Skip to main content

​
Supported Features

Account Deletion Account Provisioning

​
Prerequisites

​
How to Log In to Amazon Web Services

Go to the AWS login page and sign in as a root user or IAM user. AWS login screen

​
How to Create an Integration Policy

  1. Go to Identity and Access Management (IAM), click Policies in the left menu, then click Create policy. IAM Policies screen
  2. On the Create policy screen, click the JSON tab and overwrite it with the following script. To retrieve the LastActivity of roles, add "iam:GetRole", below "iam:ListRoles", in the policy script.
    If you do not need account deletion or provisioning (Read Only), use the following script instead.To retrieve the LastActivity of roles, add "iam:GetRole", below "iam:ListRoles", in the policy script.
  3. After entering the details, click Next. Policy JSON editing screen
  4. On the next screen, enter any name in the Policy name field and click Create policy. The policy is now created. Policy name input screen

​
How to Create an Integration Role

  1. Go to Identity and Access Management (IAM), click Roles in the left menu, then click Create role. Note: Role LastActivity cannot be retrieved. IAM Roles screen
  2. Under Select trusted entity, enter the following values:
    • Trusted entity type: Select AWS account
    • AWS account: Select Another AWS account and enter 162001151631 as the Account ID
    • Check Require external ID (Best practice when a third party will assume this role)
    • For the External ID, enter a random alphanumeric string (at least 24 characters, no symbols recommended)
    • Uncheck Require MFA
    Click Next when done. Role creation screen
  3. The Add permissions screen will appear. Select the policy created in the previous step, scroll down, then click Next. Add permissions screen
  4. Enter a name for the role (any name), scroll down, then click Create role. The role is now created. Role name input screen

​
How to Find the Role ARN

  1. Search for the role you created on the Roles screen and click it. Roles list screen
  2. The Role ARN will be displayed. Copy and save it. Role ARN display screen

​
Integration Setup

  1. in the integration screen, search for AWS IAM.
  2. Enter the Role ARN obtained in the previous step and the External ID set when creating the role. Role ARN input screen
  3. Select the permissions. If you do not want to retrieve roles during integration, select Read And Write (excluding roles). Permissions selection screen
  4. Review the entered details and click Connect. Integration confirmation screen
  5. Once the integration with AWS is successful, the registered user information will appear in the account list.
If the integration does not complete successfully. Go to the Status tab on the integration screen, click Edit, and try connecting again. If the issue persists, please contact us via chat.

​
Supplement: Retrieving Email Addresses

AWS does not retrieve email addresses by default, so the user type will be shown as “Unknown” or “System.” To retrieve email addresses, use one of the following methods:
  1. Use the Account Merge feature
This allows user types to be assigned, enabling more accurate management of offboarded employees.
  1. Assign email addresses directly to IAM users using tags.
By setting the tag key to email and the tag value to the email address, the email address will be retrieved. IAM tag settings screen
Last modified on July 22, 2026