> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/integrations/aws-1.md).

# AWS User-Based Access \[Deprecated]

## <mark style="color:$danger;">Deprecation Notice</mark>

{% hint style="danger" %}
This document refers to an AWS connection method that was replaced in February 2025 with an improved method using short-term credentials.\
\
Existing connections using this method remain unaffected and can be updated, but new integrations may only use the [role-based connection method](/integrations/aws.md). If you have an existing integration that used this method and would like to convert it to te new role-based access, speak to your support representative.
{% endhint %}

## Overview

Cisco Identity Intelligence can connect directly to AWS environments that use [AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) and collect data regarding user accounts, activity, and more.

## Known Issues

There is currently an issue with the AWS API where user accounts that are disabled in AWS will have their account status returned as active, even though they show as disabled in the AWS IAM console.\
\
Currently, CII shows all AWS accounts as `unknown` due to this issue.

## Requirements

This integration requires the following:

* AWS IAM Identity Center is the replacement for the former AWS Single Sign-on (SSO) functionality (see [article](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html#renamed)). <mark style="color:red;">**The use of AWS IAM Identity Center is a hard requirement for this integration.**</mark> User data will not be collected without it.
* IAM Identity Center is configured for your AWS enterprise account at a parent level (organization), with child AWS accounts managed by that IAM Identity Center instance (example shown below)
* If IAM Identity Center is configured separately or discretely with individual AWS account instances, then you will need to set up a CII AWS integration for each account.

<figure><img src="/files/R70UHtpLdgsqaPEgehKi" alt=""><figcaption></figcaption></figure>

## AWS Configuration

<mark style="color:orange;">**Note**</mark> - there are many methods for creating accounts and granting access with AWS IAM. If you have questions or suggestions, please speak with your Oort technical representative.

1. Navigate to the AWS IAM service in the parent AWS account, where SSO is configured.

<figure><img src="/files/eToaIDwJJp9fdJ7eGBn6" alt=""><figcaption></figcaption></figure>

2. Click <mark style="color:orange;">**Create user**</mark> and then create an Oort integration user object.
3. Within the **Permissions** section, create an inline policy type and insert or paste the following JSON into it:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sso:List*",
                "sso:Describe*",
                "sso:Get*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "identitystore:List*",
                "identitystore:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "cloudtrail:LookupEvents",
            "Resource": "*"
        }
    ]
}
```

4. Within the User object page, click the **Security Credentials** tab
5. Click **Create access key**

<figure><img src="/files/UE1Oa52HKdS11JIDlA5Q" alt=""><figcaption></figcaption></figure>

6. Select **Command Line Interface (CLI)** and click the Confirmation box at the bottom of the page

<figure><img src="/files/SLmnsMoek69G647Y1Twg" alt=""><figcaption></figcaption></figure>

7. Leave the Set description tag value blank and click <mark style="color:orange;">Create access key</mark>
8. Copy the Access key name and the Secret for use in the Oort console

<figure><img src="/files/0qXHgt3AfSCYDrtADelP" alt=""><figcaption></figcaption></figure>

## Oort Configuration

1. Within the Integrations tab, click Add Integration and click AWS

<figure><img src="/files/jouarTL89FYCEzXJOzhp" alt=""><figcaption></figcaption></figure>

2. Enter a display name for the integration
3. Enter the AWS region where the IAM service account was created, in `us-east-2` format
4. Enter the Access Key ID
5. Enter the Access Key secret
6. Click Save

<figure><img src="/files/wTwbNjKgBiEngrYDpgVN" alt=""><figcaption></figcaption></figure>

### Test Connectivity

Once saved, on the Integrations page, you can click the 3-dot menu on the right side for your AWS integration and click **Test Connectivity**.

If successful with a "Connected" message in the lower left of the screen, you can click the 3-dot menu again and select **Collect Now** to begin collection.

<figure><img src="/files/ErQkJnC6HXY36EkZMIQO" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.oort.io/integrations/aws-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.