Set up an AWS connector

This is an updated and improved version of the AWS connector!If you’re setting up AWS with C1 for the first time, you’re in the right place.

Capabilities

Resource	Sync	Provision
IAM and Identity Center user accounts
IAM roles
IAM groups
IAM accounts
Identity Center groups
Accounts via Permission Sets		*
Secrets - Access keys
Organization Root / Organizational Unit (Sparse ACLs)**
Permission Set / Permission Set Assignment (Sparse ACLs)**		*
IAM managed policies
Inline policies

The AWS connector supports automatic account provisioning and deprovisioning of IAM accounts. *The connector can provision to accounts via permissions sets only if Identity Center is enabled. **Sparse ACL resources are opt-in — see Sparse ACLs: Organizations and permission sets as scoped bindings below. This connector can sync secrets and display them on the Inventory page. This connector syncs non-human identities and displays them on the Identities overview dashboard.

AWS STS web identity action

The connector exposes the global assume_role_with_web_identity action for approved, short-lived AWS credential vending. C1 supplies a request-scoped OIDC token and age encryption recipient. The connector exchanges the token with AWS STS, encrypts the returned credential envelope before it crosses the connector boundary, and returns ciphertext plus expiration and assumed-role audit metadata. The action accepts:

role_arn: the target customer IAM role;
web_identity_token: a short-lived C1-issued OIDC token;
age_recipient: the request-scoped public encryption recipient;
session_name: the AWS audit/session name;
duration_seconds: 900 through 43,200, also limited by the IAM role; and
policy_json: an optional restrictive inline session policy.

Before enabling the action, create an IAM OIDC provider for the C1 issuer and a role trust policy allowing sts:AssumeRoleWithWebIdentity. Restrict the trust policy to the documented C1 issuer, intended audience, and tenant/requestor subject profile. Do not use a wildcard issuer, audience, or subject. The role’s permissions policy defines the maximum AWS access; the optional session policy can only narrow it further. Synced IAM role profiles include aws_max_session_duration_seconds, the provider-observed MaxSessionDuration ceiling returned by IAM. C1 must combine that ceiling with its own access policy when choosing duration_seconds. AWS does not expose an authoritative role property that says whether a future session will be issued directly or through role chaining; C1 must derive that topology from its configured issuance mode and apply the corresponding AWS limit.

Sparse ACLs: Organizations and permission sets as scoped bindings

When both Enable support for AWS Organizations and Enable support for AWS IAM Identity Center are turned on, the connector also models Identity Center permission set assignments as Sparse ACL bindings, alongside the existing flat per-account entitlement model. This introduces four resource types:

Organization Root and Organizational Unit — the AWS Organizations hierarchy (Root → OU → Account), synced as read-only navigation/review context. Neither carries bindings of its own.
Permission Set — a role catalog entry for each Identity Center permission set.
Permission Set Assignment — one binding per (permission set, account) pair that’s actually assigned, listing the users and groups granted that permission set on that account. Group grants expand to their members.

Instead of one row per (account, permission set, user) combination, reviewers see “Permission Set X on Account Y” as a single item, with the account’s place in the AWS Organizations hierarchy shown for context. These four resource types are opt-in on the C1 platform: even with both checkboxes enabled above, you must separately opt in to each resource type before C1 begins syncing it. Until you opt in, the connector keeps syncing the existing flat account/permission-set entitlement model unchanged. Syncing the Organization Root / Organizational Unit hierarchy also requires the organizations:ListRoots and organizations:ListOrganizationalUnitsForParent permissions (see the IAM policy in the Identity Center setup tab below). If these permissions are missing, the connector logs a warning and skips the OU hierarchy rather than failing the sync — accounts continue to sync without OU grouping.

IAM policies as resources

The connector syncs AWS IAM policies as resources in their own right, alongside the identities they’re attached to:

IAM managed policies — both customer-managed and AWS-managed policies. AWS-managed policies (arn:aws:iam::aws:policy/...) are global objects shared by every account, so they’re synced once rather than per account.
Inline policies — policies embedded directly in an IAM user, role, or group, and the inline policy attached to an Identity Center permission set.

Each policy resource carries its policy document (the JSON that defines which actions the policy allows or denies) as a resource attribute, so reviewers can see what a policy actually grants instead of only its name. Syncing policy documents requires the policy read permissions listed in the IAM policies below (iam:GetPolicy, iam:GetPolicyVersion, and the iam:Get*Policy / iam:List*Policies actions). If these permissions are missing, the connector logs a warning and syncs the policy resources without their document contents rather than failing the sync — so a policy that appears with no document is usually a missing-permission symptom rather than an empty policy. For an IAM user, Last Login is the most recent of password-based AWS sign-in (PasswordLastUsed) and access-key use. Password sign-in includes the AWS Management Console and can also include other AWS websites, such as AWS Marketplace. The two signals stay separate on the profile so reviewers can tell a console sign-in apart from programmatic key activity.

password_last_used — the password-based AWS sign-in timestamp.
access_key_last_used — the most recent use across all of the user’s access keys.

