Connect a cloud account (CSPM)

786 Cyber can scan your cloud accounts for misconfiguration — public buckets, disabled logging, missing MFA, over‑permissive access — and score the findings alongside the rest of your estate. This page walks you through connecting an AWS account. Azure and Google Cloud follow the same shape: a one‑time, read‑only grant.

Three things to know before you start, because being asked to create a role in your own cloud reasonably makes people cautious:

1. Read‑only. 786 Cyber can look; it can never change, delete, or read the contents of anything.
2. One‑time, per account. You do this once per AWS account — not per scan. Every future scan just runs.
3. Revocable in one click. Delete the stack you create and the access is gone instantly.

Ready to connect now? Open the cloud account in your Asset Directory and find its Cloud Security (CSPM) panel — then follow the steps below.

Before you start

• The cloud account must already exist as a cloud asset in your Asset Directory.
• Cloud scanning is plan‑metered — your plan includes a set number of cloud accounts. If you’ve reached the limit, Enable cloud scan will say so clearly. See Team & settings for your plan.

Connecting AWS

In 786 Cyber

1. Go to Assets, open the cloud asset, and find the Cloud Security (CSPM) panel. Choose AWS and click Save. This generates a unique ExternalId for your organisation — a shared secret that ensures only your account can be reached by the scanner.

2. Click Launch Stack ↗. This opens AWS CloudFormation in a new tab with the template and your ExternalId already filled in — nothing to download or upload.

   Prefer to do it by hand, or need a specific region? Use Get CloudFormation ↓ instead: it downloads the same template (786cyber-cspm-role.yaml), and you upload it to CloudFormation → Create stack → Upload a template file. The rest of the steps are identical.

In your AWS console

3. The Quick create stack page opens in the London (eu-west-2) region with everything pre-filled. (The role is global, so the region doesn’t affect what it can see — it’s just where the small stack lives.)

4. Scroll to the bottom and tick “I acknowledge that AWS CloudFormation might create IAM resources with custom names”, then click Create stack.

   This checkbox is required and is the single most common place people get stuck. The role has a fixed name, so AWS asks you to acknowledge it. If you can’t create the stack, this is almost always why.

   Wait a minute or two for the stack to reach CREATE_COMPLETE.

Back in 786 Cyber

5. Open the stack’s Outputs tab, copy the RoleArn value (it looks like arn:aws:iam::<your-account-id>:role/786cyber-readonly), and paste it into the CSPM panel.
6. Click Enable cloud scan, then Run cloud scan. The scan takes roughly 5–8 minutes — it runs 600+ checks across every AWS region. Progress shows in the panel and on the dashboard Scans card, and the Run button locks while it’s running so you can’t start duplicates.

What the role actually grants

Being specific here is the point — you’re granting access to your own cloud, and you should know exactly what:

• Two AWS‑managed, read‑only policies: SecurityAudit and ViewOnlyAccess.
• The trust is restricted to 786 Cyber’s scanner identity and requires your unique ExternalId — both must match or the connection is refused.
• No write, no delete, no data access. 786 Cyber reads configuration metadata — is MFA on, is logging enabled, is this bucket public — never the contents of your buckets, databases or workloads.
• To revoke: delete the CloudFormation stack. Access ends immediately.

Saving the role is not the same as testing it. When you paste the ARN, 786 Cyber checks that it’s well‑formed — but it can only confirm the role actually works by running a scan. If a detail is wrong, you’ll find out on the first scan rather than at the point of saving.

Results

• Findings land in the Cloud Posture lane on your Posture dashboard, each scored for severity and prioritised alongside everything else. Before you connect a provider, that lane is tagged Not configured rather than showing a blank or zeroed score.
• Download report ↓ produces a branded PDF you can share with an auditor or the board.
• A scan that fails is reported as failed, with the reason — an unscanned account is never presented as a clean one.

Common questions

• Do I have to do this for every scan? No — once per AWS account. Every later scan reuses the role.
• I have several AWS accounts. One role per account; each is its own connection. A bulk option is on the roadmap.
• Which region should I create the stack in? It doesn’t matter — IAM roles are global, and 786 Cyber scans all regions regardless.
• Can 786 Cyber change anything in my account? No — the role is read‑only by construction.
• Is this continuous monitoring? No — scans run on demand, when you or your team start them.
• Azure or Google Cloud? Each uses an equivalent one‑time, read‑only grant; the panel guides you through it.

---

Related: Assets · Vulnerability management