Polara Labs Logopolara labsBack to Home
Read-only integration

Connect AWS to Polara

Read-only IAM role assumption. Eleven evidence types collected automatically. Closes six SOC 2 gaps in your Slim Package without a single screenshot of your console.

Go to dashboard to connect

What we collect

Eleven evidence types map to the AICPA Common Criteria controls in your SOC 2 report. Same set every sync, no extras.

EvidenceWhat it showsSOC 2 controls
IAM usersWho has access, MFA status, and last login.CC6.1, CC6.2, CC6.3
IAM password policyAccount-wide password requirements (or absence thereof).CC6.1, CC6.2
IAM rolesPrivileged roles and the trust policies that grant them.CC6.1, CC6.3
IAM groupsGroups and their member assignments.CC6.3
IAM account summaryAccount-wide stats, including user count and whether root MFA is enabled.CC6.1, CC6.6
CloudTrail trailsAudit log configuration per region.CC7.2, CC7.3
S3 bucket encryptionServer-side encryption settings on each S3 bucket (at-rest).CC6.7, CC6.8
RDS instance encryptionStorage encryption status for each RDS database (at-rest).CC6.7, CC6.8
KMS keysCustomer-managed encryption keys per region.CC6.7
CloudWatch alarmsSecurity-relevant monitoring alarms per region.CC7.2
AWS Config recordersConfiguration drift detection per region.CC7.2

Permissions we request

SecurityAudit + ViewOnlyAccess

Both are AWS-managed policies, read-only. No write, modify, or delete on anything in your account. No access to bucket contents, database data, or customer PII.

No stored credentials

Polara does not store your AWS keys. We assume your IAM role on each sync using short-lived STS tokens (~1 hour) gated by your unique ExternalId.

How to connect

Four steps, about two minutes start to finish.

  1. 1

    Open the AWS card in your Polara dashboard

    Sign in to Polara, go to the Integrations tab, find the AWS card, and click Connect.

    Polara dashboard Integrations tab with the AWS card and Connect button highlighted
    Step 1
  2. 2

    Launch in AWS Console

    Polara opens AWS CloudFormation with a pre-filled stack. Sign in to your AWS account if prompted.

    AWS CloudFormation quick-create stack page with PolaraEvidenceCollector pre-filled
    Step 2
  3. 3

    Create stack and copy the RoleArn

    Click "Create stack". After it reaches CREATE_COMPLETE (about 60 seconds), open the Outputs tab and copy the RoleArn value.

    AWS CloudFormation stack Outputs tab with the RoleArn value highlighted
    Step 3
  4. 4

    Paste the RoleArn back into Polara

    Paste the RoleArn into the Polara connect form and click Connect. Polara validates the role with STS, then starts collecting evidence.

    Polara connect form with RoleArn pasted and the Connect button highlighted
    Step 4

Manual setup

For Terraform, CDK, or restricted IAM environments▾

If your AWS account requires that all infrastructure goes through Terraform or CDK, apply the CloudFormation template directly. The two parameters Polara needs:

  • ExternalId: your Polara assessment UUID, shown in the Polara dashboard connect form.
  • PolaraAccountId: also shown in the Polara dashboard connect form.

Download the template: cloudformation.yml

Terraform example:

resource "aws_cloudformation_stack" "polara_evidence_collector" {
  name         = "PolaraEvidenceCollector"
  template_url = "https://polaralabs.com/integrations/aws/cloudformation.yml"

  parameters = {
    ExternalId      = "<paste-from-polara-dashboard>"
    PolaraAccountId = "<paste-from-polara-dashboard>"
  }

  capabilities = ["CAPABILITY_NAMED_IAM"]
}

After the stack reaches CREATE_COMPLETE, copy the RoleArn output and paste it into the Polara dashboard connect form.

Troubleshooting

Common errors and fixes▾
External ID mismatch
The ExternalId in your CloudFormation stack does not match your Polara assessment UUID. Delete the stack, click Launch in AWS Console again from Polara to get a fresh pre-filled link, and re-create the stack with the correct value.
Role not assumable (AccessDenied)
Confirm the CloudFormation stack reached CREATE_COMPLETE. If you applied the template by hand, make sure the IAM trust policy includes the Polara account ID shown in the Polara dashboard connect form. Editing the template manually is the most common cause. Re-launch from Polara to fix it.
Missing region / no evidence collected
IAM is global, so the AWS Console region does not matter for the role-creation step. Any region works (we recommend us-east-1 or us-west-2). Polara enumerates enabled regions via ec2:DescribeRegions on each sync. If a region was enabled after your last sync, click Sync now to re-discover.

Ready to connect?

Two minutes from here. Polara does the rest.

Go to your dashboard
polara labs

Polara Labs builds both sides of the audit: the readiness platform startups use to earn a SOC 2 report or an ISO 27001 certificate, and the practice OS audit firms use to run the examination. Every price is published on the page it belongs to.

© 2026 Polara Labs Inc. All rights reserved.Contact: founder@polaralabs.com

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms in our network; the audit opinion is theirs alone and is not regulated by Polara Labs. We generate custom policies, evidence checklists, and remediation guidance. You remain responsible for implementing controls and owning audit outcomes. Replace placeholders with your actual controls and have final documents reviewed by qualified professionals before your audit.