Amazon Web Services

The AWS integration connects HomeBase to CloudTrail, GuardDuty, Security Hub, IAM, and Config — ingesting threat findings, configuration changes, and identity events across all monitored accounts and regions.

What's ingested

• CloudTrail — API call history, IAM mutations, unusual access patterns.
• GuardDuty — threat detections: malware, compromised credentials, unusual network behaviour.
• Security Hub — aggregated findings from GuardDuty, Inspector, Macie, and third-party tools.
• IAM — user, role, and policy inventory; privilege escalation detection.
• AWS Config — configuration change history and compliance rules.

Setup: cross-account IAM role

HomeBase uses a read-only cross-account IAM role to access your AWS account. No long-lived credentials are stored.

1. Create the IAM role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "hld-ext-YOUR_TENANT_ID"
        }
      }
    }
  ]
}

2. Attach permissions

The role needs the following AWS managed policies:

3. Register the integration

POST /v1/integrations

{
  "type": "aws",
  "tenant_id": "ten_01hxyz",
  "credentials": {
    "role_arn": "arn:aws:iam::YOUR_ACCOUNT_ID:role/HLDHomeBaseRole",
    "external_id": "hld-ext-YOUR_TENANT_ID"
  },
  "config": {
    "regions": ["ap-southeast-2", "us-east-1"],
    "ingest_cloudtrail": true,
    "ingest_guardduty": true,
    "ingest_security_hub": true
  }
}