Read-only, agentless. Cross-account IAM for AWS, Entra federated credentials for Azure, Workload Identity Federation for GCP.
| Account | Role | External ID | Last sync | Status |
|---|---|---|---|---|
| prod-us-east-1 (111122223333) | arn:aws:iam::111122223333:role/GrandLineReadOnly | eid-a1b2 | 2m ago | healthy |
| prod-eu-west-1 (222233334444) | .../GrandLineReadOnly | eid-a1b2 | 3m ago | healthy |
| staging (333344445555) | .../GrandLineReadOnly | eid-a1b2 | 5m ago | healthy |
| sandbox (444455556666) | .../GrandLineReadOnly | eid-a1b2 | 4m ago | healthy |
| network-hub (555566667777) | .../GrandLineReadOnly | eid-a1b2 | 4m ago | healthy |
| security (666677778888) | .../GrandLineReadOnly | eid-a1b2 | 3m ago | healthy |
AWS Organizations onboarding: member accounts are discovered automatically via organizations:ListAccounts. Roles can be deployed via a StackSet.
| Subscription | Entra App | Federated credential | Last sync | Status |
|---|---|---|---|---|
| acme-prod (00000000-0000-0000-0000-000000000001) | grandline-reader | fc-acme-prod | 4m ago | healthy |
| acme-nonprod | grandline-reader | fc-acme-nonprod | 5m ago | healthy |
| acme-data | grandline-reader | fc-acme-data | 2m ago | healthy |
| acme-legacy | grandline-reader | fc-acme-legacy | 6m ago | stale |
Management Group onboarding: assign Reader at the root MG and GrandLine will sync new subscriptions on a daily cadence.
| Project | SA | WIF pool | Last sync | Status |
|---|---|---|---|---|
| svc-prod | [email protected] | grandline-pool | 3m ago | healthy |
| data-prod | [email protected] | grandline-pool | 4m ago | healthy |
| net-hub | .../grandline-reader | grandline-pool | 3m ago | healthy |
| security | .../grandline-reader | grandline-pool | 2m ago | healthy |
| sandbox | .../grandline-reader | grandline-pool | 4m ago | healthy |
Org + Folder onboarding with roles/viewer and roles/iam.securityReviewer. Projects are discovered via Resource Manager.
We'll show you a CloudFormation StackSet template that creates GrandLineReadOnly with an external ID, trusted to our SaaS account.
We'll provide the Entra app ID and federated credential subject pattern. You grant Reader on the target Management Group.
We'll show you the WIF pool and principal subject. You create the service account, bind roles/viewer and roles/iam.securityReviewer at the org.