Amazon Elastic Compute Cloud (EC2)

​

About Amazon Elastic Compute Cloud (EC2)

​

How It Works

1. Trusts Iru’s role ARN (shown in the wizard) only when sts:ExternalId matches the value Iru displays.
2. Allows read-only EC2 and supporting calls, typically via AmazonEC2ReadOnlyAccess, or a tighter inline policy if your security team prefers least privilege.

​

Prerequisites

• IAM rights to create roles and attach policies (for example IAMFullAccess or a narrower admin role).
• The Iru principal ARN and external ID from your tenant’s connector screen (not the sample values in examples below unless they match what Iru shows you today).

​

Connect Amazon EC2 to Iru

• Iru Compliance
• AWS

Start here: open the source wizard and review the trust policy (and note the external ID). When you are ready to create the role in AWS, switch to the AWS tab and follow Create the IAM role. After you have the Role ARN, return to the Iru Compliance tab and complete Submit the role ARN in Iru below.

​

Get the trust policy from Iru

1

Open Sources

In Iru Compliance, on the left navigation bar, expand Compliance and select Sources.

2

Turn on AWS Elastic Compute Cloud (EC2)

Find AWS Elastic Compute Cloud (EC2) (use Category or Search by name or description). On that card, turn on the toggle. Leave the Iru is requesting access to external services wizard tab open.

3

Review the trust policy JSON

The wizard asks for a role ARN and displays the trust policy your IAM role must use (Principal and sts:ExternalId). Below is an example of the structure; copy the live JSON from your wizard so the account, principal ARN, and external ID match exactly.

copy=false

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::753695775620:role/IruConnect"
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

4

Switch to AWS to create the role

Keep the Iru wizard tab open for reference, then switch to the AWS tab and follow Create the IAM role.

​

Submit the role ARN in Iru

Finish the AWS tab first (through Create the IAM role) so you have the Role ARN from the new role.

1

Paste the IAM Role ARN

Return to the Iru wizard tab. Paste the Role ARN into the Role ARN field.

2

Finish the connection

Click Submit Role. When the connection succeeds, the wizard shows Connection Configured.

3

Confirm the source is Active

Close the Iru is requesting access to external services browser tab, then return to Compliance → Sources and confirm the EC2 card is Active.

Complete Get the trust policy from Iru on the Iru Compliance tab before you create this role. Use the external ID and trust policy from the live wizard when you configure Trusted entity.

​

Create the IAM role

1

Start the Create role workflow

Sign in to the AWS account that owns your EC2 workload. Open IAM → Roles → Create role.

2

Configure trusted entity

Choose AWS account → Another AWS account. Enter Iru’s AWS account ID (753695775620 unless the wizard shows a different value). Enable Require external ID and paste the external ID from the Iru wizard.

3

Attach EC2 read permissions

On Permissions, attach AmazonEC2ReadOnlyAccess.If your security team does not use the managed policy, attach an inline policy with the JSON below instead. The JSON is an example least-privilege alternative; tighten or expand actions after your team’s review.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ec2:Get*",
        "elasticloadbalancing:Describe*",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:Describe*",
        "autoscaling:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

4

Name the role and copy its ARN

Finish the wizard and name the role (for example IruEC2ReadOnly). Open the new role and copy the Role ARN from the top of the summary page. Switch back to the Iru Compliance tab and complete Submit the role ARN in Iru.

5

Verify the trust policy

Open the role’s Trust relationships tab and confirm the JSON matches what Iru displayed. Typos in the external ID are the most common cause of AccessDenied on AssumeRole.

Continue on the Iru Compliance tab to paste the Role ARN and finish the wizard (Submit the role ARN in Iru).

​

Troubleshooting

​

Considerations

​

Related Articles