Populating access_key_last_used requires iam:ListAccessKeys and iam:GetAccessKeyLastUsed; it does not require Sync secrets. When AWS returns neither PasswordLastUsed nor any access-key last-used date, C1 leaves Last Login unset. A missing password date does not mean the user has no console password; use console_access_enabled for that distinction. Per-key detail lives on the access key itself, on the Inventory page:

Last used, together with last_used_service and last_used_region — what the key was calling and from where. For a key with no tracked use, AWS returns a null date and "N/A" placeholders; the connector omits those values.
Status — Active or Inactive. Inactive keys were already synced; they now carry a disabled status so reviewers can tell them apart from active keys. Inactive keys can be reactivated; reviewers decide whether to delete them.

Two optional settings gate parts of this, and both are off by default:

Sync secrets — without it no access keys are synced, so none of the per-key detail above appears.
Sync IAM User Console Access (BATON_SYNC_IAM_USER_CONSOLE_ACCESS) — without it console_access_enabled, password_reset_required, and login_profile_created_at are not populated. It is off by default because it costs one iam:GetLoginProfile call per IAM user and requires iam:GetLoginProfile on the connector role. This setting detects an IAM console password; it does not detect access through Identity Center or an assumed role.

IAM user Last Login itself does not depend on either setting. Identity Center user Last Login uses a separate CloudTrail event feed. Enable Organizations support, Identity Center support, and Sync SSO User Last Login (BATON_SYNC_SSO_USER_LAST_LOGIN), and grant cloudtrail:LookupEvents to report Identity Center sign-ins. This setting is also off by default and does not affect IAM user Last Login or access key activity.

Gather AWS credentials

Configuring the connector requires you to pass in credentials generated in AWS. Gather these credentials before you move on.

ImportantA user with the Connector Administrator or Super Administrator role in C1 and the ability to create an IAM Role in AWS must perform this task.C1 uses an IAM Trust relationship between your AWS Account and C1’s Service AWS Account. This is the AWS recommended method of sharing access to AWS Accounts. C1 has a specially created and isolated AWS Account dedicated to the AWS integration. For advanced configurations, the only trusted entity should be the following ARN: arn:aws:iam::765656841499:role/ConductorOneService

Follow the relevant set of instructions below to set up the AWS connector for IAM or SSO, as your configuration dictates.

IAM setup
Identity Center setup

IAM setup: Gather credentials that support syncing child account data

To sync IAM data (like users, roles, and groups) from multiple AWS child accounts, C1 uses a secure, read-only mechanism called cross-account access. This setup works by allowing a central role in your root account to temporarily assume a specific role in each child account. This method ensures that the connector can gather the necessary data without storing credentials or requiring permanent access.If you’re using this setup, make sure to click Enable support for AWS Organizations when setting up the connector in the C1 web UI. You may also enable Enable support for AWS IAM Identity Center at the same time. By default, enabling Identity Center alongside Organizations syncs only Identity Center data (users, groups, permission sets, account assignments) and skips cross-account IAM. To also sync IAM users, roles, and groups from every child account in this combined mode, additionally enable Also sync cross-account IAM when Identity Center is enabled. This flag is off by default so existing Identity Center deployments don’t suddenly require child-account sts:AssumeRole access.In order to use the connector to gather IAM AWS data, you’ll need to configure each sub-account to have a role with a trust policy. There are two options here:

Use OrganizationAccountAccessRole, and add the following to the management role: { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/OrganizationAccountAccessRole" }
Create a new custom role by following the steps below

Get a C1-provided External ID

AWS requires the use of External IDs when granting third-party access to your AWS account. This security measure prevents the “confused deputy” problem and ensures that only authorized parties can assume the role.

In C1, navigate to Apps > Connectors and click Add connector.

Search for AWS v2 and click Add.

Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

Copy and save the External ID populated in the External ID field.

Create a custom IAM role

This custom role acts as a bridge, allowing C1 to securely access your child account. The trust policy you’re about to create is the key to this connection.

Navigate to the IAM Dashboard and select Roles > Create Role.

