The user in Vanta connecting must be an editor or an admin in Vanta

The user must also have admin access to AWS, or permissions to create Roles and Policies in IAM

Navigate to Vanta Integrations page and select the Available tab

Search for Amazon Web Services

Click the purple Connect button
​
​

You will be taken to a page prompting you to choose the type of account you wish to connect for the integration. There are two account types, Account and Organization:
​
​

Select Account , for the Organization connection flow, please navigate to Connecting Vanta & AWS Organization
​​

​
​

You will then be prompted to select your preferred method. The option you choose will depend on how you manage instances and resources active on your AWS account. There are three options available:
​
1. Console - we'll continue with Console in this article, please select Console under the preferred method and then next:
​
​

​
2. CloudFormation - See, Connecting AWS with CloudFormation
3. Terraform

You will be taken to a menu where you must select your account type. Select Yes, if the AWS Account you are connecting is an AWS GovCloud Account, or No if it is not; then click Next

You will be taken to a menu where you can select the products used within your organization. You can click the toggle button to enable the desired product on the integration:
​
​

​
The available products on this menu are:
​
1. AWS Web Services (On by Default, Cannot be Disabled)
2. AWS CodeCommit
3. AWS IAM Identity Center
4. Amazon Inspector/Basic Scanning
​
​

After enabling the desired products, click the next button to move on to policy creation.
​
​

You will be presented with a page displaying JSON of the permissions you need to grant Vanta in order for the integration to work. The permissions displayed depend on the products enabled in the previous menu. You will need to add these permissions to a customer-managed policy in AWS.
​
​

Sign into AWS, and once on the home page, use the search bar to search for IAM, and click 'policies' in the Top Features sub-menu:
​
​

Next click create policy, and then click JSON button on the Policy editor table. From there delete the existing text in the editor:
​
​

Navigate back to Vanta and click the copy button:
​
​

​
Then, head back over to the policy editor in AWS, and paste the copied JSON into the editor. Ensure there are no extra spaces or additional characters, then click next:
​
​

After you click the Next button

You will be taken to a page where you must enter policy details such as name and description. Name the policy VantaAdditionalPermissions and enter your desired description, then click Create policy:
​
​

You will be instructed to navigate back to AWS and head to roles page in IAM. This can be found by going to the left hand menu, and selecting roles under 'Access Management':
​
​

Click on the 'Create role' button on the top right:
​
​

Then select 'Custom trust policy' as the Trusted entity type :
​
​

A text editor will appear on the bottom of the page after the selection is made , delete all of the existing text:
​
​

Then head back into Vanta and copy the snippet below step 3 and head back into AWS and paste it into the editor. From there click Next on the bottom right of the page:
​
​

You will be taken to a page where you will grant the role specific permissions, those being the SecurityAudit permission set and the VantaAdditionalPermisisons you created in an earlier step. Both these permissions are required for the integration to work properly, do not omit either.
​

You will be taken to a page where you must grant the role a name, and a description. Name the role vanta-auditor and enter your desired description, then click Create role on the bottom right of the page:
​
​

Head back to Vanta and click Next twice to head to the 'Role ARN' section:
​
​

Next, paste the ARN you copied from AWS into the text box under step 2 and click next:
​
​

In the Region selection step, you will be able to add additional regions outside of the default by clicking on Select regions box
​
​

You can click the "X" to remove any regions that you do not wish to be connected. If removed, Vanta will not pull in any resources within that region on the account.

Clicking Next will complete the linking process.
If it's successful, you will receive the message "All your resources have finished loading."

After you are done with the initial account connection, you can add additional AWS accounts by:

If you're not using S3 Bucket policies, you will not need to modify any policy for Vanta to read in S3 Buckets. If your account is using S3 buckets, you may be using S3 Bucket Policies. If so, you'll need to also modify these permissions to let Vanta fetch your buckets, since S3 bucket policies override the default permissions.

To do this, grant further permissions to `vanta-auditor` on the bucket policy itself by following instructions under "Granting cross-account bucket access to a specific IAM role" in AWS's guide. The permissions should be those from the `SecurityAudit` policy. Here is an example of what you would add to the bucket policy:
​
​