AWS EC2 & SSM

Overview

The AWS EC2 & SSM integration enables ThreatAware to collect read-only data from your AWS account, providing visibility into EC2 instances, Systems Manager configurations, and cloud infrastructure.

Connection Method: IAM Role with Cross-Account Access Setup Time: 20 minutes Access Required: AWS Account Administrator or IAM permissions ThreatAware Account ID: available in-product under Settings → Integrations → AWS Account / IP Whitelist Info

Data collected

The AWS integration provides:

EC2 instance details and status
Systems Manager (SSM) agent information
Instance metadata and configuration
Multi-account inventory (optional)

Use cases

EC2 Instance Monitoring

Track EC2 instances and compute resources across accounts

Systems Manager Tracking

Monitor SSM agent status and Systems Manager configurations

Multi-Account Inventory

Discover resources across multiple AWS accounts with Organisations

Compliance Verification

Validate EC2 and SSM configurations meet organisational standards

Setup instructions

Visit the AWS Management Console and sign in with your AWS credentials.

Navigate to IAM

Access the Identity and Access Management (IAM) service from the AWS console dashboard.

Create a New Role

In the IAM console:

Select Roles from the left navigation
Click Create role

Select Trusted Entity

In the role creation wizard:

Choose Another AWS Account as the trusted entity type
Enter the ThreatAware Account ID (from Settings → Integrations → AWS Account / IP Whitelist Info)
Leave Require external ID unchecked for now

Configure External ID

For enhanced security, enable external ID:

Check Require external ID
Enter a complex string (like a password with no special characters)
Example: ThreatAware123ExternalID456

Use a complex string with letters and numbers, but no special characters. You will need to provide this to ThreatAware.

Attach IAM Permissions

Add the required permissions to the role:

Select or create a policy with these permissions:
- ec2:DescribeInstances
- ssm:DescribeInstanceInformation

For AWS Organisations setup, also add: organization:ListAccounts

Review and Create Role

Review the role configuration:

Verify the trusted entity is the ThreatAware Account
Confirm the permissions are correct
Copy the Role ARN for later use
Click Create role

Record Credentials

Document the following for ThreatAware configuration:

AWS Account ID: Your 12-digit AWS account ID
Role ARN: The full ARN of the role you created
External ID: The external ID string you configured (if used)
Region: Your primary AWS region

Configure Multiple Accounts (Optional)

If connecting multiple AWS accounts:

Repeat steps 3-7 for each AWS account
Each account needs its own role with the same permissions
Each role must trust the ThreatAware Account (see Settings → Integrations → AWS Account / IP Whitelist Info)

AWS Organisations Setup (Optional)

For organisation-wide monitoring:

Create a role in the parent/management account
Add permission: organization:ListAccounts
Add the same EC2 and SSM permissions as individual accounts
Provide only the parent account ID to ThreatAware
ThreatAware will discover all member accounts automatically

Configure in ThreatAware

In ThreatAware, go to Integrations and select AWS EC2 & SSM:

Enter the AWS Account ID
Enter the Role ARN
Enter the External ID (if configured)
Enter your primary Region
Click Connect

Verify Connection

After connecting, verify the integration:

Check that the Integration Status shows as Active
Wait for initial data synchronization (typically 1 hour)
Verify EC2 and SSM data appears in ThreatAware

Required configuration

AWS Account ID

Field Name: AWS Account ID Type: String (12 digits) Description: Your AWS account ID where the role is createdExample: 123456789012

Find your account ID in the AWS Console top right corner or in the Account menu.

Role ARN

Field Name: IAM Role ARN Type: String Description: The full ARN of the cross-account roleFormat: arn:aws:iam::123456789012:role/RoleNameExample: arn:aws:iam::123456789012:role/ThreatAwareRole

External ID

Field Name: External ID Type: String (optional) Description: The external ID configured for enhanced securityExample: ThreatAware123ExternalID456

Only required if you enabled “Require external ID” when creating the role.

