--- title: "Prepare AWS for Cloud Discovery | Lansweeper Platform" slug: "prepare-aws-for-cloud-discovery" description: "Prepare AWS for Lansweeper Cloud Discovery. Set up the IAM roles, permissions, and access Lansweeper needs to inventory assets across your AWS environment." tags: ["Lansweeper Platform", "Discovery and scanning", "Cloud Discovery"] status: "update" updated: 2026-10-21T14:38:52Z published: 2026-10-21T14:38:52Z canonical: "docs.lansweeper.com/prepare-aws-for-cloud-discovery" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt > Use this file to discover all available pages before exploring further. # Prepare AWS for Cloud Discovery > [!WARNING] > Note on third‑party tools > > We aim to provide accurate and helpful details about third‑party tools, but we can’t guarantee that this information is always complete or up to date. For the most reliable information, please always refer to the third‑party tool’s official documentation. Before scanning your AWS cloud environment with Lansweeper Cloud Discovery, you need to integrate your Amazon Web Services (AWS) accounts with Lansweeper’s identity provider using Workload Identity Federation. This setup allows Lansweeper to authenticate securely with AWS using OpenID Connect (OIDC) tokens, without storing or managing long-term credentials. To see which AWS workloads Cloud Discovery detects, see [Discoverable cloud workloads](/docs/discover-workloads). ## Understand the AWS scanning model To scan resources across multiple AWS accounts, Lansweeper uses a two-level account structure: - **Main account** - Lists all linked AWS accounts using AWS Organizations. - Assumes roles in target accounts to read resources. - **Target accounts** - Contain a role that grants Lansweeper permissions to read cloud resources. ## Create an OIDC identity provider Create an OpenID Connect provider in your main AWS account to enable Lansweeper Discovery to authenticate. 1. Follow AWS’s documentation to [Create an OpenID Connect (OIDC) identity provider in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html). 2. Complete the fields as follows: 1. Provider URL: `https://login.auth.lansweeper.com/6d02a192-efc6-a58a-e413-8abc60f3b067` (no trailing space or /) 2. Audience: `866d6f4d-c8fa-4342-9f6a-377932892ee0` 3. Finish creating the provider. ## Main account – Create the accounts listing policy The accounts listing policy allows your Lansweeper Site to list organization accounts and assume roles in target accounts. 1. Follow AWS’s documentation to [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html). 2. In the IAM console, create a new policy. 3. Paste the following JSON and replace `<your site ID>` with your site’s ID. To find your site ID, go to **Site settings** **> General** and copy your Site ID. ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:List*", "organizations:Describe*", "sts:GetCallerIdentity", "iam:GetRole", "sts:TagSession", "sts:AssumeRole" ], "Resource": "*", "Condition": { "StringEquals": { "aws:PrincipalTag/siteId": [ "" ] } } } ] } ``` 4. If you plan to use the same role across multiple Lansweeper Sites, add all Site IDs in an array: ``` "StringEquals": { "aws:PrincipalTag/siteId": ["site ID #1", "site ID #2"] } ``` ## Main account – Create the main role and trust entity Create a new IAM role that uses the OIDC identity provider and the listing policy. 1. In **IAM > Roles**, select **Create role**. 2. Under **Trusted entity type**, select **Web identity**. 3. For **Identity provider**, enter: `https://login.auth.lansweeper.com/6d02a192-efc6-a58a-e413-8abc60f3b067` 4. For **Audience**, enter: `866d6f4d-c8fa-4342-9f6a-377932892ee0` 5. Attach the custom accounts listing policy created earlier. 6. Name the role, e.g. `LSMainAccountRole`. 7. After creation, select the role and open the **Trust relationships** tab. 8. Choose **Edit trust policy** and ensure the following JSON is in place: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam:::oidc-provider/login.auth.lansweeper.com/6d02a192-efc6-a58a-e413-8abc60f3b067" }, "Action": [ "sts:AssumeRoleWithWebIdentity", "sts:TagSession" ], "Condition": { "StringEquals": { "login.auth.lansweeper.com/6d02a192-efc6-a58a-e413-8abc60f3b067:aud": "866d6f4d-c8fa-4342-9f6a-377932892ee0" } } } ] } ``` 9. Save the trust policy. 10. Copy the **Role ARN** and keep it for later configuration in Lansweeper. ## Main and target accounts – Create the reading policy This policy defines the permissions used by Lansweeper to read AWS asset information. 1. Apply it to the main and all target accounts. 2. In **IAM > Policies**, create a new policy. 