Least privilege for tools connected to AWS accounts

Connecting a tool to AWS is a trust decision, not a setup checkbox. The customer should be able to inspect the assumed role, understand the actions it permits, and remove it without depending on the tool vendor.

Separate reading from changing

Discovery and analysis generally need read-only access. Deployment and remediation need a different role with a narrower, explicit write scope. Combining them because a product may eventually need both makes every connection harder to approve and harder to reason about.

Use a per-customer external ID, request only the resources the job needs, and document the role policy in the integration flow. A useful connection also states its failure mode: if the role is removed, the product loses context but the workload continues to run in the customer account.

Trust grows when a boundary is visible and reversible.