-access:ListEntitlements, account-access:CreateEntitlement, and account-access:DeleteEntitlement, plus organizations:ListAccounts. sso:ListInstances is optional but recommended. organizations:ListAccounts is what lets the connector find the accounts to look for role assignments in; without it no roles are discovered. organizations:ListAccounts is not only an IAM question: AWS answers it from the organization’s management account or a delegated administrator, and refuses it from an ordinary member account whatever the policy grants. So the connector has to run from one of those two. sso:ListInstances (the IAM prefix for IAM Identity Center is sso, not sso-admin, which is only the SDK’s name for the API) is used only at setup, to confirm the Identity Store ID you enter is really this account’s. Setup never fails over it: with the permission the connector can tell you when the ID is not one this account can see, and without it that check simply does not run. Granting it is still worth doing, because a wrong ID is otherwise invisible — the sync succeeds, the roles appear, and every grant silently disappears. If you cannot see the connector’s logs, you can check it yourself: the ID here must match the Identity Store ID in the IAM Identity Center console under Settings, and a sync that produces roles but no grants is the symptom of a mismatch.

For every IAM role you intend to grant access to through Account Access Manager, add a trust policy statement allowing the account-access.amazonaws.com service principal to sts:AssumeRole and sts:SetContext, with a Condition block matching aws:SourceAccount and aws:SourceArn for your application — without it, granting access to that role fails with a validation error.

If a sync later fails with AccessDenied: ... is not authorized to perform: sts:AssumeRole, check the external ID before changing any permissions. AWS returns that same message for a mismatched sts:ExternalId as it does for a role that genuinely denies access. The connector’s error names which hop failed and which field feeds it. Regenerating the External ID in C1 means updating this trust policy too.

Look up the AWS Identity Store ID (Identity Center console → Settings, format d-xxxxxxxxxx) backing this Application’s Identity Center instance, and copy the role ARN and Identity Store ID for the configuration step below.

Make sure a connector that syncs the same IAM Identity Center instance is already set up in C1 — an AWS connector with Identity Center enabled, for example. This connector emits every role grant against an Identity Center user or group and syncs none of those identities itself, so without that pair there is nothing to correlate the grants to and the sync fails.

Configure the AWS Account Access Manager connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for AWS Account Access Manager and click Add.

Choose how to set up the new AWS Account Access Manager connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

Find the Settings area of the page and click Edit.

Enter the required configuration:

AWS Region: the primary region of your IAM Identity Center instance. Account access manager must be enabled in that same region.
Identity Store ID (required): the Identity Store ID for your IAM Identity Center instance, from the AWS IAM Identity Center console under Settings. Format d-1234567890, or a UUID if migrated from legacy AWS SSO. It must be the same identity store your AWS connector syncs.
Application ARN (optional): scope sync to a single Application. Leave blank to sync every Application visible to the credentials below.
AWS Role ARN / AWS Role External ID: the role C1 assumes in your account, and the external ID its trust policy must require.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your AWS Account Access Manager connector is now pulling access data into C1.

Follow these instructions to use the AWS Account Access Manager connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new AWS Account Access Manager connector

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new AWS Account Access Manager connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your AWS Account Access Manager connector deployment:

Secrets configuration

# baton-aws-account-access-manager-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-aws-account-access-manager-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # AWS Account Access Manager credentials
  BATON_REGION: <primary region of your IAM Identity Center instance>
  BATON_IDENTITY_STORE_ID: <identity store ID, e.g. d-1234567890>

  # Credentials: a static key pair, or omit both to use the ambient AWS
  # credential chain (instance role, IRSA). Add BATON_ROLE_ARN, and
  # BATON_EXTERNAL_ID if the role's trust policy requires one, to assume a
  # role on top of either.
  BATON_ACCESS_KEY_ID: <AWS access key ID>
  BATON_SECRET_ACCESS_KEY: <AWS secret access key>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-aws-account-access-manager.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-aws-account-access-manager
  labels:
    app: baton-aws-account-access-manager
spec:
  selector:
    matchLabels:
      app: baton-aws-account-access-manager
  template:
    metadata:
      labels:
        app: baton-aws-account-access-manager
        baton: "true"
        baton-app: aws-account-access-manager
    spec:
      containers:
      - name: baton-aws-account-access-manager
        image: public.ecr.aws/conductorone/baton-aws-account-access-manager:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-aws-account-access-manager
        envFrom:
        - secretRef:
            name: baton-aws-account-access-manager-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the AWS Account Access Manager connector to. AWS Account Access Manager data should be found on the Entitlements and Resources tabs.

Done. Your AWS Account Access Manager connector is now pulling access data into C1.

All versions of this connector are available at dist.conductorone.com.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up an AWS Account Access Manager connector

Capabilities

Gather AWS Account Access Manager credentials

Configure the AWS Account Access Manager connector

Step 1: Set up a new AWS Account Access Manager connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Gather AWS Account Access Manager credentials

​Configure the AWS Account Access Manager connector

​Step 1: Set up a new AWS Account Access Manager connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather AWS Account Access Manager credentials

Configure the AWS Account Access Manager connector

Step 1: Set up a new AWS Account Access Manager connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector