Give Your Auditor AWS Access — Without Sharing a Single Credential

If your auditor asks for that, that should be the first finding. 🚩

An external auditor needs access to your AWS accounts, and the first instinct in most companies is one of two things: create an IAM user and share the access keys, or provision the auditor a user in your identity provider so they can log into the console.

Neither is necessary. An auditor doesn’t need a login in your organization at all — API access is enough. And AWS has had a mechanism for exactly this situation for over a decade. It’s the same one AWS partners and every third-party monitoring tool use:

A cross-account IAM role with a trust relationship. No credentials ever change hands.

In this article I’ll walk through how the pattern works and share two CloudFormation templates I built — one for a single AWS account, one that covers an entire AWS Organization. You can deploy either in about five minutes. Both templates are also on GitHub: https://github.com/up-cdk/aws-audit-access