Connect your AWS account

StackTakt is agentless. It connects to an AWS account through two IAM roles you create in that account, assumed cross-account with a per-connection external ID. Nothing runs inside your account, StackTakt stores connection metadata only (never long-lived credentials), and deleting the roles revokes access at any time.

The two roles

Role	Access	Purpose
Discovery	Read-only	Inventories the account and reads back resource configurations for evidence. Changes nothing.
Deployment	Scoped	Applies blueprint resources. Scoped to the templates’ resource namespaces (stacktakt-*), not blanket admin access.

Role names carry a per-tenant suffix, so one AWS account can serve more than one tenant without name collisions.

Billing data is opt-in. When you include it, the discovery role gains a separate read-only AWS Cost Explorer policy that powers the Billing report. Leave it out and the role carries no ce:* access at all.

The external ID

Each connection gets a generated external ID (format stkt-ext-xxxx-xxxx-xxxx). AWS checks it on every role assumption, which blocks confused-deputy access: nobody can use StackTakt to reach your account without both the role trust and this value.

Connect an account

1. Under Accounts, select Add AWS account and register the account’s name and 12-digit ID.
2. Select Connect on its row, confirm the region, choose whether to include billing data, and select Create connection.
3. Create the roles in AWS. Three ways to run the same stack:
   • Launch CloudFormation quick-create: opens the console with the stack prefilled (external ID, tenant slug, billing choice).
   • The AWS CLI command shown on the page.
   • The Terraform snippet, if your account is managed as code. The stack creates both roles plus the evidence and state buckets, and needs CAPABILITY_NAMED_IAM.
4. Select Validate connection.

Validation checks

Validation assumes the discovery role with a short-lived session and runs five named checks. Each reports passed or failed with a remediation:

Check	What it confirms
Role present	The discovery role exists and can be assumed.
Trust policy	The role trusts StackTakt’s AWS account.
External ID	The assumption required the connection’s external ID.
Role policies current	Both roles’ policies match what the current stack renders.
Evidence & state stores	The two stacktakt-* buckets exist.

The connection stays Pending until every check passes, then turns Healthy and writes an account.connected audit event. A previously healthy connection that fails a later validation turns Failed.

Failure paths

• AccessDenied on validate. AWS returns the same error whether the role is missing, the trust is wrong, or the external ID mismatches. The check text names all three; most often the stack has not finished creating. Wait for CREATE_COMPLETE, then validate again.
• Role policies out of date. The platform gained permissions your roles predate. Update the existing stack with the current template (the page shows the exact CLI command), or re-apply the Terraform snippet, then validate again.
• Revoking access. Delete the StackTaktConnect-* stack in the account. Both roles disappear and StackTakt can no longer reach it.