Skip to main content

​
Overview

The AWS integration lets you scan one or more AWS accounts from within Pwnbook. It discovers running resources, checks for security misconfigurations, and imports findings for review.

​
Prerequisites

  • An AWS account with permissions to create IAM roles and policies
  • Admin or Owner access in Pwnbook to configure the integration

​
Connecting an AWS account

Pwnbook uses an IAM role with read-only permissions, following the AWS recommended cross-account access pattern.
1

Open the AWS integration

Go to Organization Settings → Marketplace → AWS and click Connect AWS Account.
2

Create the IAM role in AWS

Using CloudFormation (recommended):
  1. Click Deploy CloudFormation Stack.
  2. You’ll be redirected to the AWS CloudFormation console with the template pre-loaded.
  3. Review the template — it creates a read-only IAM role with an external ID.
  4. Click Create Stack and wait for completion (1–2 minutes).
Manual setup:
  1. In AWS IAM, create a new role with Another AWS account as the trusted entity.
  2. Enter the Pwnbook AWS account ID and External ID shown in the integration setup.
  3. Attach the SecurityAudit and ReadOnlyAccess managed policies.
  4. Create the role and copy its ARN.
3

Enter the role ARN in Pwnbook

Paste the IAM role ARN into the Role ARN field.Select the AWS regions to include in scans.Click Test Connection to verify, then Save.

​
Running resource discovery

Once connected, discover resources:
  1. Go to Organization Settings → Integrations → AWS.
  2. Select the connected account.
  3. Click Run Discovery.
  4. Choose resource types and regions.
  5. Click Start.

​
Discoverable resource types

EC2 instances, Auto Scaling groups, ECS clusters and tasks, Lambda functions, Elastic Beanstalk environments.
VPCs, subnets, security groups, load balancers, CloudFront distributions, Route 53 zones.
S3 buckets (with public access status), EBS volumes, EFS file systems, RDS instances.
IAM users, roles, policies, and access keys; Cognito user pools.
GuardDuty findings, Security Hub findings, Inspector findings, CloudTrail trails, Config compliance status.

​
Security findings

Pwnbook automatically checks for common security misconfigurations:

​
Removing an AWS account

  1. Go to Organization Settings → Integrations → AWS.
  2. Click Disconnect next to the account.
  3. Confirm the disconnection.
After disconnecting, delete the IAM role from your AWS account to fully revoke Pwnbook’s access.