Integrations

Connecting AWS

AWS is a deep integration. Connect once and Radius360 begins pulling configuration, identity, and event data that feeds your risk register, evidence vault, and framework assessments.

What you get

Once AWS is connected, Radius360 receives:

IAM inventory. Users, roles, policies, MFA status, access keys (with last-used age).
S3 configuration. Public access, encryption at rest, versioning, logging, lifecycle rules.
EC2 and networking. Security group rules, public IPs, unencrypted EBS volumes.
RDS. Encryption, public accessibility, automated backups, deletion protection.
CloudTrail. Management event logs for audit evidence.
Security Hub findings. If enabled, findings become risks automatically.
GuardDuty alerts. High-severity findings create incident records.

Framework controls that light up:

SOC 2 CC6.1, CC6.6, CC7.1 (System Operations), CC7.2 (System Monitoring)
ISO 27001:2022 A.5 (Organizational), A.8 (Technological) — covering access, cryptography, logging, and network security
NIST CSF 2.0 PR.AA (Access Control), PR.DS (Data Security), PR.IR (Infrastructure Resilience), DE.CM (Continuous Monitoring)
HIPAA 164.308(a)(1), 164.312(a)(1), 164.312(e)(1) (for PHI-handling workloads)

Prerequisites

AWS account with IAM admin or the ability to create a read-only role
CloudFormation permissions (we provide a one-click CloudFormation template)
About 10 minutes for single-account; 20 to 30 for multi-account Organizations setups

Read-only IAM role, no credentials stored

Radius360 uses an IAM role with a trust policy scoped to our AWS account. No access keys or secrets ever leave your environment. You can revoke us by deleting the role.

Connecting AWS

1
Open Integrations, find AWS, click Connect.
2
Choose Single Account or Organizations. For most users starting out, Single Account is the right choice.
3
Click Launch Stack. You are redirected to AWS CloudFormation with our template pre-loaded. It creates an IAM role named Radius360-ReadOnly-Role with a trust policy that only our AWS account can assume.
4
Review the template, acknowledge IAM resource creation, and click Create Stack. The stack completes in about 2 minutes.
5
Copy the role ARN from the stack outputs. Paste it back into Radius360 and click Verify. Radius360 tests the assume-role connection and, if successful, starts the first sync.

The first sync takes 5 to 15 minutes depending on the size of your AWS footprint (number of S3 buckets, EC2 instances, IAM entities). Subsequent syncs are incremental and take 1 to 2 minutes.

Multi-account setups

For AWS Organizations with multiple accounts, you have two options:

Org-wide deployment. Deploy the CloudFormation template as a Stack Set across your Organization. Radius360 sees all accounts as one deep integration, with per-account scoping in the risk context.
Per-client account mapping. If you are a vCISO or MSSP with each client having their own AWS account, deploy the CloudFormation template in each account and map them to their respective Radius360 clients.

Troubleshooting

AssumeRole fails. The role's trust policy was modified, or the external ID is wrong. Redeploy the CloudFormation template.

No risks generated after first sync. Enable Security Hub and GuardDuty in the region(s) you care about. Radius360 reads from these services; if they are off, we have nothing to read.

Missing data from a specific region. The IAM role is scoped to account-level services by default. Check the Regions configuration in Settings, Integrations, AWS to enable additional regions.

For complex setups (multi-region GovCloud, per-OU scoping, etc.), email support@radius360.co or ask the GRC Assistant.

PreviousConnecting Okta Next Connecting Microsoft 365