Prerequisites
Before you begin, make sure the following requirements are met:
AWS Account Access
You must have permission to create IAM roles in the AWS account you want to connect. Typically, this requires admin privileges or IAM permissions like:
iam:CreateRoleiam:AttachRolePolicyiam:GetRole
Step 1: Enter AWS Account Information
In ComplyJet, you will be asked to provide the AWS account number you wish to connect.
Why this is needed: ComplyJet uses this identifier to create a trust relationship when you later create an IAM role.
Where to find it: Log in to your AWS Console > Click your account name > View "My Account" > Copy the 12-digit Account ID.
Paste this into the AWS Account Number field in ComplyJet.
Step 2: Create the IAM Role in AWS
You will now create a read-only role that allows ComplyJet to securely monitor your AWS account.
2.1: Define the Trust Relationship
Go to the IAM Console in AWS.
Click Create Role.
Under Trusted entity type, select AWS Account.
Choose Another AWS Account and enter:
yaml CopyEdit ComplyJet Account ID: 123456789012
Check the box for Require external ID, and enter the external ID provided in the ComplyJet setup screen.
Why this is needed: The external ID adds a security layer by ensuring only ComplyJet can assume the role.
Ensure that Require MFA is not selected.
Click Next: Permissions.
2.2: Assign the Required Permissions
On the Permissions screen, search for the managed policy named:
nginx CopyEdit SecurityAudit
Select the checkbox next to the
SecurityAuditpolicy.Why this is needed: This policy provides read-only access to a broad set of AWS services and resources needed for compliance monitoring.
Click Next: Tags (you can skip this section unless your org requires tags).
Click Next: Review.
2.3: Name and Create the Role
Name the role exactly as shown below:
CopyEdit complyjet-auditor
Description (optional):
Read-only cross-account access for ComplyJet compliance automation.Click Create Role.
Step 3: Link the Role in ComplyJet
After creating the role, navigate to it in the IAM > Roles section.
Copy the full Role ARN (Amazon Resource Name), which looks like:
ruby CopyEdit arn:aws:iam::123456789012:role/complyjet-auditor
Paste the Role ARN into the corresponding field in ComplyJet.
Why this is needed: The ARN uniquely identifies the role and allows ComplyJet to assume it for read-only access.
Step 4: Select AWS Regions to Monitor
ComplyJet allows you to specify which AWS regions to monitor for compliance.
If your account has no region restrictions:
Select All regions to allow full visibility across your infrastructure.
Click Next once you’ve selected the appropriate regions.
Completion
Once the role is linked and regions selected, ComplyJet will begin its first sync. Within a few minutes, you should start seeing AWS assets and compliance signals populated in your dashboard.
If you need help at any step, please reach out to our support team via the in-app chat. We're here to help.