AWS services

The connection uses an IAM role in your AWS account and an External ID supplied by Persyst. It does not require a permanent AWS access key to enter or share.

Divide the workCopy section link

The Persyst admin prepares resources and recipients. The AWS owner needs permission to create a role and its policies in the target account; they can complete that part without a Persyst account.

Pilot services include S3, DynamoDB, CloudWatch Logs, CloudTrail, Budgets, Cost Explorer and CloudWatch metrics. Enable only the services you need. Reads and queries remain subject to the connected account’s AWS billing.

Prepare the setup package in PersystCopy section link

1. In Data sources → Add a source, choose the AWS service.
2. Prepare a connection with a name, 12-digit AWS account ID, regions and required services. The role ARN can be added later.
3. In Resources, enter exact references: S3 bucket and prefix, DynamoDB table, log group or another required resource.
4. In Connection → IAM setup, copy or download the package containing the trust policy, permissions and resource manifest.
5. Share this package with the AWS owner.

Create the role in AWSCopy section link

1. Check the package’s target account, Persyst technical principal ARN, External ID and requested resources.
2. Create a dedicated IAM role in the target account and install the supplied trust policy with the exact principal and External ID.
3. Attach the supplied permissions for the selected resources only. For KMS-encrypted S3 objects, also check permissions on the relevant key.
4. Give the complete role ARN to the Persyst admin.

Do not replace the principal with * or remove the External ID condition. Global discovery permissions are optional when you supply exact resource references.

Verify and grant resourcesCopy section link

The admin enters the role ARN, saves, then clicks Test role and verify resources. Results distinguish the verified AWS identity from resources whose access has been confirmed. A verified identity does not prove every read permission.

In Access management, grant verified resources and their tools to recipients. A prepared reference, or a globally selected tool, does not by itself open other resources.

Remove delegationCopy section link

Remove Persyst grants for one member, or disable the connection for all its recipients. The AWS owner can also remove permissions or delete the role. To revoke already issued IAM sessions, follow AWS’s role session revocation procedure.

References: AWS third-party delegation and External ID, revoking IAM sessions.