InfraSync scans your AWS account with read-only access and generates Terraform plus cost-optimization recommendations. It never creates, modifies, or deletes your AWS resources. This page shows the two ways to connect — read-only access keys (fastest) and a cross-account role (most secure) — and how to set up each one in the AWS console, with the AWS CLI, or — for the cross-account role — a single CloudFormation stack.

What access InfraSync needs

For scanning and cost analysis, InfraSync is read-only — it never creates, modifies, or deletes your AWS resources. The AWS-managed ReadOnlyAccess policy covers all of it:

  • Scanner (Terraformer) — Get* / List* / Describe* across EC2, S3, RDS, IAM, VPC, Lambda, ECS, EKS, and the rest of the ~89 supported services, to build your Terraform.
  • Cost optimizer — compute-optimizer:Get*, ce:Get* (Cost Explorer / Savings Plans), and ec2:Describe* for right-sizing and idle-resource findings.

Attach ReadOnlyAccess and you're done. It's a superset of everything above and stays correct as AWS adds services — a hand-built action list eventually misses one and breaks a scan. And you don't have to get it perfect: InfraSync validates access when you connect, and again before every scan, and if a permission is missing it tells you the exact action to add.

Two optional permissions

Only needed if you use the feature they unlock. Each is a single, narrowly-scoped permission added alongside ReadOnlyAccess — neither touches your actual infrastructure.

1 · Let InfraSync enable AWS Compute Optimizer. Only if you want the Enable Compute Optimizer button to opt your account in (otherwise enable it yourself in the AWS console). Without it, everything works except that one button.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "compute-optimizer:UpdateEnrollmentStatus",
    "Resource": "*"
  }]
}

2 · Store Terraform state in your own S3 bucket. Only if you turn on the S3 remote-state backend with a bucket you own. InfraSync writes the generated terraform.tfstate there using the credentials you connected, so that role or user needs write access to that one bucket. ReadOnlyAccess already allows the reads — this adds the writes. State locking is S3-native, so there's no DynamoDB table to create.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::YOUR_TFSTATE_BUCKET",
      "arn:aws:s3:::YOUR_TFSTATE_BUCKET/*"
    ]
  }]
}

Using an encrypted (SSE-KMS) backend? Also allow kms:Decrypt and kms:GenerateDataKey on that key. See our read-only IAM guide for the deeper why.

Option A — read-only access keys (fastest)

Create an IAM user with the AWS-managed ReadOnlyAccess policy and an access key you paste into InfraSync. Works immediately.

In the AWS console

  1. IAM → Users → Create user (e.g. infrasync-readonly), without console access.
  2. Attach the ReadOnlyAccess managed policy directly.
  3. Open the user → Security credentials → Create access key → Third-party service.
  4. Copy the access key ID and secret access key.

With the AWS CLI

aws iam create-user --user-name infrasync-readonly

aws iam attach-user-policy \
  --user-name infrasync-readonly \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Prints the access key ID and secret — paste both into InfraSync
aws iam create-access-key --user-name infrasync-readonly \
  --query "AccessKey.[AccessKeyId,SecretAccessKey]" --output table

The secret access key is shown only once. If you lose it, delete the access key and create a new one.

Option B — cross-account role (no shared keys)

Instead of sharing keys, you create a read-only role that InfraSync assumes for short-lived credentials — nothing long-lived is stored, and you revoke access instantly by deleting the role. The role trusts InfraSync's AWS account and is scoped by an external ID (a per-account secret that prevents the confused-deputy problem).

Start in InfraSync

The external ID is generated per account, so begin in the app:

  1. Open Connect your account in InfraSync and choose Cross-account role as the connection method.
  2. InfraSync shows two values — its AWS account ID (529928147507, the trusted principal) and a unique external ID for this account. Keep both for the next step.

