Sprinto DashboardAPI Reference

Amazon Web Services (AWS) Integration

This guide explains how to integrate your Amazon Web Services (AWS) Organisation Unit (OU) or individual AWS account with Sprinto for compliance monitoring. The integration enables Sprinto to perform automated checks across your infrastructure and supports enforcement of security best practices.

Benefits of Integration

Connecting AWS with Sprinto enables:

  • Monitoring of infrastructure security configurations

  • Detection of policy violations

  • Automated closure of vulnerabilities and incidents

  • Access control tracking across AWS accounts

Before You Begin

Ensure the following prerequisites are met:

  • You are logged in to the Sprinto Admin Portal.

  • You have AdministratorAccess privileges in your AWS root or target account.

  • You have permissions to create IAM roles or CloudFormation stacks.

Scripts, Account IDs, and External IDs shown in this guide are dynamic. You must copy these directly from the Sprinto Integration panel.

Available Compliance Checks

Sprinto supports over 70 automated AWS checks. Below are some commonly used ones:

Compliance Check
Resolution Guide

AWS access should be removed for offboarded users

Offboarding Guide

MFA should be enabled for AWS users

MFA Setup

AWS RDS freespace should be monitored

RDS Freespace

AWS RDS CPU utilisation should be monitored

RDS CPU

AWS access keys should not be older than 90 days

Key Rotation

View Full List

You can integrate AWS with Sprinto using either of the following methods:

  • Integrate an AWS Organisation Unit (OU): This option allows you to connect an AWS OU along with its nested OUs and accounts. During configuration, you can select the specific accounts to monitor for compliance.

  • Integrate individual AWS accounts: This option lets you connect standalone AWS accounts for compliance tracking.

If you’ve already integrated individual accounts from an AWS OU and wish to switch to OU-level integration, you must first disable the existing account-level integrations.

Integrate AWS OU

Option 1: CloudFormation Template (Recommended)

  1. In the Sprinto Admin Portal, go to Settings > Integrations.

  2. Under Available Integrations, click Connect next to AWS.

  3. Select AWS Organization.

  4. Follow on-screen instructions and click Next.

  5. Log in to the management (root) account of your AWS Organisation, select the Use CloudFormation Template check box and click Continue.

  6. Open AWS CloudShell and copy the CloudFormation script from Sprinto.

  7. Execute the script in CloudShell. This will:

    • Create an IAM role called sprinto-auditor-role

    • Assign permissions required for auditing

  1. To get the Role ARN from the root account, run the CloudFormation describe command provided in the integration panel.

If you encounter a CREATE_IN_PROGRESS status, wait a few minutes and re-run the command.

  1. Run the script for each child account you want to monitor. You do not need the ARN—only the script needs to be executed.

  2. Enter the following in the Sprinto portal:

    • Role ARN: Copied from AWS root account output

    • Region: Your AWS deployment region

    • Root Account ID: The alphanumeric Root Account ID from IAM Identity Center (not the numeric account ID)

11. Click Connect.

Root Account ID: The alphanumeric Root Account ID from IAM Identity Center (not the numeric account ID).

Option 2: IAM Role

  1. In the Sprinto Admin Portal, go to Settings > Integrations.

  2. Under Available Integrations, click Connect next to AWS.

  3. Select AWS Organization.

  4. Follow on-screen instructions and click Next.

  5. Log in to the management (root) account of your AWS Organisation, select the Create IAM role manually check box and click Continue.

  6. Go to IAM > Roles > Create Role.

  7. Choose Another AWS account.

  8. Copy the Account ID and External ID from Sprinto Integration panel and paste them.

  9. Uncheck Require MFA and click Next.

  10. Add the following permission policies:

  11. SecurityAudit

  12. (Optional) AWSSSODirectoryReadOnly, AWSSSOReadOnly – for SSO users

  13. (Optional) CloudWatchFullAccess – to allow CloudWatch alarms from Sprinto

  14. Name the role sprinto-auditor-role.

  15. Create the role and copy the Role ARN.

  16. Repeat steps 6 to 15 for each child account you want to connect. Do not copy the ARN.

  17. Return to Sprinto and input:

    • Role ARN: Copied from AWS root account output

    • Region: Your AWS deployment region

    • Root Account ID: The alphanumeric Root Account ID from IAM Identity Center (not the numeric account ID)

  18. Click Connect.

Root Account ID: The alphanumeric Root Account ID from IAM Identity Center (not the numeric account ID).

Integrate Individual AWS Account

  1. In the Sprinto Admin Portal, select Integrate Individual AWS Account.

  2. Choose applicable compliance use cases.

  3. Follow either of these integration methods:

    • CloudFormation Template: Follow steps from Option 1.

    • IAM Role: Follow steps from Option 2.

Note:

1. You do not need the AWS Root Account ID for individual account integration.

2. You can connect as many individual accounts as needed.

Support

If you encounter any issues or need assistance with your integration, contact the Sprinto support team at [email protected].

PreviousFreshteam IntegrationNextAdobe Sign Integration

Last updated