Connect AWS
Vigil assesses AWS with Prowler against CIS, NIST and PCI benchmarks. It connects through a read-only cross-account IAM role gated by a unique external ID — Vigil never stores your AWS keys.
What you need
- An AWS administrator who can create an IAM role (one-time).
- Nothing to install — Vigil assumes a read-only role; no keys are ever shared or stored.
Option A — CloudFormation (fastest)
- In Vigil, go to Settings → Integrations and click Connect AWS.
- Click Launch stack in AWS Console — the template arrives pre-filled with Vigil's scanner account ID and your unique external ID.
- Acknowledge the IAM capabilities checkbox and click Create stack.
- Open the stack's Outputs tab and copy the RoleArn.
- Paste the Role ARN back into Vigil and click Connect, then Run check.
Option B — create the role manually
- In IAM, choose Create role → Custom trust policy and paste the trust policy shown in Vigil's connect panel. It permits only Vigil's scanner account to assume the role, gated by your unique external ID.
- Attach the AWS-managed policies SecurityAudit and ViewOnlyAccess.
- Name the role (e.g.
VigilScanner) and create it. - Paste the role's ARN into Vigil and click Connect.
The external ID is what stops a confused-deputy attack: even if someone learned Vigil's scanner account ID, they could not assume your role without your unique external ID.
What it covers
An AWS scan contributes verified evidence to your Cloud domain, with some Network and Monitoring signal. Vigil automatically scopes the scan to the regions that actually contain workloads, so scans stay fast; global services such as IAM are always assessed.
Stuck on something this doesn't answer?Email support