3. Add the following JSON: JSON ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:DescribeOrganization", "sts:GetCallerIdentity", "iam:GetRole", "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "codepipeline:Get*", "codepipeline:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "appfabric:Get*", "appfabric:List*", "dms:Describe*", "dms:List*", "ds:Describe*", "ds:Get*", "ds:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "iam:Get*", "iam:List*", "autoscaling:Describe*", "autoscaling:Get*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "network-firewall:Describe*", "network-firewall:List*", "sqs:Get*", "sqs:List*", "launchwizard:Describe*", "launchwizard:Get*", "launchwizard:List*", "compute-optimizer:Describe*", "compute-optimizer:Get*", "dlm:Get*", "savingsplans:Describe*", "savingsplans:List*", "sagemaker-groundtruth-synthetic:Get*", "sagemaker-groundtruth-synthetic:List*", "emr-serverless:Get*", "emr-serverless:List*", "route53domains:Get*", "route53domains:List*", "ses:Describe*", "ses:Get*", "ses:List*", "codeartifact:Describe*", "codeartifact:Get*", "codeartifact:List*", "networkmanager:Describe*", "networkmanager:Get*", "networkmanager:List*", "athena:Get*", "athena:List*", "iot:Describe*", "iot:Get*", "iot:List*", "appsync:Get*", "appsync:List*", "ce:Describe*", "ce:Get*", "ce:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "iotwireless:Get*", "iotwireless:List*", "sdb:Get*", "sdb:List*", "application-autoscaling:Describe*", "application-autoscaling:List*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "lambda:Get*", "lambda:List*", "s3:Describe*", "s3:Get*", "s3:List*", "trustedadvisor:Describe*", "apprunner:Describe*", "apprunner:List*", "iotevents:Describe*", "iotevents:List*", "sagemaker:Describe*", "sagemaker:Get*", "sagemaker:List*", "sagemaker:Search*", "clouddirectory:Get*", "clouddirectory:List*", "iotroborunner:Get*", "iotroborunner:List*", "account:Get*", "account:List*", "rds:Describe*", "rds:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:Search*", "lakeformation:Describe*", "lakeformation:Get*", "lakeformation:List*", "lakeformation:Search*", "appstream:Describe*", "appstream:List*", "glue:Get*", "glue:List*", "glue:Search*", "elastic-inference:Describe*", "elastic-inference:List*", "logs:Describe*", "logs:Get*", "logs:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "kafka:Describe*", "kafka:Get*", "kafka:List*", "scheduler:Get*", "scheduler:List*", "codedeploy:Get*", "codedeploy:List*", "servicediscovery:Get*", "servicediscovery:List*", "kms:Describe*", "kms:Get*", "kms:List*", "ecr-public:Describe*", "ecr-public:Get*", "ecr-public:List*", "workspaces-web:Get*", "workspaces-web:List*", "elasticfilesystem:Describe*", "elasticfilesystem:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:Get*", "route53-recovery-control-config:List*", "batch:Describe*", "batch:List*", "events:Describe*", "events:List*", "waf-regional:Get*", "waf-regional:List*", "workspaces:Describe*", "redshift:Describe*", "redshift:Get*", "organizations:Describe*", "organizations:List*", "emr-containers:Describe*", "emr-containers:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "datapipeline:Describe*", "datapipeline:Get*", "datapipeline:List*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "sts:Get*", "lightsail:Get*", "s3-object-lambda:Get*", "s3-object-lambda:List*", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "firehose:Describe*", "firehose:List*", "codebuild:Describe*", "codebuild:List*", "notifications:Get*", "notifications:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "autoscaling-plans:Describe*", "autoscaling-plans:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "eks:Describe*", "eks:List*", "pipes:Describe*", "pipes:List*", "ec2messages:Get*", "mq:Describe*", "mq:List*", "identitystore-auth:List*", "tag:Describe*", "tag:Get*", "config:Describe*", "config:Get*", "config:List*", "es:Describe*", "es:Get*", "es:List*", "amplify:List*", "lookoutvision:List*", "sns:Get*", "sns:List*", "cloudsearch:Describe*", "cloudsearch:List*", "secretsmanager:Describe*", "secretsmanager:List*", "notifications-contacts:Get*", "notifications-contacts:List*", "elasticloadbalancing:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "elasticmapreduce:Describe*", "elasticmapreduce:Get*", "elasticmapreduce:List*", "waf:Get*", "waf:List*", "elasticache:Describe*", "elasticache:List*", "memorydb:Describe*", "memorydb:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:List*", "swf:Describe*", "swf:Get*", "swf:List*", "ec2:Describe*", "ec2:Get*", "ec2:List*", "ec2:Search*", "transfer:Describe*", "transfer:List*", "iot1click:Describe*", "iot1click:Get*", "iot1click:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "ecs:Describe*", "ecs:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "route53:Get*", "route53:List*", "route53resolver:Get*", "route53resolver:List*" ], "Resource": "*" } ] } ``` 4. Save the policy with a consistent name, e.g. `LSReadResourcesPolicy`. ## Main and target accounts – Create the reading role and trust entity This role lets your Lansweeper Site enumerate resources in each AWS account. 1. In each AWS account, go to **IAM > Roles > Create role**. 2. Choose **Custom trust policy**. 3. Add the following trust relationship, replacing `<main account number>` and role names accordingly: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:sts::
:assumed-role/LSMainAccountRole/web-identity" ] }, "Action": [ "sts:AssumeRole", "sts:TagSession" ] } ] } ``` 4. Attach the `LSReadResourcesPolicy`. 5. Name the role **LSReadingRole**. Use the same name for this role across all accounts. ## Configure EKS cluster scanning permissions The setup above lets Lansweeper read your Amazon EKS clusters at the AWS level. To also read Kubernetes-level detail from inside a cluster, such as nodes, pods, services, and endpoints, grant Lansweeper read access to the cluster's Kubernetes API. - [Configure EKS cluster scanning permissions](/docs/configure-eks-cluster-scanning-permissions) ## Next steps Now that you have prepared your AWS environment, you can create a Cloud Discovery action to connect with Lansweeper Sites. - [Create a cloud action - AWS](/docs/create-a-cloud-action-aws)