Skip to main content

AWS

Credentials​

Mantle uses an assumable IAM role. Mantle does not store AWS access keys.

The read credential has a role ARN, a Mantle external ID, and a session name. The read session name is mantle-read.


An optional write credential uses the same shape. The write session name is mantle-write. AWS is the only connector that accepts a write credential.

  1. Create the integration. Enter a display name and a 12-digit AWS account ID.
  2. Select the services that Mantle reads.
  3. Create the IAM role in AWS. Use the trust policy and the permissions policy that Mantle generates. The trust policy allows the Mantle broker principal to assume the role only with the Mantle external ID. See Trust policy and Permissions policy.
  4. Enter the read role ARN. Enter a write role ARN only if write access is required. a. Note: we do not currently have any features requiring write permissions in mantle.
  5. Run the checks.

The integration starts in Draft. After you save the read credential, the status is Unverified. After the checks pass, the status is Connected. The backend then starts the first sync.

Discovery and adoption apply to a Connected AWS integration with management metadata set to true.

  1. Discover member accounts. The list excludes the management account.
  2. Adopt a member account. Mantle creates a child integration. The child read credential uses arn:aws:iam::{account}:role/MantleAuditRole, the family external ID, and session name mantle-audit. The child starts as Unverified. Run the checks. The daily sweep does not include Unverified integrations.

Backend checks​

If the checks pass, the status is Connected. If a Connected integration fails a later check, the status is Action needed.

The backend runs these live checks on the read role:

  • aws.role_assumable: assume the role with the Mantle external ID.
  • aws.confused_deputy_guard: refuse assume of the role without the Mantle external ID.

The backend runs a daily verification sweep on Connected and Action needed integrations.

Trust policy​

Mantle generates this trust policy during setup. Use the generated document. The broker principal and the Mantle external ID are unique to your integration.

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your-external-id>"
        }
      },
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::724937262053:root"
      }
    }
  ],
  "Version": "2012-10-17"
}

Permissions policy​

Mantle generates this permissions policy from the services you select. The document below includes the default services: IAM, S3, EC2, Lambda, and KMS. Every policy also includes ec2:DescribeRegions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MantleAuditRead",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ec2:DescribeRegions",
        "iam:GenerateCredentialReport",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:Get*",
        "iam:List*",
        "kms:Describe*",
        "kms:GetKeyRotationStatus",
        "kms:List*",
        "lambda:GetAccountSettings",
        "lambda:GetPolicy",
        "lambda:List*",
        "s3:GetAccountPublicAccessBlock",
        "s3:GetBucket*",
        "s3:GetEncryptionConfiguration",
        "s3:ListAllMyBuckets",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}