# Amazon Web Services (AWS) Integration

Sprinto’s AWS integration enables continuous monitoring of your cloud infrastructure to help you meet security and compliance requirements with minimal manual effort.

By connecting your AWS environment, Sprinto automatically evaluates configurations, access controls, and resource health across your accounts. Sprinto uses **read-only access** to collect evidence, monitor compliance status, and alert you when action is required—without making any changes to your AWS resources.

You can integrate AWS in two ways:

* At the **organisation level**, to monitor all accounts under AWS Organizations
* At the **individual account level**, to monitor specific AWS accounts independently

***

### Prerequisites

Ensure the following prerequisites are met before setting up the AWS integration:

* You are logged in to the **Sprinto Admin portal**.
* You have **AdministratorAccess** privileges in the AWS root account, organisation management account, or the individual AWS account you want to connect.
* You have permissions to create **IAM roles** or deploy **CloudFormation stacks** in AWS.

{% hint style="info" %}

#### Note

Scripts, AWS account IDs, and external IDs shown during setup are **dynamically generated**. Always copy these values directly from the **Sprinto integration panel** to avoid configuration errors.
{% endhint %}

***

### **Available Compliance Checks** <a href="#available-compliance-checks" id="available-compliance-checks"></a>

Sprinto supports over 70 automated AWS checks. Below are some commonly used ones:

<table><thead><tr><th width="478.22265625">Compliance Check</th><th>Resolution Guide</th></tr></thead><tbody><tr><td>AWS access should be removed for offboarded users</td><td><a href="../../monitors/authentication-and-access-monitors/resolve-sprinto-check-for-removing-access-for-offboarded-users">Offboarding Guide</a></td></tr><tr><td>MFA should be enabled for AWS users</td><td><a href="../../monitors/authentication-and-access-monitors/enabling-mfa-for-aws-iam-user">MFA Setup</a></td></tr><tr><td>AWS RDS freespace should be monitored</td><td><a href="aws-security-hub-integration">RDS Freespace</a></td></tr><tr><td>AWS RDS CPU utilisation should be monitored</td><td><a href="https://sprinto.freshdesk.com/en/support/solutions/articles/72000572327">RDS CPU</a></td></tr><tr><td>AWS access keys should not be older than 90 days</td><td><a href="https://sprinto.freshdesk.com/en/support/solutions/articles/72000629427">Key Rotation</a></td></tr></tbody></table>

[View Full List](https://docs.sprinto.com/monitors/cloud-and-infrastructure-monitoring/aws)

{% hint style="info" %}

#### Note

Understand the complete list of permissions needed for AWS databases [here](https://docs.sprinto.com/integrations/permissions-and-resource-usage-in-sprinto-integrations#amazon-web-services-aws).
{% endhint %}

You can integrate AWS with Sprinto using either of the following methods:

* **Integrate an AWS Organisation Unit (OU):** This option allows you to connect an AWS OU along with its nested OUs and accounts. During configuration, you can select the specific accounts to monitor for compliance.
* **Integrate individual AWS accounts:** This option lets you connect standalone AWS accounts for compliance tracking.

{% hint style="info" %}

#### &#x20;Note

* You can connect multiple AWS accounts to your Sprinto dashboard.
* If you’ve already integrated individual accounts from an AWS OU and wish to switch to OU-level integration, you must first disable the existing account-level integrations.
  {% endhint %}

***

### How it Works

When you connect AWS to Sprinto:

* Sprinto assumes an IAM role in your AWS account to **read configuration and metadata**
* Resources are automatically discovered across selected regions
* Compliance checks are evaluated continuously
* Issues are surfaced in Sprinto with clear remediation guidance

Sprinto does **not** create, modify, or delete any AWS resources.

***

### Integration Methods

You can integrate AWS using either:

* A **CloudFormation template** (recommended)
* A **manually created IAM role**

Each method is available for:

* **AWS organisation-level integration**
* **Individual AWS account integration**

***

### AWS Organisation-level Integration

Use this approach if you manage multiple AWS accounts under **AWS Organizations** and want to monitor them centrally.