Select Custom Trust Policy and paste the following into the Trust Policy JSON editor, replacing {ROOT_ID} with the root ID from the main account and EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE with the External ID you copied from C1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::{ROOT_ID}:role/ConductorOneService"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE"
        }
      }
    }
  ]
}

Notes on the Trust Policy: “Action”: “sts:AssumeRole”: This is the core permission. It’s the only action allowed by this policy, and it specifically allows the C1 role in your root account to temporarily assume this role in the child account. Think of it like a temporary key that only the main account can use. “Principal”: “arn:aws:iam::{ROOT\_ID}:role/ConductorOneService”: This is the trusted entity. It specifies that only the C1 role in your main root account is allowed to assume this role. This ensures that no other account can use this trust policy. “Condition”: “sts:ExternalId”: The External ID acts as a shared identifier between you and C1, confirming which trust relationship is being used. This helps prevent the “confused deputy” problem by ensuring the request is coming from the expected context. Learn more about granting access using External IDs.

Click Next.

Skip Add permissions and click Next.

Give the role a name, such as C1Integration.

Add any tags relevant to your organization and click Create Role.

Find the newly created role, and click on it to view the role details page.

Grant permission for data sync

Next, you will create an inline policy to define the specific data this role can gather from the child account. These are read-only permissions that enable C1 to securely sync your IAM data.

Under Permissions Policies, click Add Permissions and select Create Inline Policy.

Switch to the JSON Editor tab and paste the following policy into the editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MinimumRequiredPermissionsSyncIAMUsersGroupsRoles",
      "Effect": "Allow",
      "Action": [
        "iam:ListUsers",
        "iam:ListGroups",
        "iam:ListRoles",
        "iam:GetGroup",
        "iam:GetRole",
        "iam:ListAccessKeys",
        "iam:GetAccessKeyLastUsed",
        "iam:GetLoginProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsSupport",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "UseMoreDescriptiveAccountAliases",
      "Effect": "Allow",
      "Action": [
        "iam:ListAccountAliases"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SyncIAMPolicyDocuments",
      "Effect": "Allow",
      "Action": [
        "iam:ListPolicies",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListUserPolicies",
        "iam:ListRolePolicies",
        "iam:ListGroupPolicies",
        "iam:GetUserPolicy",
        "iam:GetRolePolicy",
        "iam:GetGroupPolicy",
        "iam:ListAttachedUserPolicies",
        "iam:ListAttachedRolePolicies",
        "iam:ListAttachedGroupPolicies"
      ],
      "Resource": "*"
    }
  ]
}

Explanation of permissionsCore IAM Permissions These permissions allow C1 to sync your basic identity structure.

iam:ListUsers: Allows C1 to retrieve a list of all IAM user accounts.
iam:ListGroups: Allows C1 to retrieve a list of all IAM groups.
iam:ListRoles: Allows C1 to retrieve a list of all IAM roles.
iam:GetGroup: Required to see which users belong to which groups. ListGroups only provides the group names, while GetGroup identifies the specific members.
iam:GetRole: Allows C1 to retrieve detailed information about specific roles, including their trust relationships.

Access key activity These permissions populate access_key_last_used on each IAM user. Enable Sync secrets to also sync each key as its own secret resource with status and per-key activity.

iam:ListAccessKeys and iam:GetAccessKeyLastUsed: These allow C1 to gather access key metadata, including when each key was last used. This is useful for identifying unused or stale credentials. Note that C1 only retrieves metadata for auditing; it does not store or access the secret access keys themselves.

Optional: IAM User Console Access The JSON above includes this permission. It is used only when Sync IAM User Console Access (BATON_SYNC_IAM_USER_CONSOLE_ACCESS) is enabled. The flag is off by default because it makes one iam:GetLoginProfile call per IAM user.

iam:GetLoginProfile: Allows C1 to see whether each IAM user has a console login profile, and whether a password reset is required.

Optional: AWS Organizations Support Include these permissions if you enable the “Enable support for AWS Organizations” checkbox in the C1 UI.

organizations:ListAccounts: Allows the connector to discover all accounts within your AWS Organization.
organizations:DescribeOrganization: Provides high-level details about your organization to ensure proper mapping.

Optional: Descriptive Account Aliases

iam:ListAccountAliases: Include this if you prefer to use human-readable account aliases (for example, “Production-Environment”) in the C1 UI instead of 12-digit numeric AWS account IDs.

Optional: IAM Policies as Resources Include these permissions if you want C1 to sync IAM managed policies and inline policies as resources, along with their policy documents. See IAM policies as resources above.

iam:ListPolicies, iam:GetPolicy, and iam:GetPolicyVersion: Allow C1 to discover managed policies and read the JSON document of each policy’s default version.
iam:ListUserPolicies, iam:ListRolePolicies, and iam:ListGroupPolicies: Allow C1 to discover the inline policies embedded in each IAM user, role, and group.
iam:GetUserPolicy, iam:GetRolePolicy, and iam:GetGroupPolicy: Allow C1 to read the JSON document of each inline policy.
iam:ListAttachedUserPolicies, iam:ListAttachedRolePolicies, and iam:ListAttachedGroupPolicies: Allow C1 to see which managed policies are attached to which users, roles, and groups. If these permissions are omitted, the connector still syncs successfully — policy resources are either skipped or synced without their document contents.

