connect-aws

Name: connect-aws
Availability: InStock
Author: SubImage

Deploy the SubImageScanRole IAM role to connect AWS accounts to SubImage.

Updated Apr 30, 2026

Search Tags:#onboarding #aws #cloudformation #terraform #iam #subimage #stacksets

Ready to run

npx skills add https://github.com/subimagesec/skills --skill connect-aws-subimagesec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: connect-aws
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-setup/skills/connect-aws
Command: npx skills add https://github.com/subimagesec/skills --skill connect-aws-subimagesec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you onboard AWS accounts into SubImage by creating the read-only IAM role SubImage uses to inventory cloud resources safely and repeatably.

Core Features & Use Cases

Organization-wide onboarding: Deploy the role across an AWS Organization with CloudFormation StackSets.
IaC-friendly setup: Generate Terraform for teams that manage IAM through infrastructure as code.
One-off account registration: Create the role manually with aws-cli when you need a fast, single-account setup.
Example use case: A platform engineer can wire a new business unit's AWS accounts into SubImage, then register those accounts in the AWS module and trigger an immediate sync.

Quick Start

Ask the assistant to generate the correct SubImage AWS onboarding path for your tenant and target accounts, using the role trust policy and permissions shown in this Skill.

Frequently Asked Questions about connect-aws

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I onboard AWS accounts to SubImage using CloudFormation StackSets?▼

Onboard AWS accounts to SubImage by deploying the SubImageScanRole IAM role across an AWS Organization using CloudFormation StackSets. You need your SubImage tenant account ID, tenant slug, and target AWS account IDs to establish the read-only trust required for inventory collection.

Can I use Terraform to create the IAM role for SubImage inventory collection?▼

Yes, you can generate Terraform modules to create the SubImageScanRole IAM role for SubImage inventory collection. This IaC-friendly setup allows teams managing IAM through infrastructure as code to establish the read-only permissions needed to connect AWS accounts repeatably.

What is the best way to connect a single AWS account to SubImage for a one-off setup?▼

For a one-off AWS account setup, use aws-cli to manually create the SubImageScanRole IAM role. This fast registration path requires the SubImage tenant account ID, tenant slug, target AWS account ID, and read-only trust policy permissions for resource inventory collection.

What IAM permissions does SubImage need to inventory cloud resources in my AWS accounts?▼

SubImage requires read-only IAM permissions to inventory cloud resources in your AWS accounts. The SubImageScanRole establishes a trust policy with your SubImage tenant account ID, enabling safe and repeatably scoped access for resource collection across connected AWS accounts.

Do I need AWS Organizations to onboard multiple accounts to SubImage?▼

No, AWS Organizations is not required but is supported via CloudFormation StackSets for organization-wide onboarding. You can alternatively use Terraform modules for IaC repositories or aws-cli for one-off accounts, providing flexible paths to connect AWS accounts to SubImage.

What information is required to deploy the SubImage IAM role across target AWS accounts?▼

Deploying the SubImage IAM role requires the correct SubImage tenant account ID, tenant slug, and target AWS account IDs. These inputs configure the read-only trust policy and permissions needed for SubImage to safely inventory cloud resources across your connected accounts.