#### Before you Begin

Ensure the AWS user, role, or group performing the setup has the **AdministratorAccess** policy attached.

***

#### Method 1: Use CloudFormation template (recommended)

This method automates IAM role creation using a CloudFormation template.

#### **Start the integration in Sprinto**

1. Log in to the Sprinto Dashboard.
2. Go to **Settings → Integrations.**
3. Search for **AWS** and click **Connect.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2Fd5HJcfaM5s69vHB2RXr1%2FScreenshot%202026-02-10%20at%2011.56.53.png?alt=media&#x26;token=94300e43-8491-44ce-ba8d-aea613c8e76e" alt="" width="563"><figcaption></figcaption></figure>

4. Select **AWS organization.**
5. Enter your **Root OU ID.**
6. Choose **Use CloudFormation template**, then click **Continue.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FTiXP0ryJa0PlI02hqnQk%2FScreenshot%202026-02-09%20at%204.01.45%E2%80%AFPM.png?alt=media&#x26;token=a392994d-2d54-4ee0-9592-0d377762008a" alt="" width="375"><figcaption></figcaption></figure>

#### Step 1: Create the access role

This step sets up a read-only IAM role (`sprinto-auditor-role`) across all accounts in your AWS Organisation.

**A. Set up access permissions for the management account**

1. Log in to your **AWS management (root) account**.
2. Open **AWS CloudShell**.
3. From the Sprinto integration panel, **copy the provided bash script**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FUMOuthyopPCYk9LERZxr%2FScreenshot%202026-02-09%20at%204.02.14%E2%80%AFPM.png?alt=media&#x26;token=0151c3a7-77b8-446a-a1c7-37ead24f78f3" alt="" width="375"><figcaption></figcaption></figure>

4. Paste and run the script in CloudShell.

What this does:

* Creates an IAM role named **`sprinto-auditor-role`**.
* Grants permissions to audit AWS resources and read CloudWatch logs.
* Uses a **CloudFormation template** to automate role creation.
* Attaches required policies such as:
  * `SecurityAudit`
  * `CloudWatch (Read Only), PutMetricAlarm (Write) and Lightsail (Read Only)` (if enabled)

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FMf931LYxqcFKjUA9tVqY%2Faws-cloudshell-snapshot.png?alt=media&#x26;token=d85a0fed-d57f-4d04-805c-5ecd716459f7" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}

#### Note

Scripts, Account IDs, and External IDs are dynamic. Always copy them directly from the Sprinto integration panel.
{% endhint %}

***

**B. Create a StackSet**

After permissions are set up:

1. In the **same management account**, copy the **StackSet creation command** from Sprinto.
2. Run the command in **AWS CloudShell**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FkLmnxPznVxrNeBl9WnZB%2FScreenshot%202026-02-09%20at%204.02.23%E2%80%AFPM.png?alt=media&#x26;token=39724e92-c12e-4b9f-bc5f-1b1fa0e2756a" alt="" width="375"><figcaption></figcaption></figure>

What this does:

* Creates a **CloudFormation StackSet**.
* Defines the IAM role and permissions that will be deployed across all child accounts in the organisation.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FSTWAQ36A7NyGHSUXuX9t%2Faws-cloudformation-create-stack-set.png?alt=media&#x26;token=61f8b3d8-1ff2-4b33-8274-3a4b24a003f5" alt="" width="563"><figcaption></figcaption></figure>

***

**C. Deploy the StackSet to all accounts**

Once the StackSet is created:

1. Copy the **StackSet deployment command** from Sprinto.
2. Run it in **AWS CloudShell**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FwxUX00NJZap2sSbdySI5%2FScreenshot%202026-02-09%20at%204.02.33%E2%80%AFPM.png?alt=media&#x26;token=795a7702-2a62-4406-bbf8-e7c011714760" alt="" width="375"><figcaption></figcaption></figure>

What this does:

* Deploys the StackSet to **all accounts under the specified Root OU**.
* Automatically creates the `sprinto-auditor-role` in each child account.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FrCSvZQN82WQV3ryMBdB5%2Faws-cloudformation-deploy-stack-instances.png?alt=media&#x26;token=08b5a521-268f-4678-b30c-96c438d147da" alt="" width="563"><figcaption></figcaption></figure>