Click Review Policy.

Give the policy a name, such as C1Permissions and click Create Policy.

Copy the Role ARN for the Role we created, it should look like: arn:aws:iam::NNNNNNNNNN:role/ConductorOneIntegration.

Done. Next, move on to the connector configuration instructions.

Identity Center setup: Gather credentials

Follow these steps to gather the credentials needed for an AWS IAM Identity Center setup of the AWS connector.

Get a C1-provided External ID

In C1, navigate to Apps > Connectors and click Add connector.

Search for AWS v2 and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

Copy and save the External ID populated in the External ID field.

Create a custom IAM role

This setup allows C1 to integrate with AWS IAM Identity Center (formerly SSO). It requires permissions to both read existing user, group, and permission set data, and optionally, to provision new assignments and manage related resources.The permissions policy below is broken into several sections to align with these functions. This allows you to grant only the permissions you need for your use case, following the principle of least privilege.

In a new browser tab, sign in to your AWS Account using your existing credentials or SSO. To support use of AWS Organizations: You must create this IAM Role in the management (formerly called master) account of the AWS Organization.

Navigate to the IAM Dashboard and select Roles > Create Role.

Select Custom Trust Policy and paste the following into the Trust Policy JSON editor, replacing EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE with the External ID from C1.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::765656841499:role/ConductorOneService"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE"
        }
      }
    }
  ]
}

Click Next.

Skip Add permissions and click Next.

Give the role a name, such as C1Integration.

Add any tags relevant to your organization and click Create Role.

Find the newly created role, and click on it to view the role details page.

Under Permissions Policies, click Add Permissions and select Create Inline Policy. This policy provides the necessary permissions for C1 to securely integrate with your AWS IAM Identity Center setup. Below is the full policy, followed by a detailed breakdown of each section.

Switch to the JSON Editor tab and paste the following policy into the editor:

{
  "Statement": [
    {
      "Action": [
        "iam:GetGroup",
        "iam:GetAccessKeyLastUsed",
        "iam:GetLoginProfile",
        "iam:GetRole",
        "iam:ListAccountAliases",
        "iam:ListGroups",
        "iam:ListRoles",
        "iam:ListUsers",
        "identitystore:GetGroupMembershipId",
        "identitystore:ListGroupMemberships",
        "identitystore:ListGroups",
        "identitystore:ListUsers",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:ListAccounts",
        "organizations:ListParents",
        "sso:DescribePermissionSet",
        "sso:GetInlinePolicyForPermissionSet",
        "sso:ListAccountAssignments",
        "sso:ListCustomerManagedPolicyReferencesInPermissionSet",
        "sso:ListInstances",
        "sso:ListManagedPoliciesInPermissionSet",
        "sso:ListPermissionSets",
        "sso:ListPermissionSetsProvisionedToAccount",
        "organizations:ListRoots",
        "organizations:ListOrganizationalUnitsForParent",
        "iam:GetUser",
        "iam:ListAccessKeys",
        "iam:ListSigningCertificates",
        "iam:ListSSHPublicKeys",
        "iam:ListServiceSpecificCredentials",
        "iam:ListMFADevices",
        "iam:ListUserPolicies",
        "iam:ListAttachedUserPolicies",
        "iam:ListGroupsForUser"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "ConductorOneReadAccess"
    },
    {
      "Action": [
        "cloudtrail:LookupEvents"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "SSOUserLastLogin"
    },
    {
      "Action": [
        "iam:AddUserToGroup",
        "iam:RemoveUserFromGroup",
        "iam:CreateUser",
        "sso:CreateAccountAssignment",
        "sso:DeleteAccountAssignment",
        "identitystore:CreateGroupMembership",
        "identitystore:DeleteGroupMembership",
        "identitystore:CreateUser",
        "identitystore:DeleteUser",
        "sso:DescribeAccountAssignmentCreationStatus",
        "sso:DescribeAccountAssignmentDeletionStatus",
        "iam:DeleteLoginProfile",
        "iam:DeleteAccessKey",
        "iam:DeleteSigningCertificate",
        "iam:DeleteSSHPublicKey",
        "iam:DeleteServiceSpecificCredential",
        "iam:DeactivateMFADevice",
        "iam:DeleteUserPolicy",
        "iam:DetachUserPolicy",
        "iam:DeleteUser",
        "iam:TagUser"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "ConductorOneProvisionAccess"
    },
    {
      "Sid": "AccessToSSOProvisionedRoles",
      "Effect": "Allow",
      "Action": [
        "iam:AttachRolePolicy",
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:PutRolePolicy",
        "iam:UpdateRole",
        "iam:UpdateRoleDescription"
      ],
      "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
    },
    {
      "Sid": "IAMListPermissions",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "iam:ListPolicies"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SyncIAMPolicyDocuments",
      "Effect": "Allow",
      "Action": [
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListUserPolicies",
        "iam:ListRolePolicies",
        "iam:ListGroupPolicies",
        "iam:GetUserPolicy",
        "iam:GetRolePolicy",
        "iam:GetGroupPolicy",
        "iam:ListAttachedUserPolicies",
        "iam:ListAttachedRolePolicies",
        "iam:ListAttachedGroupPolicies"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetSAMLProvider"
      ],
      "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/OrganizationAccountAccessRole"
    }
  ],
  "Version": "2012-10-17"
}

