Skip to main content
Serval can ingest AWS IAM roles from your linked accounts so they are visible in Serval (for example, for access reviews). Roles must be tagged for discovery, and Serval must be granted a policy that allows it to read role data.

​
Ingestion Configuration

Perform the following setup for each AWS account for which Serval will ingest roles.
  1. Follow the guide to add give Serval access to an AWS role in your account.
  2. Once the role is created, navigate to permissions and select “Create inline policy”
    AWS IAM permissions tab with Create inline policy button

    Create an inline policy for the ingestion role

  3. Add the following permission policy. These permissions are required to be able to properly ingest all the data we require:

​
Tagging roles for ingestion

Serval only ingests roles tagged with the key serval (the value can be empty). Add this tag to each IAM role you want discovered during resource sync, and attach any AWS permission policies that define what the role can do.