Change how an account connects

Draft, pending the appliance build. Changing the way to connect is built and tested in the product. The steps may change before release.

An AWS account added to SecurITPosture keeps its run history and its evidence when you change how it connects. Use this when, for example, you move the appliance into your AWS account and can drop an access key for the instance role, or when your organization moves to its own certificate authority.

Steps

1. Set up the new way in AWS first, as its own page describes: the instance role, IAM Roles Anywhere, or an access key.
2. In SecurITPosture, open Integrations, then AWS, and choose Change how to connect on the account's card. Only a system administrator or a compliance analyst can change it.
3. Choose the new way and enter what it needs, as when you add an account.
4. Save. The product checks the new way first: it connects, checks that the account answering is the same account, and checks every region.

What happens

• If the new way validates, the account switches to it, and the old way's stored credentials are removed: an access key, a certificate and its key, or an external ID. Remove an old access key in IAM yourself afterwards; the product never changes your account.
• If it does not, nothing changes. The account keeps connecting the old way, and the message names the step to fix in the new way, never a credential.
• If someone removes the account or changes it again while the new way is being checked, the change is not applied.

Every change is recorded in the audit log with the old and the new way, never with a secret.

Accounts added before the three ways existed

An account added before October 2026 used a trust that is no longer offered. Its card says "Reconnect this account with one of the three ways to connect", and it runs nothing until it is reconnected. Choose Reconnect on its card and follow the steps above; its history and evidence stay.

See also Instance role, IAM Roles Anywhere, and Access key.