> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS Identity and Access Management (IAM)
> Connect AWS IAM to Iru Compliance with a cross-account IAM role to collect users, roles, policies, MFA status, and credential-report evidence for audits.
### About AWS Identity and Access Management (IAM)
The **IAM** connector inventories **users**, **roles**, **groups**, **policies**, **access keys**, **MFA devices**, and **credential reports**. High sensitivity data used for access-review evidence. The integration uses **`sts:AssumeRole`**. **`IAMReadOnlyAccess`** is simplest; the inline JSON below narrows to **`Get*`** / **`List*`** plus **`GenerateCredentialReport`** / **`GenerateServiceLastAccessedDetails`**.
Treat the **cross-account role ARN** like infrastructure secrets - limit who edits trust relationships.
### How It Works
Iru runs in its own AWS account. To read **IAM** data in your account, you create an **IAM role** with a **trust policy** that allows Iru’s principal to call **`sts:AssumeRole`**, gated by the **External ID** from the wizard, and a **permissions policy** that grants read-only access to IAM resources (for example **`IAMReadOnlyAccess`** or the tighter inline JSON on the [**AWS**](#aws) tab). You then paste the role’s **ARN** back into Iru. **`IAMReadOnlyAccess`** exposes identities, policy documents, and access-key metadata by design, so treat the role and its ARN as sensitive.
| Detail | Value |
| ------------------ | ---------------------- |
| **Category** | Identity |
| **Authentication** | Cross-account IAM role |
### Prerequisites
* IAM admin rights in the **same account** whose IAM plane you want evidence for.
### Connect AWS IAM to Iru
Start here: open the source wizard and copy the **trust policy** (and note the **external ID**). When you are ready to create the role in AWS, switch to the [**AWS**](#aws) tab and follow [**Create the IAM role in AWS**](#create-the-iam-role-in-aws). After you have the **Role ARN**, return to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru) below.
#### Get the trust policy from Iru
In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.
Find **AWS IAM** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. Leave the **Iru is requesting access to external services** wizard tab open.
The wizard shows the **trust policy** JSON your IAM role must use (**Principal** and **sts:ExternalId**). Below is an **example** of the structure; **copy the live JSON from your wizard** so the account, principal ARN, and external ID match exactly.
```json copy=false lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::753695775620:role/IruConnect"
},
"Condition": {
"StringEquals": {
"sts:ExternalId": "YOUR_EXTERNAL_ID"
}
},
"Action": "sts:AssumeRole"
}
]
}
```
Keep the Iru wizard tab open for reference, then switch to the [**AWS**](#aws) tab and follow [**Create the IAM role in AWS**](#create-the-iam-role-in-aws).
#### Submit the role ARN in Iru
Finish the [**AWS**](#aws) tab first (through [**Create the IAM role in AWS**](#create-the-iam-role-in-aws)) so you have the **Role ARN** from the new role.
Return to the Iru wizard tab. Paste the **Role ARN** into the field the wizard provides.
Click **Submit Role**. When the connection succeeds, the wizard shows **Connection Configured**.
Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **AWS IAM** card is **Active**.
Complete [**Get the trust policy from Iru**](#get-the-trust-policy-from-iru) on the [**Iru Compliance**](#iru-compliance) tab before you create this role. Use the **external ID** and trust policy from the live wizard when you configure **Trusted entity**.
#### Create the IAM role in AWS
In the account whose IAM data you need, open **IAM** → **Roles** → **Create role**.
Choose **AWS account** → **Another AWS account**. Enter **`753695775620`** (or the account ID Iru shows). Enable **Require external ID** and paste the value from Iru.
Attach **`IAMReadOnlyAccess`**, **or** add this **inline policy** if you cannot use the managed policy. The JSON below is an **example**; tighten actions if your security team requires it.
```json lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:Get*",
"iam:List*",
"iam:GenerateCredentialReport",
"iam:GenerateServiceLastAccessedDetails"
],
"Resource": "*"
}
]
}
```
Name the role (for example **`IruIAMReadOnly`**), create it, and copy the **Role ARN** from the role summary. Switch back to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru).
On **Trust relationships**, verify the JSON matches Iru’s wizard exactly.
Continue on the [**Iru Compliance**](#iru-compliance) tab to paste the **Role ARN** and finish the wizard ([**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru)).
### Troubleshooting
Check **pop-up blocker** settings for the Iru site and try again.
Prime **`GenerateCredentialReport`** manually once via console/CLI.
Wildcards must cover **`Get*`** / **`List*`** for each resource type you expect.
### Considerations
IAM is **global** within an account - single scan covers all Regions’ IAM APIs.
### Related Articles
Browse and manage every Compliance source.
Frameworks, actions, and **Artifacts**.
How Endpoint, Compliance, and Identity fit together.
Upload, review, and organize evidence from sources and actions.