AWS
Connect an AWS account to Trace with a read-only cross-account IAM role for cloud asset inventory and pentest context.
Trace connects to AWS using a cross-account IAM role with read-only permissions, so it can inventory what you've deployed and understand how your application is actually reachable. Nothing in your AWS account changes; Trace only reads.
How it works
- From Settings → Integrations → AWS in the dashboard, generate the onboarding artifacts. Trace produces an external ID unique to your organization and a CloudFormation template that creates a read-only role.
- Deploy the CloudFormation stack in your AWS account. The template creates an IAM role scoped to the external ID, so only Trace can assume it.
- Paste the role ARN back into the dashboard. Trace verifies access through AWS STS and starts the initial sync.
- Trace inventories your account on a recurring basis: accounts, regions, key resource types, and the relationships between them. Public-facing resources are tagged so you can spot them at a glance.
What Trace sees
Trace's IAM role grants read-only access. We can list and describe your cloud resources; we cannot create, modify, or delete anything. The CloudFormation template is published with your onboarding artifacts so you can audit every permission before deploying.
When you disconnect, Trace retains your inventory for a fixed grace period (visible on the integration page) so you don't lose context if you reconnect, then deletes it.
Why connect AWS
Source code alone can't tell you what's actually reachable in your live environment. Cloud inventory closes that gap: Trace flags resources exposed to the internet (public services, open ports, reachable databases, open storage buckets, serverless function URLs, and exposed management endpoints) that never show up in source alone. During a penetration test, Trace uses your real topology (which services are public, which paths connect to them, where a data store actually sits) to confirm whether a weakness is genuinely reachable and exploitable, rather than only theoretically vulnerable. All cloud access during an engagement stays read-only and short-lived; Trace never modifies your cloud.
GCP is supported — see the GCP integration. Support for Azure is on the roadmap; reach out to the Trace team if you'd like early access.