***

**D. Get the Role ARN**

After deployment completes:

1. Run the **final command** provided in Sprinto to retrieve the Role ARN from the management account.
2. Copy the **Role ARN** and keep it handy.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FLb7nqrSFIehyJtwHjCBi%2FScreenshot%202026-02-09%20at%204.02.42%E2%80%AFPM.png?alt=media&#x26;token=5b758418-9fe6-4ff0-9a9f-6f51d22590a2" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="info" %}

#### Note

If the output shows `CREATE_IN_PROGRESS`, wait a few seconds and run the command again until the Role ARN is returned.
{% endhint %}

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FS0VxQPDgKUEesP1KZyQm%2FScreenshot%202026-02-09%20at%204.08.21%E2%80%AFPM.png?alt=media&#x26;token=1b1c9419-1459-4eff-a475-daa5bce185d8" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 2: Complete the integration in Sprinto

1. Return to the **Sprinto AWS integration screen**.
2. Paste the **Role ARN** you copied earlier.
3. Select the **AWS regions** where your production workloads run.
4. Click **Connect**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FWLYAWmwPg25ihOfHG7up%2FScreenshot%202026-02-09%20at%204.02.50%E2%80%AFPM.png?alt=media&#x26;token=e84b22f3-988d-4574-a082-530f33cdcbd3" alt="" width="375"><figcaption></figcaption></figure>

Once completed, Sprinto will start monitoring all supported AWS resources across your organisation using the configured read-only access.

***

#### Method 2: Create IAM role manually

Use this method if you prefer to configure IAM permissions yourself.

#### **Start the integration in Sprinto**

1. Go to **Settings → Integrations.**
2. Search for **AWS** and click **Connect.**
3. Select **AWS organization.**
4. Choose **Create IAM role manually.**
5. Click **Continue.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FyKYX1x0wp2LXD4GFAS5D%2FScreenshot%202026-02-09%20at%204.11.43%E2%80%AFPM.png?alt=media&#x26;token=42e245b4-4e5b-41ee-b0ce-766f9b9e5bea" alt="" width="375"><figcaption></figcaption></figure>

**A. Set up roles on all accounts**

1. Log in to the AWS Management Console.
2. Navigate to **IAM**.
3. Go to **Roles** and select **Create role**.
4. On the role creation page, choose **Another AWS account** as the trusted entity.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FNZOoTSt8y42cZkYMXjfv%2FScreenshot%202026-02-09%20at%204.11.55%E2%80%AFPM.png?alt=media&#x26;token=3539e91c-8ca6-4624-84e3-992c65bd6e35" alt="" width="375"><figcaption></figcaption></figure>

This sets up the base role that Sprinto will later assume to audit your AWS resources.

***

**B. Set up permissions on all accounts**

1. In the **Specify accounts that can use this role** section, enter the following details:
   * **Account ID**: Copy this from the Sprinto integration drawer.
   * **External ID**: Copy this exactly as shown in Sprinto.
2. Ensure **Require external ID** is enabled (recommended best practice for third-party access).
3. Make sure **Require MFA** is **not selected**.
4. Select **Next**.
5. On the **Add permissions** screen:
   * Search for and attach the **SecurityAudit** policy.
6. Click **Next** to proceed.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2Fpo0c7KenyNiIhEUKcMSB%2FScreenshot%202026-02-09%20at%204.12.06%E2%80%AFPM.png?alt=media&#x26;token=cd7836c0-2389-4272-b897-5a897d58873e" alt="" width="375"><figcaption></figcaption></figure>

***

**C. Add additional permissions (optional)**

Depending on your setup, you can attach additional policies:

* To allow Sprinto to create or manage CloudWatch alarms:
  * Attach CloudWatch (Read Only), PutMetricAlarm (Write) and Lightsail (Read Only)
* To fetch AWS SSO users:
  * Attach **AWSSSODirectoryReadOnly**
  * Attach **AWSSSOReadOnly**
* You can optionally add tags in the **Add tags** section.