Notes about permissions: Section 1: Read-only access (“C1ReadAccess”) This group of permissions is the minimum required for C1 to discover and sync your Identity Center users, groups, and permission sets. These are strictly read-only permissions.

iam:CreateUser: This permission is required to provision IAM user accounts.
iam:List..., iam:GetGroup: These are standard IAM permissions for listing and retrieving users, groups, and roles. They are necessary to identify resources within your AWS account. iam:GetGroup provides the members of a group.
iam:GetRole: Recommended, used to read a role’s trust policy when syncing grants for that role. If omitted, the connector logs a warning and skips trust-policy grants for that role instead of failing.
identitystore:List...: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center.
organizations:ListAccounts: This permission allows C1 to list all accounts within your AWS Organization.
organizations:DescribeOrganization: Not currently used by the connector; included for parity with the rest of this policy and to reserve it in case it’s needed in the future.
organizations:ListParents: Recommended, only needed to re-parent accounts onto their Organizational Unit for the Sparse ACLs by-inheritance hierarchy. If omitted, accounts sync flat without OU grouping instead of failing.
organizations:DescribeAccount: Recommended, enables proactive validation of account status before creating assignments. If omitted, the connector proceeds anyway and surfaces a less clear error for suspended accounts.
sso:List..., sso:Describe..., sso:Get...: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set.
cloudtrail:LookupEvents: Optional, only needed when Organizations support, Identity Center support, and Sync SSO User Last Login are all enabled. The JSON above includes it so the connector can read Identity Center sign-in events in that configuration.
organizations:ListRoots, organizations:ListOrganizationalUnitsForParent: Optional, only needed for the Sparse ACLs Organization Root / Organizational Unit hierarchy (see Sparse ACLs above). If omitted, the connector logs a warning and skips the OU hierarchy instead of failing.
iam:GetUser, and various iam:List... permissions: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed. Section 2: Provisioning access (“C1ProvisionAccess”) This group of permissions is only required if you want to provision (create or delete) user assignments in AWS, including managing IAM users directly. For example, if you plan to use C1 to add a user to a group, assign a permission set to a user, create an IAM user, or fully delete an IAM user, you will need to include these permissions.
iam:AddUserToGroup, iam:RemoveUserFromGroup: These permissions are used to manage IAM group memberships directly.
sso:CreateAccountAssignment, sso:DeleteAccountAssignment: These are the core permissions for provisioning. They allow C1 to add or remove assignments of permission sets to users within your organization.
identitystore:CreateGroupMembership, identitystore:DeleteGroupMembership: These permissions manage group membership for users and groups defined within the Identity Center.
identitystore:CreateUser, identitystore:DeleteUser: Required to provision and deprovision Identity Center user accounts (separate from IAM users). Identity Store has no disable/deactivate operation, so deprovisioning is a hard delete.
iam:DeleteLoginProfile, iam:DeleteAccessKey, iam:DeleteUser, and other iam:Delete... and iam:Deactivate... actions: These permissions are required to clean up all credentials and associated policies for an IAM user before the final iam:DeleteUser action can be successful. These are required for full user deprovisioning functionality.
iam:TagUser: This permission is required to add tags to a newly created IAM user. Section 3: Access to IAM Identity Center-provisioned roles (“AccessToSSOProvisionedRoles”) This group of permissions allows C1 to inspect and manage the AWS-managed roles created by IAM Identity Center in your accounts. This is crucial for understanding how permission sets are being applied.
iam:AttachRolePolicy, iam:DeleteRole, etc.: These are permissions to manage IAM roles. The key detail is the Resource constraint: arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*. This ensures that C1 can only modify roles created and managed by the AWS IAM Identity Center service itself, preventing it from modifying other roles in your account. Note that read-only access (iam:GetRole) is granted separately in Section 1 for all roles. Section 4: Other permissions These are supporting permissions that enable specific features or functionality. Some of the permissions listed here can be omitted if your particular use case doesn’t require the data they pull in to C1.
IAMListPermissions: This section adds supplementary IAM role and managed-policy listing in the management account. Access key activity is provided by iam:ListAccessKeys and iam:GetAccessKeyLastUsed in the ConductorOneReadAccess statement above.
sts:AssumeRole: This permission is required when AWS Organizations support is enabled and the connector is doing cross-account IAM sync. That covers two cases: Organizations on with Identity Center off, and Organizations on with Identity Center on plus the “Also sync cross-account IAM” flag turned on. It lets C1 assume the OrganizationAccountAccessRole in your child accounts so it can discover and sync resources across your AWS Organization. It can be omitted if AWS Organizations support is disabled, or if Identity Center is on without the cross-account IAM flag.
iam:GetSAMLProvider: This is a necessary permission to read the configuration of the SAML provider that AWS IAM Identity Center uses for single sign-on.
The permissions listed in the "Sid": "IAMListPermissions" and "Sid": "AccessToSSOProvisiondRoles" sections are required only if you want to use C1 to create assignments in the AWS Organization’s management account. In certain cases, you may also need to add iam:UpdateSAMLProvider to these sections.
iam:ListAccessKeys and iam:GetAccessKeyLastUsed let C1 report the most recent access key activity on each IAM user. Enable Sync secrets to also sync each key as its own secret resource with per-key activity.
iam:GetLoginProfile is only needed when Sync IAM User Console Access is enabled. It lets C1 report whether an IAM user has a console password.

