Deploy with CloudFormation or Terraform

If you manage AWS with Infrastructure-as-Code, use the Parsivex templates instead of clicking through the IAM console. Both options create the same read-only ParsivexReadOnly role and minimal permission policy.

You can also use the Deploy with CloudFormation button in the onboarding wizard — it pre-fills all parameters for you.

Before you deploy

Collect these two values from Parsivex before running either template:

Both values are required. The External ID is embedded in the role's trust policy so only your Parsivex workspace can assume the role. See External ID explained for why this matters.

Option 1: CloudFormation

The Parsivex CloudFormation template creates:

• An IAM managed policy (ParsivexReadOnlyPolicy) with the minimal read-only permissions Parsivex needs
• An IAM role (ParsivexReadOnly) with a trust policy referencing your External ID

Required parameters

Deploy via AWS Console

1. Open CloudFormation

   Go to the AWS CloudFormation console and choose Create stack → With new resources.

2. Upload the template

   Download the CloudFormation template from the security page and upload it, or use Deploy with CloudFormation in the Parsivex onboarding wizard (it pre-fills both parameters automatically).

3. Enter parameters

   Set Parsivex AWS Account ID and External ID from your Parsivex dashboard.

4. Create the stack

   Acknowledge IAM resource creation and create the stack. Wait until the stack finishes successfully.

5. Copy the Role ARN

   Open the stack Outputs tab and copy RoleArn (arn:aws:iam::YOUR-ACCOUNT-ID:role/ParsivexReadOnly).

Deploy via AWS CLI

Download the template from the security page, save it as parsivex-role.yaml, then run:

aws cloudformation create-stack \
  --stack-name parsivex-role \
  --template-body file://parsivex-role.yaml \
  --parameters \
    ParameterKey=ParsevixAccountId,ParameterValue=123456789012 \
    ParameterKey=ExternalId,ParameterValue=parsivex-xxxxxxxxxxxx \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation wait stack-create-complete --stack-name parsivex-role

aws cloudformation describe-stacks \
  --stack-name parsivex-role \
  --query 'Stacks[0].Outputs[?OutputKey==`RoleArn`].OutputValue' \
  --output text

Replace 123456789012 with the Parsivex AWS Account ID and parsivex-xxxxxxxxxxxx with your External ID.

Option 2: Terraform

The Parsivex Terraform module creates the same role and policy. Download it from the security page. It requires Terraform ≥ 1.0 and the AWS provider ≥ 4.0.

Required variables

Optional variables: role_name (default ParsivexReadOnly), policy_name (default ParsivexReadOnlyPolicy), and tags.

Example usage

module "parsivex_role" {
  source = "./parsivex-terraform-module"  # path to the downloaded module

  parsivex_account_id = "123456789012"  # From Parsivex dashboard
  external_id         = "parsivex-xxxxxxxxxxxx"
}

output "parsivex_role_arn" {
  description = "Copy this ARN into Parsivex"
  value       = module.parsivex_role.role_arn
}

Deploy

cd parsivex-terraform-module  # your downloaded module directory
terraform init
terraform plan \
  -var="parsivex_account_id=123456789012" \
  -var="external_id=parsivex-xxxxxxxxxxxx"
terraform apply \
  -var="parsivex_account_id=123456789012" \
  -var="external_id=parsivex-xxxxxxxxxxxx"
terraform output role_arn

The module README (included in the download) documents optional inputs such as custom role and policy names, tags, and cleanup with terraform destroy.

After deployment: connect Parsivex

1. Copy the Role ARN from CloudFormation outputs or terraform output role_arn
2. In the Parsivex onboarding wizard, go to Verify connection
3. Paste the Role ARN, select your primary AWS region, and click Test connection
4. When verification succeeds, continue to choose a plan and run your first scan

If verification fails, see Connection troubleshooting.

Revoking access

• CloudFormation: delete the stack — the role and policy are removed automatically
• Terraform: run terraform destroy in your module directory
• Manual: delete the ParsivexReadOnly role in IAM

See Revoking Parsivex access for what happens to your Parsivex data when you disconnect.