AWS Accounts Administration

Manage the lifecycle of AWS accounts connected to Securitain.

AWS account administration is intentionally separated into different actions because:

Stop scanning
≠
Revoke AWS access
≠
Delete Securitain data

Where to manage AWS accounts

Use the AWS Accounts settings page to:

• add an AWS account
• rename an account alias
• review connection state
• disconnect an account
• verify AWS access revocation
• reconnect
• permanently purge stored account data

The AWS Setup experience also provides a richer connection and capability view.

Add an AWS account

Choose Add AWS Account. Securitain routes to the AWS Setup wizard. The normal connection flow uses CloudFormation:

Securitain Setup
      ↓
Customer reviews CloudFormation
      ↓
Customer deploys audit role
      ↓
STS + External ID
      ↓
Securitain validates connection

See Connect AWS for full onboarding instructions.

Rename an account

The AWS Accounts page allows the human-facing alias/name to be edited. For example, a twelve-digit AWS account ID can be named Production or Shared Services. This does not change the underlying AWS account ID. It helps humans understand account context throughout Securitain.

Role ARN is not edited from the alias modal

The current Edit Account modal shows the IAM role ARN as connection information. It is not editable there. If connection details must change, use the AWS Setup or reconnect workflow. This keeps AWS trust configuration aligned with the setup model.

Account status

A connected account can have product connection states such as:

• Connected
• Degraded
• Failed
• Pending

Status should be interpreted with capability details. A degraded connection can still provide partial assessment coverage. Use Scan Status and capability details to understand what is available.

Test connection / capabilities

The AWS Setup account overview can test connection health and display capability areas such as: Assume Role, Caller Identity, IAM Inventory, Credential Report, Access Analyzer, CloudTrail, Resource Policies, Organizations and Identity Center. Not every capability must be available in every AWS account.

Account limits

The AWS Accounts page can display the number of accounts used versus available. The limit depends on the customer's current plan. Disconnecting an account releases its active account slot immediately.

Disconnect an AWS account

Choose Disconnect / Remove. Disconnect is the first step in offboarding. It:

• stops new Securitain use of the account
• cancels current or in-flight assessment activity where applicable
• removes the account from current posture
• releases the active account slot
• preserves account record and history for the next offboarding steps

Disconnect does not revoke AWS access by itself

The Securitain application can stop using the connection. But the AWS-side role exists inside the customer's AWS account. The customer should separately remove or revoke that AWS access. The current UI provides Open AWS CloudFormation and Copy CLI command to help remove the stack.

Recommended offboarding flow

1. Disconnect in Securitain
        ↓
2. Delete Securitain CloudFormation stack / role in AWS
        ↓
3. Verify access revoked
        ↓
4. Decide whether to retain history or permanently purge data

Verify access revoked

After the AWS role or stack is removed, choose Verify access revoked. Securitain checks whether the previous cross-account role can still be used. Possible user-visible outcomes:

• Verified revoked: the role is no longer accessible to Securitain.
• Role still accessible: AWS-side access appears to remain. Review and delete the role or stack.
• Could not verify: Securitain could not reach a conclusive result. Retry and independently review AWS.

Why revocation verification matters

Deleting the Securitain account record would not necessarily remove the role that exists in AWS. Verification helps answer whether the AWS-side trust is actually gone. This is a stronger offboarding model than merely hiding the account in the SaaS UI.

Reconnect

A disconnected account can be reconnected. Choose Reconnect. The current product returns to AWS Setup. Reconnection validates the correct connection state rather than directly editing hidden trust secrets in Settings.

Permanent purge

Examples of data that can be affected include:

• IAM inventory and findings
• Data Security inventory and findings
• stored activity and evidence
• scan history
• account-specific reports
• other stored account context

Purge does not delete AWS resources

Purge deletes Securitain's stored copy of account-related data. It does not itself delete:

• AWS IAM roles
• CloudFormation stacks
• AWS resources
• application workloads

AWS-side revocation should be handled separately.

Archived evidence

The current purge flow allows the administrator to control whether archived evidence is also removed. Permanent removal can include archived Securitain evidence associated with the account.

Purging before verified revocation

The safest workflow is to verify AWS revocation first. Authorized administrators may have an exceptional force-purge option when revocation cannot be verified. This removes Securitain's stored data but does not prove the AWS role has been removed.

Disconnect vs purge

Historical evidence after disconnect

A disconnected account can retain historical Securitain data until purge. This is useful for audit history, prior findings, incident investigation and governance records. But the disconnected account should not continue to contribute to current posture.

Security of connection secrets

Treat connection identifiers and role configuration as security-sensitive. Securitain does not display AWS secret credentials as part of account administration. Do not share External IDs or role ARNs unnecessarily.

Troubleshooting account removal

Account disconnected but AWS role still accessible

Delete the CloudFormation stack or IAM role in the customer AWS account, then re-run revocation verification.

Revocation verification is inconclusive

Check AWS directly: does the role still exist, does the stack still exist, did stack deletion fail? Then retry verification.

Need to preserve audit history

Disconnect the account and revoke AWS access, but do not perform permanent purge until retention requirements have been considered.

Need to completely remove Securitain data

1. 1

   Disconnect

   Stop scanning and remove from current posture.

2. 2

   Revoke AWS access

   Delete the CloudFormation stack or IAM role in the customer AWS account.

3. 3

   Verify

   Confirm revocation using the verify workflow.

4. 4

   Permanent purge

   Delete Securitain's stored account-specific data.

Related guides