Click Review Policy.

Give the policy a name, such as C1Permissions and click Create Policy.

Copy the Role ARN for the Role we created, it should look like: arn:aws:iam::NNNNNNNNNN:role/ConductorOneIntegration.

Done. Next, move on to the connector configuration instructions.

Configure the AWS connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in C1
Access to the set of AWS credentials generated by following the instructions above

Cloud-hosted
Self-hosted
Terraform

Follow these instructions to use a built-in, no-code connector hosted by C1.

Return to the AWS v2 connector setup page in C1.

Find the Settings area of the page and click Edit.

Paste the AWS Role ARN into the Role ARN field.

Optional. Click to Enable support for AWS Organizations. If support for AWS Organizations is enabled, the IAM Role (as described in Step 2) must be created in the management (formerly called master) account of the AWS Organization. If the IAM Role is created on a member account and support for AWS Organizations is enabled, the integration will return a 400 error.

Optional. Click to Enable support for AWS IAM Identity Center and select the region for AWS IAM Identity Center from the dropdown.

Optional. Enable Sync secrets to display them on the Inventory page.

Optional. Enable Sync IAM User Console Access to report whether each IAM user has a console password. The connector role must include iam:GetLoginProfile.

Optional. If both Organizations support and Identity Center support are enabled, enable Sync SSO User Last Login to report Identity Center sign-ins. The connector role must include cloudtrail:LookupEvents.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your AWS connector is now pulling access data into C1.

Follow these instructions to use the Amazon Web Services connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.
GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new AWS connector

In C1, navigate to Apps > Connectors and click Add connector.

Search for Baton and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret. Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your AWS connector deployment:

Secrets configuration

# baton-aws-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-aws-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # AWS credentials
  BATON_EXTERNAL_ID: <External ID for the AWS account, generated by C1>
  BATON_ROLE_ARN: <AWS Role ARN>

  # Optional: Include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

  # Optional: Include if you want to enable support for AWS Organizations (see note below)
  BATON_GLOBAL_AWS_ORGS_ENABLED: true

  # Optional: Include if you want to enable support for AWS IAM Identity Center
  BATON_GLOBAL_AWS_SSO_ENABLED: true
  BATON_GLOBAL_AWS_SSO_REGION: <Region for SSO identities (default is "us-east-1")>

  # Optional: Sync access keys as secret resources on the Inventory page
  BATON_SYNC_SECRETS: true

  # Optional: Report whether IAM users have a console password
  # Requires iam:GetLoginProfile
  BATON_SYNC_IAM_USER_CONSOLE_ACCESS: true

  # Optional: Report Identity Center user Last Login from CloudTrail
  # Requires Organizations and Identity Center support plus cloudtrail:LookupEvents
  BATON_SYNC_SSO_USER_LAST_LOGIN: true

  # Optional: Choose which AWS user type C1 should create when provisioning accounts.
  # "iam_user" (default) creates IAM users. "sso_user" creates AWS Identity Center
  # (SSO) users via the Identity Store API. Only one path is active at a time per
  # connector instance, so a single instance cannot provision both IAM and SSO users.
  BATON_CREATE_ACCOUNT_RESOURCE_TYPE: sso_user

