cybersoftwareBack to Home
Read-only integration

Connect AWS to cybersoftware

Read-only IAM role assumption. Eleven evidence types collected automatically. Closes six SOC 2 gaps in your Slim Package without a single screenshot of your console.

Go to dashboard to connect

What we collect

Eleven evidence types map to the AICPA Common Criteria controls in your SOC 2 report. Same set every sync, no extras.

EvidenceWhat it showsSOC 2 controls
IAM usersWho has access, MFA status, and last login.CC6.1, CC6.2, CC6.3
IAM password policyAccount-wide password requirements (or absence thereof).CC6.1, CC6.2
IAM rolesPrivileged roles and the trust policies that grant them.CC6.1, CC6.3
IAM groupsGroups and their member assignments.CC6.3
IAM account summaryAccount-wide stats — user count, root MFA enabled.CC6.1, CC6.6
CloudTrail trailsAudit log configuration per region.CC7.2, CC7.3
S3 bucket encryptionServer-side encryption settings on each S3 bucket (at-rest).CC6.7, CC6.8
RDS instance encryptionStorage encryption status for each RDS database (at-rest).CC6.7, CC6.8
KMS keysCustomer-managed encryption keys per region.CC6.7
CloudWatch alarmsSecurity-relevant monitoring alarms per region.CC7.2
AWS Config recordersConfiguration drift detection per region.CC7.2

Permissions we request

SecurityAudit + ViewOnlyAccess

Both are AWS-managed policies, read-only. No write, modify, or delete on anything in your account. No access to bucket contents, database data, or customer PII.

No stored credentials

cybersoftware does not store your AWS keys. We assume your IAM role on each sync using short-lived STS tokens (~1 hour) gated by your unique ExternalId.

How to connect

Four steps, about two minutes start to finish.

  1. 1

    Open the AWS card in your cybersoftware dashboard

    Sign in to cybersoftware, go to the Integrations tab, find the AWS card, and click Connect.

    cybersoftware dashboard Integrations tab with the AWS card and Connect button highlighted
    Step 1
  2. 2

    Launch in AWS Console

    cybersoftware opens AWS CloudFormation with a pre-filled stack. Sign in to your AWS account if prompted.

    AWS CloudFormation quick-create stack page with PolaraEvidenceCollector pre-filled
    Step 2
  3. 3

    Create stack and copy the RoleArn

    Click "Create stack". After it reaches CREATE_COMPLETE (about 60 seconds), open the Outputs tab and copy the RoleArn value.

    AWS CloudFormation stack Outputs tab with the RoleArn value highlighted
    Step 3
  4. 4

    Paste the RoleArn back into cybersoftware

    Paste the RoleArn into the cybersoftware connect form and click Connect. cybersoftware validates the role with STS, then starts collecting evidence.

    cybersoftware connect form with RoleArn pasted and the Connect button highlighted
    Step 4

Manual setup

For Terraform, CDK, or restricted IAM environments▾

If your AWS account requires that all infrastructure goes through Terraform or CDK, apply the CloudFormation template directly. The two parameters cybersoftware needs:

  • ExternalId — your cybersoftware assessment UUID, shown in the cybersoftware dashboard connect form.
  • PolaraAccountId — also shown in the cybersoftware dashboard connect form.

Download the template: cloudformation.yml

Terraform example:

resource "aws_cloudformation_stack" "polara_evidence_collector" {
  name         = "PolaraEvidenceCollector"
  template_url = "https://cybersoftware.com/integrations/aws/cloudformation.yml"

  parameters = {
    ExternalId      = "<paste-from-cybersoftware-dashboard>"
    PolaraAccountId = "<paste-from-cybersoftware-dashboard>"
  }

  capabilities = ["CAPABILITY_NAMED_IAM"]
}

After the stack reaches CREATE_COMPLETE, copy the RoleArn output and paste it into the cybersoftware dashboard connect form.

Troubleshooting

Common errors and fixes▾
External ID mismatch
The ExternalId in your CloudFormation stack does not match your cybersoftware assessment UUID. Delete the stack, click Launch in AWS Console again from cybersoftware to get a fresh pre-filled link, and re-create the stack with the correct value.
Role not assumable (AccessDenied)
Confirm the CloudFormation stack reached CREATE_COMPLETE. If you applied the template by hand, make sure the IAM trust policy includes the cybersoftware account ID shown in the cybersoftware dashboard connect form. Editing the template manually is the most common cause — re-launch from cybersoftware to fix it.
Missing region / no evidence collected
IAM is global, so the AWS Console region does not matter for the role-creation step. Any region works (we recommend us-east-1 or us-west-2). cybersoftware enumerates enabled regions via ec2:DescribeRegions on each sync — if a region was enabled after your last sync, click Sync now to re-discover.

Ready to connect?

Two minutes from here. cybersoftware does the rest.

Go to your dashboard
cybersoftware

SOC 2 Type 1 and Type 2 for startups. From assessment to audit ready report. $2,000 one time for platform onboarding, or $4,000 with the SOC 2 Type 1 examination and report included. Then $600 a month on a 12 month term, or $7,000 for the first 12 months in one invoice.
Your first SOC 2 Type 2 audit is included in that term.

© 2026 cybersoftware. All rights reserved.Contact: surya@cybersoftware.com

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms. The audit opinion is theirs alone.
We generate custom policies, evidence checklists, and remediation guidance. You remain responsible for implementing controls and owning audit outcomes. Replace placeholders with your actual controls and have final documents reviewed by qualified professionals before your audit.