Skip to main content

​
How It Works

  1. Copy your External ID:
    • In CodeAnt AI, go to Settings -> Cloud Security -> AWS.
    • Copy the External ID shown at the top of the form - it’s a per-tenant value used to prevent cross-account confused-deputy attacks. You’ll paste it into your IAM trust policy in step 2.
  2. Create an IAM role in your AWS account:
    • Create an IAM role and attach the trust policy below, replacing <EXTERNAL_ID> with the value you copied above:
    • Attach the AWS managed ReadOnlyAccess policy. That is the only permission CodeAnt AI needs - it only reads, never writes, creates, or deletes.
    • Copy the Role ARN (e.g. arn:aws:iam::123456789012:role/CodeAntCSPM).
    Need tighter, least-privilege access? You can grant CodeAnt AI extremely fine-grained, view-only access instead - see Fine-grained permissions at the bottom of this page.
  3. Save in Settings:
    • Back in Settings -> Cloud Security -> AWS, paste the Role ARN and your region, then save.
    • Click Validate Permissions to confirm CodeAnt AI can assume the role and that ReadOnlyAccess (or a valid fine-grained set) is attached.
  4. Start a Scan:
    • Go to Cloud Security -> Infrastructure Scan and click Start New Scan, then pick your AWS connection.
    • The scan typically completes in 5-20 minutes depending on account size, and results appear under Overview, Findings, Services, and Compliance.

​
Fine-grained permissions

We recommend ReadOnlyAccess for most teams - it’s the simplest setup and covers every feature. If your security program calls for tighter, least-privilege access, you can grant CodeAnt AI extremely fine-grained, view-only access instead. It’s two parts: 1. Attach AWS’s managed security policies - SecurityAudit + ViewOnlyAccess. These are standard AWS managed policies, maintained by AWS - you don’t author or maintain their contents. They grant read access to security configuration/metadata only (no object, message, or log contents), comparable to how Vanta requests access, and cover the full posture scan, GuardDuty findings, and compliance. 2. Add this one custom policy. It’s the only thing you configure yourself - a small set of read-only actions the two managed policies above don’t include:
3. (Optional) Enable API-abuse / WAF-log detection - attach CloudWatchLogsReadOnlyAccess. The view-only set above does not read log contents, so the API Abuse tab stays empty. To enable it, also attach the AWS managed policy CloudWatchLogsReadOnlyAccess - this lets CodeAnt AI analyze your WAF and API Gateway logs to flag suspicious client IPs. It reads edge-log content (client IPs and request bodies), so it’s fully opt-in.
Strict-minimal alternative to CloudWatchLogsReadOnlyAccess: a custom policy granting only logs:DescribeLogGroups, logs:StartQuery, and logs:GetQueryResults on Resource: "*".

​
VM Scanning permissions

VM Scanning reuses this same IAM role but needs a few write actions the read-only CSPM set doesn’t include, because it creates a temporary disk snapshot, reads it, and deletes it. Attach this policy to the CodeAnt IAM role:
If you already attached ReadOnlyAccess, the only new permissions are the three in CodeAntVMScanSnapshot - the read block is already covered. For encrypted EBS volumes, also grant kms:Decrypt and kms:DescribeKey on the relevant keys. See VM Scanning for tag-scoped variants.
Looking to scan container images? See Container Scanning for the extra permissions it needs.