AWS

AWS Configuration

Manage your Amazon Web Services integration securely.

Local AWS Credentials If you run Stratum locally, it mounts your host's ~/.aws directory. You can specify a specific AWS Profile. If left blank, it defaults to your environment securely.

IAM PassRole (Optional) You can bind an IAM Role ARN that trusts Stratum's execution context with an External ID, and provide the generated IAM Instance Profile Name for temporary scan/build instances.

Required Permissions The IAM Role must have policies granting the following actions for the build pipeline:

ec2:RunInstances, ec2:TerminateInstances (to launch the build VM)
ec2:CreateImage, ec2:CreateTags, ec2:Describe* (for Golden AMI)
ssm:SendCommand, ssm:GetCommandInvocation (to run Ansible hardening securely)
iam:PassRole (required if instance profile is used)

View Exact JSON Policy Definition

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:DescribeInstances",
                "ec2:DescribeImages",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DescribeVolumes",
                "ec2:DescribeSnapshots",
                "ec2:CreateTags",
                "ec2:CreateImage",
                "ec2:CreateSnapshot",
                "ec2:ModifyImageAttribute",
                "ssm:SendCommand",
                "ssm:GetCommandInvocation",
                "ssm:ListCommandInvocations",
                "ssm:DescribeInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/Stratum*InstanceRole",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "ec2.amazonaws.com"
                }
            }
        }
    ]
}

Onboard AWS with CloudFormation

Download a template, create a CloudFormation stack using Upload a template file, then paste the stack outputs below.

Scanner Template Builder Template CloudFormation

Access Key ID

Required unless Stratum can use an AWS profile or environment credentials.

Secret Access Key

Stored encrypted by Stratum.

CloudFormation Stack Name

Uses the credentials above to read stack outputs and fill Role ARN, External ID, instance profile, and region.

AWS Profile (Optional)

Role ARN

External ID from CloudFormation output

Region

Subnet ID or VPC ID

Enter a subnet-xxx ID, or a vpc-xxx ID to auto-select the first available subnet.

Security Group ID

IAM Instance Profile Name