Select **Next** after adding any optional permissions.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FidMtQnBlHnT5dVe3W0HR%2FScreenshot%202026-02-09%20at%204.12.17%E2%80%AFPM.png?alt=media&#x26;token=b899faef-8843-4d44-b384-338680dc7b38" alt="" width="375"><figcaption></figcaption></figure>

***

**D. Complete role setup on all accounts**

1. In the **Role details** section:
   * Enter the role name as **`sprinto-auditor-role`**
2. Review the configuration and select **Create role**.
3. Once created, search for the role **`sprinto-auditor-role`** in IAM.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FPLsbo8LQauRUabhqP20d%2FScreenshot%202026-02-09%20at%204.12.27%E2%80%AFPM.png?alt=media&#x26;token=d0237469-771e-465e-8294-87e30bde8517" alt="" width="375"><figcaption></figcaption></figure>

***

**E. Get the Role ARN of the root account**

1. In the **management (root) account**, open the newly created role:
   * **`sprinto-auditor-role`**
2. Copy the **Role ARN**.
3. Save this ARN, you’ll need it in the next step.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FzPYNk6s3vJe3piPu9cyt%2FScreenshot%202026-02-09%20at%204.12.37%E2%80%AFPM.png?alt=media&#x26;token=0de67be3-47b5-4ada-aac3-f364d5afda3c" alt="" width="375"><figcaption></figcaption></figure>

***

#### Step 2: Complete the integration in Sprinto

1. Return to the **Sprinto** dashboard.
2. In the AWS integration drawer:
   * Paste the copied **Role ARN**.
3. Select the **AWS regions** where your production workloads run.
   * You can modify regions later if needed.
4. Select **Connect**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FYmHJC7FNMOhPW5cxI6l8%2FScreenshot%202026-02-09%20at%204.12.37%E2%80%AFPM.png?alt=media&#x26;token=516900ff-4131-4b46-b697-c09fdf788613" alt="" width="375"><figcaption></figcaption></figure>

Once completed, Sprinto begins monitoring your AWS environment using the configured IAM role.

***

### Individual AWS Account Integration

Use this approach if you want to monitor one or more AWS accounts independently.

{% hint style="info" %}

#### Note

If you later switch to organisation-level integration, you must first disable all individually connected accounts.
{% endhint %}

***

#### Method 1: Use CloudFormation template

**Step 1: Start the integration in Sprinto**

1. Go to **Settings → Integrations.**
2. Search for **AWS** and click **Connect.**
3. Select **AWS account.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FBJpUgSSlZ6EQ3vtdqvEv%2FScreenshot%202026-02-10%20at%2014.25.51.png?alt=media&#x26;token=7314afe9-b27e-45c9-a0dc-aeb31416d302" alt="" width="375"><figcaption></figcaption></figure>

4. Confirm and click **Continue.**
5. Review required permissions and click **Next.**
6. Choose **Use CloudFormation template.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FrBYd8ZhGngAXznVwcW3c%2FScreenshot%202026-02-10%20at%2014.27.01.png?alt=media&#x26;token=5d4f2d10-7a06-42c6-a743-47dda08d60b1" alt="" width="375"><figcaption></figcaption></figure>

**Step 2: Create the access role**

1. Copy the provided bash command.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FJWJ3etLxRy6d8CclEn7S%2FScreenshot%202026-02-10%20at%2014.28.07.png?alt=media&#x26;token=4625b095-8b86-4246-bf4d-d9b0cb460e93" alt="" width="375"><figcaption></figcaption></figure>

2. Run it in **AWS CloudShell.**
3. The role is created automatically.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FfP7bXpTq1ZSSzTGpUFoI%2FScreenshot%202026-02-10%20at%2014.32.38.png?alt=media&#x26;token=91ed36ac-56b4-4eab-aae5-2a6219e60b4c" alt="" width="375"><figcaption></figcaption></figure>

