# AWS

> IAM, Security Hub and Config posture, read-only. Prerequisites, setup steps and troubleshooting.

Source: https://docs.csquaregrc.com/connectors/aws

## What it does

The AWS connector reads identity, Security Hub and Config posture so control evidence refreshes itself instead of being screenshotted each quarter. It never writes to your account.

## Prerequisites

- A cSquare GRC workspace where you are an **owner** or **admin**.
- Connection method: **API key or token**.
- Access needed at AWS: Read-only. SecurityAudit (or ViewOnlyAccess) is enough.

## Set up

Open **Settings > Integrations** in [the app](https://app.csquaregrc.com), find AWS, then:

1. In the AWS console open IAM and create a dedicated user for cSquare with programmatic access only.
2. Attach the AWS managed SecurityAudit policy. Do not attach write policies; the collector only reads.
3. Create an access key for that user and copy both the key ID and the secret.
4. Paste them here with the region your workloads run in, then run Test connection.

## Verify the connection

1. Back in **Settings > Integrations**, AWS should show **Connected** with a recent sync time.
2. Open **Evidence** and filter by source **AWS**. The first sync can take a few minutes.
3. Open a control that depends on AWS and confirm the new evidence is linked.

## AI prompts

Paste these into Fibo in the app, or into any assistant connected through [MCP](/mcp/connect).

```text
I just connected AWS to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from AWS.
```

```text
Which controls in my programs could be covered by AWS evidence but still have no current evidence? Group them by framework and suggest what to collect.
```

## Troubleshooting

### Test connection returns 403 AccessDenied

The IAM user is missing SecurityAudit, or Security Hub is not enabled in the selected region. Enable it or pick the region where it is on.

### InvalidClientTokenId

The access key was deleted or belongs to another account. Generate a fresh key pair and re-enter both values.

### Test connection fails immediately

Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.

### The connector is quarantined

Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.

### Connected, but no evidence appears

Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.

### Still stuck?

```text
My AWS connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.
```