If support for AWS Organizations is enabled, the IAM Role must be created in the management (formerly called master) account of the AWS Organization. If the IAM Role is created on a member account and support for AWS Organizations is enabled, the integration will return a 400 error.The identitystore:CreateUser and identitystore:DeleteUser actions in the SSO policy below are only exercised when BATON_CREATE_ACCOUNT_RESOURCE_TYPE=sso_user. They are listed in the policy regardless so an operator who later switches the target does not need to re-grant the role.See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-aws.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-aws
  labels:
    app: baton-aws
spec:
  selector:
    matchLabels:
      app: baton-aws
  template:
    metadata:
      labels:
        app: baton-aws
        baton: true
        baton-app: aws
    spec:
      containers:
      - name: baton-aws
        image: public.ecr.aws/conductorone/baton-aws:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-aws
        envFrom:
        - secretRef:
            name: baton-aws-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the AWS connector to. AWS data should be found on the Entitlements and Accounts tabs.

Done. Your AWS connector is now pulling access data into C1.

Configure the AWS connector using Terraform

Use the following Terraform script to integrate your AWS instance with C1.

Step 1: Get C1-provided External ID for AWS IAM Role

Log into C1.

Click Connectors > AWS Connector.

Copy and save the External ID populated in the External ID field. We’ll use this in Step 2.

Step 2: Use a Terraform script to set up the AWS integration

variable "EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE" {
  description = "C1-provided External ID for AWS IAM Role from Step 1"
  type        = string
}

resource "aws_iam_role" "ConductorOneIntegration" {
  name = "ConductorOneIntegration"
  assume_role_policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Principal" : {
            "AWS" : "arn:aws:iam::765656841499:role/ConductorOneService"
          },
          "Action" : "sts:AssumeRole",
          "Condition" : {
            "StringEquals" : {
              "sts:ExternalId" : var.EXTERNAL_ID_FROM_C1_INTEGRATIONS_PAGE
            }
          }
        }
      ]
    })

  inline_policy {
    name = "ConductorOnePermissions"
    policy = jsonencode({
      "Statement" : [
        {
          "Action" : [
            "iam:GetGroup",
            "iam:GetAccessKeyLastUsed",
            "iam:GetLoginProfile",
            "iam:GetRole",
            "iam:ListAccountAliases",
            "iam:ListGroups",
            "iam:ListRoles",
            "iam:ListUsers",
            "identitystore:ListGroupMemberships",
            "identitystore:GetGroupMembershipId",
            "identitystore:ListGroups",
            "identitystore:ListUsers",
            "organizations:DescribeAccount",
            "organizations:DescribeOrganization",
            "organizations:ListAccounts",
            "organizations:ListOrganizationalUnitsForParent",
            "organizations:ListParents",
            "organizations:ListRoots",
            "sso:DescribePermissionSet",
            "sso:GetInlinePolicyForPermissionSet",
            "sso:ListAccountAssignments",
            "sso:ListCustomerManagedPolicyReferencesInPermissionSet",
            "sso:ListInstances",
            "sso:ListManagedPoliciesInPermissionSet",
            "sso:ListPermissionSets",
            "sso:ListPermissionSetsProvisionedToAccount",
            "iam:GetUser",
            "iam:ListAccessKeys",
            "iam:ListSigningCertificates",
            "iam:ListSSHPublicKeys",
            "iam:ListServiceSpecificCredentials",
            "iam:ListMFADevices",
            "iam:ListUserPolicies",
            "iam:ListAttachedUserPolicies",
            "iam:ListGroupsForUser"
          ],
          "Effect" : "Allow",
          "Resource" : "*",
          "Sid" : "ConductorOneReadAccess"
        },
        {
          "Action" : [
            "cloudtrail:LookupEvents"
          ],
          "Effect" : "Allow",
          "Resource" : "*",
          "Sid" : "SSOUserLastLogin"
        },
        {
          "Action" : [
            "iam:AddUserToGroup",
            "iam:RemoveUserFromGroup",
            "iam:CreateUser",
            "sso:CreateAccountAssignment",
            "sso:DeleteAccountAssignment",
            "identitystore:CreateGroupMembership",
            "identitystore:DeleteGroupMembership",
            "identitystore:CreateUser",
            "identitystore:DeleteUser",
            "sso:DescribeAccountAssignmentCreationStatus",
            "sso:DescribeAccountAssignmentDeletionStatus",
            "iam:DeleteLoginProfile",
            "iam:DeleteAccessKey",
            "iam:DeleteSigningCertificate",
            "iam:DeleteSSHPublicKey",
            "iam:DeleteServiceSpecificCredential",
            "iam:DeactivateMFADevice",
            "iam:DeleteUserPolicy",
            "iam:DetachUserPolicy",
            "iam:DeleteUser",
            "iam:TagUser"
          ],
          "Effect" : "Allow",
          "Resource" : "*",
          "Sid" : "ConductorOneProvisionAccess"
        },
        {
          "Sid" : "AccessToSSOProvisionedRoles",
          "Effect" : "Allow",
          "Action" : [
            "iam:AttachRolePolicy",
            "iam:CreateRole",
            "iam:DeleteRole",
            "iam:DeleteRolePolicy",
            "iam:DetachRolePolicy",
            "iam:ListAttachedRolePolicies",
            "iam:ListRolePolicies",
            "iam:PutRolePolicy",
            "iam:UpdateRole",
            "iam:UpdateRoleDescription"
          ],
          "Resource" : "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
        },
        {
          "Sid" : "IAMListPermissions",
          "Effect" : "Allow",
          "Action" : [
            "iam:ListRoles",
            "iam:ListPolicies"
          ],
          "Resource" : "*"
        },
        # Required to sync IAM managed policies and inline policies as resources,
        # including their policy documents. Omit to sync policy resources without
        # their document contents.
        {
          "Sid" : "SyncIAMPolicyDocuments",
          "Effect" : "Allow",
          "Action" : [
            "iam:GetPolicy",
            "iam:GetPolicyVersion",
            "iam:ListUserPolicies",
            "iam:ListRolePolicies",
            "iam:ListGroupPolicies",
            "iam:GetUserPolicy",
            "iam:GetRolePolicy",
            "iam:GetGroupPolicy",
            "iam:ListAttachedUserPolicies",
            "iam:ListAttachedRolePolicies",
            "iam:ListAttachedGroupPolicies"
          ],
          "Resource" : "*"
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "iam:GetSAMLProvider"
          ],
          "Resource" : "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
        },
        # Required when AWS Organizations is enabled and cross-account IAM sync is on. Cross-account IAM runs automatically when Identity Center is disabled, and runs alongside Identity Center when the cross-account IAM flag is set. Omit if Organizations is disabled, or if Identity Center is on and the cross-account IAM flag is off.
        {
          "Effect": "Allow",
          "Action": [
            "sts:AssumeRole"
          ],
          "Resource": "arn:aws:iam::*:role/OrganizationAccountAccessRole"
        }
      ],
      "Version" : "2012-10-17"
    })
  }
}