AWS Region

Field Name: AWS Region Type: String Description: Your primary AWS regionExamples:

us-east-1
eu-west-1
ap-southeast-1

IAM policy templates

Single Account Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ssm:DescribeInstanceInformation"
      ],
      "Resource": "*"
    }
  ]
}

Assume Role Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<THREATAWARE_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YourExternalIDHere"
        }
      }
    }
  ]
}

Parent Account Policy (Organisations)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ssm:DescribeInstanceInformation",
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    }
  ]
}

Verification and testing

After setup, verify the integration is working correctly:

Check Integration Status
- Navigate to Integrations in ThreatAware
- Confirm the AWS EC2 & SSM integration shows Active status
Verify Data Collection
- Wait for initial data sync (1 hour)
- Log in to AWS Console and note your EC2 instances
- Verify the same instances appear in ThreatAware
Test Multi-Account Setup
- Verify instances from all accounts appear
- Check that instance metadata is complete and accurate

Troubleshooting

Invalid Account ID or Role ARN

Symptoms: Connection fails immediately or shows invalid credentialsSolutions:

Verify the AWS Account ID is exactly 12 digits
Check the Role ARN format is correct: arn:aws:iam::ACCOUNT:role/ROLENAME
Ensure the role exists and is visible in the AWS IAM console
Copy values directly from AWS console to avoid typos

External ID Mismatch

Symptoms: Connection fails with authentication errorSolutions:

Verify the External ID matches exactly (case-sensitive)
Ensure you only use letters and numbers (no special characters)
Double-check the External ID in both the role and ThreatAware
If unsure, create a new role without External ID for testing

Permission Denied

Symptoms: Integration connects but shows no EC2/SSM dataSolutions:

Verify the role has these permissions: ec2:DescribeInstances, ssm:DescribeInstanceInformation
Check that the policy is attached to the role
Wait 5-10 minutes for IAM changes to propagate
Confirm the Assume Role policy trusts the ThreatAware account (see Settings → Integrations → AWS Account / IP Whitelist Info)

No Data After 1 Hour

Symptoms: Integration shows active but EC2/SSM data doesn’t appearSolutions:

Verify you have EC2 instances in the specified region
Confirm the role permissions include all required actions
Check that Systems Manager is properly configured for SSM data
Review AWS CloudTrail logs for API calls from ThreatAware
Contact AWS support if permission issues persist

AWS Organisations Not Working

Symptoms: Organisations setup returns no member accountsSolutions:

Verify the role is created in the parent/management account
Ensure the role includes organization:ListAccounts permission
Confirm AWS Organisations is enabled in your account
Check that all member accounts are properly linked
Provide only the parent account ID to ThreatAware, not member accounts

Additional resources

AWS IAM Documentation

Official AWS IAM documentation for role configuration

AWS EC2 Documentation

AWS EC2 service documentation

AWS Systems Manager Documentation

AWS Systems Manager documentation

ThreatAware Support

Contact ThreatAware support for integration assistance

Best practices

Security Configuration

Always enable External ID for enhanced security
Use complex External ID strings (letters and numbers only)
Document all credentials and External IDs securely
Review IAM permissions regularly
Monitor CloudTrail for ThreatAware API activity

Multi-Account Management

Use AWS Organisations for centralized monitoring
Create dedicated roles for ThreatAware in each account
Maintain consistent External IDs across all accounts
Test connectivity in one account before adding others
Document the structure of your AWS accounts

Browse by Category

All Guides (A-Z)

Overview

Data collected

Use cases

EC2 Instance Monitoring

Systems Manager Tracking

Multi-Account Inventory

Compliance Verification

Setup instructions

Required configuration

IAM policy templates

Verification and testing

Troubleshooting

Additional resources

AWS IAM Documentation

AWS EC2 Documentation

AWS Systems Manager Documentation

ThreatAware Support

Best practices

​Overview

​Data collected

​Use cases

EC2 Instance Monitoring

Systems Manager Tracking

Multi-Account Inventory

Compliance Verification

​Setup instructions

​Required configuration

​IAM policy templates

​Verification and testing

​Troubleshooting

​Additional resources

AWS IAM Documentation

AWS EC2 Documentation

AWS Systems Manager Documentation

ThreatAware Support

​Best practices

Overview

Data collected

Use cases

Setup instructions

Required configuration

IAM policy templates

Verification and testing

Troubleshooting

Additional resources

Best practices