**Step 3: Get role ARN and complete integration**

1. Copy the Role ARN.
2. Paste it in Sprinto.
3. Select regions.
4. Click **Connect.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2Fh0av7QDyPKlXT5xJTrmY%2FScreenshot%202026-02-10%20at%2014.33.12.png?alt=media&#x26;token=afacdbd8-d987-4164-801f-3a8dea74c3cc" alt="" width="375"><figcaption></figcaption></figure>

***

#### Method 2: Create IAM role manually

**Step 1: Start the integration in Sprinto**

1. Go to **Settings → Integrations.**
2. Search for **AWS** and click **Connect.**
3. Select **AWS account.**
4. Choose **Create IAM role manually.**
5. Click **Continue.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2F4N8uLhTy8tc7d3MNWOy5%2FScreenshot%202026-02-10%20at%2014.33.42.png?alt=media&#x26;token=ce1beebb-4091-433a-9fef-d2fca570295f" alt="" width="375"><figcaption></figcaption></figure>

**Step 2: Set up the IAM role**

1. Create a new IAM role with a **custom trust policy.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FE9nj4g9eGTqJhJtXUMKR%2FScreenshot%202026-02-10%20at%2014.35.02.png?alt=media&#x26;token=13826941-5413-434c-9b73-952c724c1a81" alt="" width="375"><figcaption></figcaption></figure>

2. Paste the JSON provided by Sprinto.
3. Attach the **SecurityAudit** policy.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FYAdahvDMygQVhnV33Jju%2FScreenshot%202026-02-10%20at%2014.35.38.png?alt=media&#x26;token=90ea12c9-2839-4391-968f-8e89840ce571" alt="" width="375"><figcaption></figcaption></figure>

**Optional permissions**

* CloudWatch alarms: `CloudWatch (Read Only), PutMetricAlarm (Write) and Lightsail (Read Only)`
* SSO users: `AWSSSOReadOnly`, `AWSSSODirectoryReadOnly`
* Tags can be added if needed.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FXXSAyJrllu30F64MTGDh%2FScreenshot%202026-02-10%20at%2014.36.25.png?alt=media&#x26;token=6c953f99-745e-4116-9840-ac152a9d5fea" alt="" width="375"><figcaption></figcaption></figure>

**Step 3: Complete role setup**

* Name the role `sprinto-auditor-role` .
* Create the role and copy its ARN.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FgOPj4hPrJaw05T9YnCaw%2FScreenshot%202026-02-10%20at%2014.36.53.png?alt=media&#x26;token=abe81391-7ad0-44c9-b5d5-4a2e66115fb6" alt="" width="563"><figcaption></figcaption></figure>

**Step 4: Complete the integration**

1. Paste the Role ARN in Sprinto.
2. Select regions.
3. Click **Connect.**

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FteoQxwP8KmXwhpA2LxXO%2FScreenshot%202026-02-10%20at%2014.37.22.png?alt=media&#x26;token=5175ad8d-afae-46eb-9855-34edc208e704" alt="" width="375"><figcaption></figcaption></figure>

***

### Required permissions and data access

#### Permissions required

* **SecurityAudit** (mandatory)
* Administrator access is required only during setup.

#### Data accessed by Sprinto

Sprinto reads configuration data for services such as:

* IAM, EC2, S3, RDS, EKS
* Load balancers, VPCs, Lambda, API Gateway
* CloudWatch (if enabled)

Sprinto does **not** modify or delete resources.

***

### Troubleshooting

#### Integration fails during setup

* Ensure **AdministratorAccess** is attached to the AWS user, role, or group.
* Verify that the correct **external ID** is used.

#### CloudFormation stack stuck in progress

* Wait a few seconds before retrying.
* Ensure no conflicting IAM roles already exist.

#### Role ARN not accepted

* Confirm the ARN belongs to `sprinto-auditor-role` .
* Ensure the role exists in the correct account.

#### Regions not showing data

* Ensure regions were selected during setup.
* You can modify regions later from the integration settings.

#### Switching from individual accounts to organisation integration

* Disable all individually connected AWS accounts first.
* Then proceed with organisation-level setup.

***

### **Support** <a href="#support" id="support"></a>

If you encounter any issues or need assistance with your integration, contact the Sprinto support team at <support@sprinto.com>.