After applying the Terraform configuration, enable Sync secrets and Sync IAM User Console Access in the connector settings if you want their optional data. Enable Sync SSO User Last Login only when both Organizations support and Identity Center support are enabled.

If your users work from the command line, see Use Cone with AWS IAM Identity Center to request and retrieve AWS credentials directly from the AWS CLI.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up an AWS connector

Capabilities

AWS STS web identity action

Sparse ACLs: Organizations and permission sets as scoped bindings

IAM policies as resources

Gather AWS credentials

IAM setup: Gather credentials that support syncing child account data

Get a C1-provided External ID

Create a custom IAM role

Grant permission for data sync

Identity Center setup: Gather credentials

Get a C1-provided External ID

Create a custom IAM role

Configure the AWS connector

Resources

Step 1: Set up a new AWS connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Configure the AWS connector using Terraform

Step 1: Get C1-provided External ID for AWS IAM Role

Step 2: Use a Terraform script to set up the AWS integration

​Capabilities

​AWS STS web identity action

​Sparse ACLs: Organizations and permission sets as scoped bindings

​IAM policies as resources

​IAM user last login and access key activity

​Gather AWS credentials

​IAM setup: Gather credentials that support syncing child account data

​Get a C1-provided External ID

​Create a custom IAM role

​Grant permission for data sync

​Identity Center setup: Gather credentials

​Get a C1-provided External ID

​Create a custom IAM role

​Configure the AWS connector

​Resources

​Step 1: Set up a new AWS connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

​Configure the AWS connector using Terraform

​Step 1: Get C1-provided External ID for AWS IAM Role

​Step 2: Use a Terraform script to set up the AWS integration

Capabilities

AWS STS web identity action

Sparse ACLs: Organizations and permission sets as scoped bindings

IAM policies as resources

IAM user last login and access key activity

Gather AWS credentials

IAM setup: Gather credentials that support syncing child account data

Get a C1-provided External ID

Create a custom IAM role

Grant permission for data sync

Identity Center setup: Gather credentials

Get a C1-provided External ID

Create a custom IAM role

Configure the AWS connector

Resources

Step 1: Set up a new AWS connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Configure the AWS connector using Terraform

Step 1: Get C1-provided External ID for AWS IAM Role

Step 2: Use a Terraform script to set up the AWS integration