AWS cloud discovery: IAM policy

The AWS quick pass in Discovery needs read-only permissions. Every permission is a List*, Get*, Describe* or Lookup* call (plus iam:SimulatePrincipalPolicy, which only evaluates a policy). Nothing in it can change the account.

AI services: Bedrock agents, knowledge bases, data sources, custom models, guardrails and invocation logging; Bedrock AgentCore runtimes; SageMaker endpoints and notebooks.

Workloads: Lambda functions, ECS services and task definitions, EC2 instances, volumes and networking.

What they can reach: S3 bucket names, DynamoDB tables, RDS instances and Secrets Manager secret names (never values), plus IAM role analysis of each workload's permissions.

CloudTrail: LookupEvents, to show recent AI service use.

In Discovery, choose AWS and copy the one-line command. Open CloudShell in the account you want to scan and paste it. It creates the read-only role IntertraceDiscoveryReadOnly, trusted only by Intertrace with your organization's external ID, and prints the role ARN to paste back. No key is stored. Reading Lambda code and disk scanning (SideScan) are separate opt-ins and are off by default.

Create an IAM user (for example intertrace-discovery) with no console access, attach the inline policy below, create an access key, and paste it into Discovery under Access key.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IntertraceDiscoveryReadOnly",
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ec2:DescribeRegions",
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "s3:ListAllMyBuckets",
        "lambda:ListFunctions",
        "lambda:ListTags",
        "ecs:ListClusters",
        "ecs:ListServices",
        "ecs:DescribeServices",
        "ecs:DescribeTaskDefinition",
        "ecs:ListTagsForResource",
        "sagemaker:ListEndpoints",
        "sagemaker:ListNotebookInstances",
        "sagemaker:DescribeNotebookInstance",
        "bedrock:ListAgents",
        "bedrock:GetAgent",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListDataSources",
        "bedrock:GetDataSource",
        "bedrock:ListCustomModels",
        "bedrock:ListGuardrails",
        "bedrock:GetModelInvocationLoggingConfiguration",
        "bedrock-agentcore:ListAgentRuntimes",
        "dynamodb:ListTables",
        "rds:DescribeDBInstances",
        "secretsmanager:ListSecrets",
        "iam:GetRole",
        "iam:GetInstanceProfile",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:SimulatePrincipalPolicy",
        "cloudtrail:LookupEvents"
      ],
      "Resource": "*"
    }
  ]
}

Delete the CloudFormation stack or role (Option A) or the access key (Option B). Discovery stops at the next scan. What it already found stays in Intertrace until you delete it.