Skip to main content

Link your first AWS account

GuardKite scans your AWS account through a read-only IAM role. Linking an account means deploying a small CloudFormation stack that creates that role.

For exactly what the role can and can't do, see What GuardKite needs from your account.

Accept your invitation​

GuardKite accounts are by invitation. Once your organization is set up, you'll receive an invitation email.

  1. Click the link in the email. It's valid for two days.
  2. Set a password, or continue with Google or Microsoft using the address the invitation was sent to.

From then on, sign in at platform.guardkite.com.

info

Don't have an invitation yet? Get in touch and we'll set up your organization.

When you sign in for the first time, the Add an AWS Account wizard appears.

info

Sign in to the AWS account you're linking before starting. The wizard opens AWS CloudFormation in a new tab, and that tab uses your current AWS session.

  1. Enter your 12-digit AWS Account ID and click Go to AWS. A new tab opens in the AWS CloudFormation console with the GuardKite template pre-loaded.
  2. Tick the Capabilities checkbox in the AWS console and click Create Stack.
  3. Wait for CREATE_COMPLETE, then return to the GuardKite tab.

GuardKite starts its first scan as soon as the stack is created.

Initial scan​

The initial scan takes up to five minutes. You'll receive an email when it finishes.

When it's done, head to Review your first findings.

Advanced: manual deployment​

Prefer to deploy the role yourself? In the wizard, expand Detailed Steps to download the CloudFormation template directly. Deploy it through the AWS Console (or your IaC tool of choice), supplying the External ID shown in the wizard.

The Cross-account IAM role page has the full policy reference.