AWS access

Parsivex needs read access to your AWS account to see what you are spending money on, and nothing more. You grant it by creating an IAM role that trusts our account and carries a read-only policy, then handing us the role ARN. There is no access key to rotate, no credentials stored on our side, and no permission in the policy that can create, modify, or delete a resource.

The articles here cover that setup end to end: creating the role by hand in the console, deploying it with CloudFormation or Terraform if you manage infrastructure as code, and verifying the connection before your first scan. They also explain the External ID — the shared secret that stops anyone else from asking AWS to assume your role — and exactly which AWS APIs a scan calls, so you can review the blast radius before you approve anything.

If a connection fails or a scan comes back partial, the troubleshooting article maps the common causes to fixes: trust policy typos, an External ID mismatch, a permission your organization denies at the service control policy level, or a region you did not intend to include. Revoking access is covered too, and it is deliberately simple — delete the role and Parsivex can no longer read anything, whatever the state of your subscription.