Connect Amazon Web Services: authentication, permissions, what Noru collects, and troubleshooting.

Authentication: AWS IAM role (AssumeRole)
Categories: Infrastructure, Security
Sync cadence: Daily by default (hourly, weekly, or monthly on request)
Requested access: arn:aws:iam::aws:policy/SecurityAuditsecurityhub:* read actions (22)sts:GetCallerIdentitys3:GetBucketTagging

Noru reads one AWS account by assuming an IAM role you create from a CloudFormation template it generates. No AWS access keys are stored. The role carries the SecurityAudit managed policy plus an inline read-only Security Hub policy.

What Noru collects

Evidence type	Evidence	Read from
Scan result	AWS Security Findings	Security Hub findings (up to 100), insights, enabled standards
Policy	IAM Users, Roles, Policies; IAM Access Keys	IAM list and get calls
Log	AWS CloudTrail Events	The 50 most recent CloudTrail events
Configuration	S3 Buckets, RDS Instances, Lambda Functions, IAM Password Policy, IAM Account Summary, EBS Default Encryption, CloudTrail Trails, Config Recorder Status, VPC Flow Log Coverage, Lambda Public Functions	S3, RDS, Lambda, IAM, EC2, CloudTrail, Config describe calls
Network	Load Balancers, Security Groups	ELBv2 and EC2 describe calls
Inventory	AWS Account Summary	STS and IAM

Assets are created for EC2 instances, RDS instances, S3 buckets, Lambda functions, and VPCs. Findings come from Security Hub (resolved and suppressed skipped) plus derived checks: IAM users without MFA, root access keys, public RDS instances, security groups open to 0.0.0.0/0, publicly invokable Lambda functions, expired ACM certificates. Evidence maps to IAM, vulnerability, configuration, cryptography, network, and asset management controls.

What Noru does not collect

Object contents in S3, database rows in RDS, or DynamoDB items.
Secret values. Secrets Manager is limited to listing metadata.
Lambda environment variables. They are never stored.
KMS, GuardDuty, Secrets Manager, ACM, and DynamoDB data. These are not read today, even though SecurityAudit would allow it.

CloudTrail events are stored

The 50 most recent CloudTrail events are collected as evidence, including their request parameters. If your trail records sensitive request bodies, turn off Include CloudTrail before connecting.

Before you connect

Permission to create a CloudFormation stack that creates an IAM role in the target account.
The AWS region where Security Hub is enabled.
Admin or editor role in Noru.

Connect

Open Data Sources, click Connect Data Source, and pick Amazon Web Services. The Connect AWS Security Hub dialog opens.

Under Step 1: Select AWS Region, choose the region.

On the Deploy step, click Download Template. The template creates a role named noru-reader- followed by a per-integration token.

In the AWS console, open CloudFormation, choose Create stack and With new resources, upload the template, and continue without changing parameters.

When the stack completes, copy the RoleArn output into the Role ARN field.

Review the Integration Details card (Account ID, Region, Role ARN), then enter an Integration Name and a Sync Frequency.

Click Create Integration. Noru assumes the role, checks that the caller identity matches the account in the ARN, and shows "AWS integration created successfully!".

After connecting

The first sync runs on schedule or when you click the row's refresh button. Expect evidence under the names above, assets in Assets, and findings in Findings. The dialog's Max Security Findings and Finding Severity options currently have no effect: every sync collects up to 100 findings regardless of severity.

Permissions in detail

Grant	Why Noru needs it	What it could technically allow
`SecurityAudit` managed policy	IAM, CloudTrail, Config, S3, EC2, RDS, Lambda, and ELB describe and list calls	Read access to configuration across most AWS services, including some Noru never calls
Inline `NoruSecurityHubReadOnlyPolicy` (22 `securityhub:` actions such as GetFindings, GetInsights, GetEnabledStandards, DescribeStandards, ListMembers)	Security Hub findings and standards	Read every Security Hub finding and member account relationship
`sts:GetCallerIdentity`	Verify the assumed role belongs to the stated account	Nothing beyond the caller's own identity
`s3:GetBucketTagging`	Tags on buckets for inventory	Bucket tags only

The trust policy lets Noru's AWS account assume the role only when sts:ExternalId matches a high-entropy external ID that Noru generates for this integration and embeds in the template; it cannot be supplied or changed from the app. Sessions last at most one hour (MaxSessionDuration 3600) as NoruSecurityHubIntegration. The dialog says Security Hub only; the attached breadth is SecurityAudit, which is wider.

Troubleshooting

"Could not assume the AWS role. Deploy the CloudFormation template downloaded for this integration so the role trust policy carries its external ID, then try again." The role was not created from this integration's template.
"Account ID does not match the Role ARN" or "The assumed AWS role belongs to a different AWS account than the one provided." Re-check the ARN you pasted.
"Invalid Role ARN format. Expected: arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME".
"AWS integration is missing its per-integration external ID. Reconnect the integration and redeploy the CloudFormation template downloaded from Noru." Older integrations show a Strengthen this AWS connection prompt; use Verify and Upgrade AWS after redeploying.
Expired or deleted roles show as Error and are retried automatically, not as Disconnected; fix the stack and sync again.

Amazon Web Services

How it works under the hoodTechnical

On this page