Amazon IAM

Amazon IAM (Identity and Access Management) by Amazon Web Services (AWS) manages the identity primitives that grant permissions inside an AWS account — instance profiles, roles, inline and customer-managed policies, and policy documents. You can bring identity and access management data from Amazon IAM into Brinqa to gain a unified view of your attack surface, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Amazon IAM and how to obtain that information from Amazon. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Amazon IAM from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Amazon IAM with Brinqa:

• Access key ID and Secret access key: The access keys associated with the AWS account. The account must have the required read-only permissions for the IAM service. For additional information, see Create an IAM user for AWS access.

• Default region: The AWS region for the connector. If not specified, the connector uses the AWS Default Region Provider Chain to automatically determine the most appropriate region. For additional information on the AWS Default Region Provider Chain, refer to the AWS documentation.

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

Create an IAM user for AWS access

For the Amazon IAM connector to interact with the AWS SDK and retrieve identity data, you must provide specific AWS credentials and permissions. To create an IAM user, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option and then click Create policy.

6. Click the JSON tab and paste the following minimum required policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "iam:ListInstanceProfiles",
           "iam:ListRoles",
           "iam:ListRolePolicies",
           "iam:GetRolePolicy",
           "iam:ListAttachedRolePolicies",
           "iam:ListPolicies",
           "iam:GetPolicyVersion"
         ],
         "Resource": "*"
       }
     ]
   }

7. Click Next, provide a name for the policy, and then click Create policy.

8. Back on the Add permissions page, search for and select the policy you just created, and then click Next.

9. Click Create user.

note

If you do not have permissions to create a new IAM user, contact your AWS administrator. For additional information, see AWS documentation.

Additional settings

The Amazon IAM connector contains additional options for specific configuration:

• Assume role ARN: ARN of an IAM role to assume. Comma-separated to assume multiple roles in the same sync.
• Session duration: Assume-role session duration in seconds. The default setting is 3600.
• Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.
• Parallel requests: The maximum number of parallel API requests. The default setting is 8.
• Maximum retries: The maximum number of times that the integration attempts to connect to the Amazon IAM API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve

The Amazon IAM connector can retrieve the following types of data from the Amazon IAM API:

Table 1: Data retrieved from Amazon IAM

Connector Object	Required	Maps to Data Model
InstanceProfile	Yes	Cloud Resource
Policy	Yes	Cloud Resource
PolicyVersion	Yes	Cloud Resource
Role	Yes	Cloud Resource
RoleInlinePolicy	Yes	Cloud Resource

info

For detailed steps on how to view the data retrieved from Amazon IAM in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

InstanceProfile

Table 2: InstanceProfile attribute mappings

Source Field Name	SDM Attribute
InstanceProfile.arn	ARN
InstanceProfile.arn	UID
InstanceProfile.createDate	FIRST_SEEN
InstanceProfile.instanceProfileId	INSTANCE_PROFILE_ID
InstanceProfile.instanceProfileName	INSTANCE_PROFILE_NAME
InstanceProfile.instanceProfileName (falls back to ARN)	NAME
InstanceProfile.path	PATH
InstanceProfile.roles[].arn	ROLE_ARNS
InstanceProfile.tags	TAGS
Generated (constant AWS)	CLOUD_PROVIDER
Generated (sync timestamp)	LAST_CAPTURED

Policy

Table 3: Policy attribute mappings

Source Field Name	SDM Attribute
Policy.arn	ARN
Policy.arn	UID
Policy.attachmentCount	ATTACHMENT_COUNT
Policy.createDate	FIRST_SEEN
Policy.defaultVersionId	DEFAULT_VERSION_ID
Policy.description	DESCRIPTION
Policy.isAttachable	IS_ATTACHABLE
Policy.path	PATH
Policy.permissionsBoundaryUsageCount	PERMISSIONS_BOUNDARY_USAGE_COUNT
Policy.policyId	POLICY_ID
Policy.policyName	POLICY_NAME
Policy.policyName (falls back to ARN)	NAME
Policy.tags	TAGS
Policy.updateDate	SOURCE_LAST_MODIFIED
Generated (constant AWS)	CLOUD_PROVIDER
Generated (sync timestamp)	LAST_CAPTURED

PolicyVersion

Table 4: PolicyVersion attribute mappings

Source Field Name	SDM Attribute
Policy.arn	POLICY_ARN
PolicyVersion.createDate	FIRST_SEEN
PolicyVersion.document (URL-decoded)	POLICY_DOCUMENT
PolicyVersion.isDefaultVersion	IS_DEFAULT_VERSION
PolicyVersion.versionId	VERSION_ID
Generated ({policyArn}|{versionId})	NAME
Generated ({policyArn}|{versionId})	UID
Generated (constant AWS)	CLOUD_PROVIDER
Generated (sync timestamp)	LAST_CAPTURED

Role

Table 5: Role attribute mappings

Source Field Name	SDM Attribute
ListAttachedRolePolicies	ATTACHED_POLICY_ARNS
ListRolePolicies	INLINE_POLICY_NAMES
Role.arn	ARN
Role.arn	UID
Role.assumeRolePolicyDocument (URL-decoded)	ASSUME_ROLE_POLICY_DOCUMENT
Role.createDate	FIRST_SEEN
Role.description	DESCRIPTION
Role.maxSessionDuration	MAX_SESSION_DURATION
Role.path	PATH
Role.permissionsBoundary.permissionsBoundaryArn	PERMISSIONS_BOUNDARY_ARN
Role.roleId	ROLE_ID
Role.roleName	ROLE_NAME
Role.roleName (falls back to ARN)	NAME
Role.tags	TAGS
Generated (constant AWS)	CLOUD_PROVIDER
Generated (sync timestamp)	LAST_CAPTURED

RoleInlinePolicy

Table 6: RoleInlinePolicy attribute mappings

Source Field Name	SDM Attribute
GetRolePolicy.policyDocument (URL-decoded)	POLICY_DOCUMENT
ListRolePolicies.policyNames[]	POLICY_NAME
Role.arn	ROLE_ARN
Role.roleName	ROLE_NAME
Generated ({roleArn}|{policyName})	UID
Generated ({roleName}/{policyName})	NAME
Generated (constant AWS)	CLOUD_PROVIDER
Generated (sync timestamp)	LAST_CAPTURED

Operation options

info

The Amazon IAM connector does not currently support operation options for the types of data it retrieves.

For detailed steps on how to view the data retrieved from Amazon IAM in the Brinqa Platform, see How to view your data.

APIs

The Amazon IAM connector uses the AWS IAM API. Specifically, it uses the following endpoints:

Table 7: Amazon IAM API endpoints

Connector Object	API Endpoint
InstanceProfile	iam:ListInstanceProfiles
Policy	iam:ListPolicies (scope = Local)
PolicyVersion	iam:ListPolicies (scope = Local), iam:GetPolicyVersion
Role	iam:ListRoles, iam:ListAttachedRolePolicies, iam:ListRolePolicies
RoleInlinePolicy	iam:ListRoles, iam:ListRolePolicies, iam:GetRolePolicy

Changelog

The Amazon IAM connector has undergone the following changes:

note

This connector is part of a bundled release with other connectors from the same vendor. If a version shows "No change", it means that the connector version was updated for consistency as part of the bundle, but no functional changes were made to this specific connector. You can update to or skip this version without affecting your existing configuration.

Table 8: Amazon IAM connector changelog

Version	Description	Date Published
3.1.0	Initial Integration+ release.	June 1st, 2026

note

This changelog will be updated as new versions are released. For the latest connector updates, see Integration+ connector releases.