Connect an AWS Account

CloudBurn Cloud scans your AWS account through a read-only IAM role you deploy in your own account, and writes scan results to a results bucket you own. CloudBurn never holds long-lived credentials for your account, and the durable copy of your findings lives only in your S3 bucket — CloudBurn reads from it to render your dashboard rather than keeping its own store of your scan data.

What you deploy

The connection consists of three pieces, all created in your account from a template the dashboard generates for you:

• A read-only IAM role that CloudBurn assumes to run discovery
• An S3 results bucket, owned by you, where scan output is stored
• Optionally, an AWS Resource Explorer index and default view in the chosen region — discovery uses Resource Explorer to enumerate resources

Setup steps

From AWS accounts in your dashboard, choose Connect AWS account:

1. Pick the AWS Region to connect.
2. Choose your template flavor — the dialog offers both CloudFormation and Terraform tabs with the same resources.
3. Decide whether to include Resource Explorer setup. If the region already has a Resource Explorer index and default view, toggle Set up AWS Resource Explorer off and reuse what you have.
4. Deploy: either Deploy directly through AWS Console (opens the AWS Console quick-create flow with the template preloaded) or copy the template into your own IaC pipeline.
5. Back in the dashboard, choose Verify connection.

Verification is granular, so a partial deployment is easy to diagnose: Verify role access, Verify storage, and Verify Resource Explorer each check one piece, and Verify all runs the full set.

Removing a connection

Deleting a connection in the dashboard removes CloudBurn's record of it — it does not delete the IAM role, CloudFormation stack, Terraform resources, or S3 bucket from your AWS account. Remove those through the same mechanism you deployed them with (delete the stack, terraform destroy, or manual cleanup) once you no longer need them.

What's next