Create the role — in the AWS console

  1. IAM → Roles → Create role → Custom trust policy.
  2. Paste the trust policy below, replacing the external ID with the one InfraSync showed you.
  3. Attach the ReadOnlyAccess managed policy, name the role (e.g. infrasync-readonly-role), and create it.
  4. Open the role and copy its Role ARN (arn:aws:iam::<your-account>:role/infrasync-readonly-role).
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::529928147507:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<external-id-from-infrasync>" }
      }
    }
  ]
}

Or with the AWS CLI

# 1. Save the trust policy (use the external ID InfraSync showed you)
cat > infrasync-trust.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::529928147507:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "EXTERNAL_ID_FROM_INFRASYNC" } }
  }]
}
JSON

# 2. Create the role and attach ReadOnlyAccess
aws iam create-role \
  --role-name infrasync-readonly-role \
  --assume-role-policy-document file://infrasync-trust.json

aws iam attach-role-policy \
  --role-name infrasync-readonly-role \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# 3. Print the Role ARN to paste into InfraSync
aws iam get-role --role-name infrasync-readonly-role \
  --query "Role.Arn" --output text

Or with CloudFormation (one stack)

Prefer a single deploy over manual steps? This template creates the same role — trust policy, external-ID condition, and ReadOnlyAccess — and prints the Role ARN as a stack output. Download the template, or copy it below.

AWSTemplateFormatVersion: "2010-09-09"
Description: "InfraSync read-only cross-account role."

Parameters:
  ExternalId:
    Type: String
    NoEcho: true
    Description: "The External ID InfraSync showed you for this account."
  RoleName:
    Type: String
    Default: "infrasync-readonly-role"

Resources:
  InfraSyncReadOnlyRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: "arn:aws:iam::529928147507:root"
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": !Ref ExternalId
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"

Outputs:
  RoleArn:
    Description: "Paste this Role ARN into InfraSync."
    Value: !GetAtt InfraSyncReadOnlyRole.Arn

In the AWS console: go to CloudFormation → Create stack → With new resources, choose Upload a template file and select the file above. Enter the External ID InfraSync showed you, tick the box acknowledging that CloudFormation may create named IAM resources, and create the stack. When it reaches CREATE_COMPLETE, open the Outputs tab and copy RoleArn.

Or with the AWS CLI (save the template as infrasync-readonly-role.yaml first):

# Deploy the stack — creates the role and attaches ReadOnlyAccess
aws cloudformation deploy \
  --template-file infrasync-readonly-role.yaml \
  --stack-name infrasync-readonly-role \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides ExternalId=EXTERNAL_ID_FROM_INFRASYNC

# Print the Role ARN to paste into InfraSync
aws cloudformation describe-stacks \
  --stack-name infrasync-readonly-role \
  --query "Stacks[0].Outputs[?OutputKey=='RoleArn'].OutputValue" \
  --output text

Back in InfraSync, paste the Role ARN and save. The trust policy lets only InfraSync's account assume the role, and only when it presents your external ID.

Add it to InfraSync

  1. In InfraSync, open Connect your account.
  2. Paste your access key + secret (Option A) or role ARN (Option B), and pick a default region.
  3. Save — InfraSync validates the credentials and you're ready to run your first scan.

Read-only access you control.

InfraSync only ever reads your AWS account to generate Terraform and cost insights — and you can revoke its access at any time.

Start a free scan

FAQ

What permissions does InfraSync need?

For scanning and cost analysis it's read-only — the AWS-managed ReadOnlyAccess policy covers the scanner and the cost-optimizer, and InfraSync never creates, modifies, or deletes your resources. Two features each need one extra, narrowly-scoped permission: the Enable Compute Optimizer button (compute-optimizer:UpdateEnrollmentStatus), and storing Terraform state in your own S3 bucket (s3:PutObject on that bucket). Both are optional — see the optional permissions above.

Should I use access keys or a cross-account role?

Access keys are simplest and work immediately. A cross-account role is more secure — InfraSync assumes it for short-lived credentials, nothing long-lived is stored, and you revoke access by deleting the role. Roles are scoped by an external ID.

Can I revoke access later?

Yes. Delete the IAM user or access key (Option A), or delete the role (Option B), and InfraSync immediately loses access — account-wide, no leftover secrets.

#aws#iam#onboarding#cross-account-role#read-only#getting-started