AWS integration
Secorvia connects to an AWS account with a read-only IAM role or access key, builds an inventory of what it can see, and maps how resources and identities connect, so findings can be ranked by what an attacker could reach.
What Secorvia reads from AWS, and what it finds
The AWS services Secorvia lists on its homepage are EC2, S3, IAM, RDS, Lambda, EKS and CloudTrail. It reads how those resources are configured, which identities can act on them and how they relate to each other. It does not read what is inside them, so object contents and database rows stay where they are.
What comes back is an inventory, a list of findings and a graph. The inventory records each resource's ID, region, tags and raw metadata, with the times it was first and last seen. Each finding carries its evidence, an explanation of why it matters, remediation guidance and its compliance impact. The graph joins resources and identities into one picture, and from the Starter plan it is used to rank attack paths: routes from something exposed, through identity and network relationships, to something worth protecting. Attack path analysis explains the method, and four worked AWS examples show each path with the one change that breaks it.
Identity analysis (CIEM) is part of the Growth plan. It reports the identities in an account, which of them are administrative, how many external trust relationships exist and the critical and high findings attached to them. The compliance views list the CIS AWS Foundations benchmark among their frameworks, and compliance starts on the Starter plan.
What connecting AWS takes
You choose between two credential types. The IAM role route is recommended: Secorvia assumes a role in your account, and the role's trust relationship uses an external ID that you control. The alternative is an IAM access key. In either case you create the credential in your own account, so you decide how narrow it is and you can rotate or delete it whenever you like.
In Secorvia you open Cloud Accounts, choose Add Cloud Account, name the connection and pick the authentication method. You then enter the 12-digit AWS account ID and a default region. For the role route you add the role ARN and the external ID. For the access-key route you add the access key ID and the secret access key. Secret values are encrypted before they are stored and are not shown again after you save.
Saving the connection starts the first scan automatically. The account's detail page shows its connection status and when it was last validated, and links to scan history, inventory and findings for that account alone. Treat a finished scan as the milestone, not the saved connection: an empty findings list while the scan is still running is not a clean result. The AWS connection guide shows each screen, and the scan history guide explains how to read a pending or failed scan.
Each AWS account is connected on its own, and the guide has you verify the first before adding more. How many you can connect depends on the plan: one per provider on Free, three on Starter, 25 on Growth and no fixed limit on Enterprise. Scans can be scheduled hourly, daily, weekly or monthly for each account.
What Secorvia does not do on AWS
Secorvia is read-only. It never asks for write access to your infrastructure, and a read-only credential cannot change your environment. It reports problems and does not fix them, so a remediation is a change you make in AWS, followed by a new scan. A finding you mark resolved is only verified once a scan no longer detects it.
Three more limits are worth knowing. What Secorvia can see is bounded by what you grant, so a narrower role means fewer resources and some findings that cannot be produced. The connection guide describes the fields and the checks and does not include a fixed policy to paste, so if your security team wants the exact permission list before approving a connection, the security page says how to ask for it. And a scan is a snapshot of the account at the time it ran, not a live feed.
If your concern is who outside your organization can assume roles in your account, the open source tool frontdoor checks federated and cross-account trust. It is separate from the platform and needs no account.
Frequently asked questions
Does Secorvia need write access to my AWS account?
No. Secorvia never asks for write access. It uses a read-only credential that you create, reads configuration and metadata, and reports problems without changing anything.
Should I use an IAM role or an access key?
The IAM role is the recommended route. Secorvia assumes the role, and its trust relationship uses an external ID that you control. An IAM access key is also supported.
Which AWS services does Secorvia cover?
The homepage lists EC2, S3, IAM, RDS, Lambda, EKS and CloudTrail. After your first scan the inventory shows what was collected for your account, so check it before relying on coverage of anything else.
How many AWS accounts can I connect?
One on Free, three on Starter and 25 on Growth, counted per provider. Enterprise has no fixed limit.
Where do I find the exact IAM permissions?
The connection guide does not include a fixed policy. The security page explains how to ask for the exact permission list before your team approves a connection.