AWS setup — IAM role + External ID.

The full handshake when Axiom assumes the role:

• You create a role in your account with our trust policy (Axiom AWS account + your External ID)
• You attach the read-only permission policy (below)
• You paste the Role ARN into Axiom
• Axiom calls sts:AssumeRole with the External ID — only succeeds if both match
• Axiom receives temporary credentials valid for 1 hour, used only for the scan
• When credentials expire, they are discarded — never persisted

If your organization disallows CloudFormation auto-deploys, create the role manually:

trust policy{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::AXIOM_ACCOUNT_ID:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID_HERE"
        }
      }
    }
  ]
}

permission policy{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AxiomReadOnlyOps",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "s3:GetBucket*",
        "s3:ListBucket",
        "s3:ListAllMyBuckets",
        "rds:Describe*",
        "rds:ListTagsForResource",
        "iam:Get*",
        "iam:List*",
        "iam:Simulate*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "cloudwatch:Describe*",
        "logs:Describe*",
        "logs:Get*",
        "logs:List*",
        "ce:Get*",
        "ce:List*",
        "sts:GetCallerIdentity",
        "tag:GetResources"
      ],
      "Resource": "*"
    }
  ]
}

Every action in the policy maps to a specific Axiom capability. Nothing is requested speculatively.

• ec2:Describe*

  Enumerate EC2 instances, volumes, security groups, VPCs, NAT gateways, ELBs for inventory + rightsizing.

• s3:GetBucket* / ListBucket

  Detect public buckets, encryption settings, lifecycle rules, versioning posture. We never read object contents.

• rds:Describe* / ListTagsForResource

  Inventory RDS instances and clusters; identify oversized DBs, missing backups, unencrypted instances.

• iam:Get* / List* / Simulate*

  Audit IAM roles, policies, and trust relationships for over-permissive grants. Simulate is read-only policy analysis.

• cloudwatch:Get* / List* / Describe*

  Pull utilization metrics for rightsizing recommendations.

• logs:Describe* / Get* / List*

  Detect missing or stale log groups, retention misconfigurations.

• ce:Get* / List*

  Cost Explorer signals — used to validate that cost optimizations land in your actual bill.

• sts:GetCallerIdentity

  Confirms successful role assumption during the connection test.

• tag:GetResources

  Aggregate cross-service tag inventory for ownership graphs.

• Create, modify, or delete any resource
• Read object content in S3 buckets (only metadata — encryption, ACL, lifecycle)
• Read database row contents in RDS (only configuration metadata)
• Decrypt secrets in Secrets Manager or KMS
• Modify IAM policies, users, roles, or permission boundaries
• Launch, stop, or modify EC2 instances
• Access CloudTrail data history (only configuration)

For execution flows (Agent tier and above), Axiom uses a separate, more-scoped role that you create per-action — never the read-only scan role. See permissions model (doc coming).

• AccessDenied (sts:AssumeRole)

  Trust policy is missing or has wrong Axiom account ID. Recopy the trust policy from the onboarding screen.

• InvalidExternalId

  External ID in the trust policy condition doesn't match what Axiom sent. Re-paste from the onboarding screen exactly.

• MalformedPolicyDocumentException

  JSON syntax error in the trust or permission policy. Use AWS Console's built-in validator before saving.

• Empty scan result

  Either the role has no permission to describe resources, or no resources exist in the selected regions. Verify with sts:GetCallerIdentity in CloudShell.

See the full troubleshooting guide for additional scenarios.