This walkthrough connects one AWS account, because AWS is the connector that fills the most of NHI Security: identities, relationships, access keys and inline permissions.

​
Before you start

You need:
  • The Owner or Admin role in your TRUSTIVAN organization. Only those roles map to the NHI Security role (Organization Admin) that can create and synchronize connectors. See role mapping.
  • An AWS account you are allowed to audit, and permission to create an IAM role in it.
  • A credentials reference that resolves in your deployment, and the AWS principal (ARN) your TRUSTIVAN deployment runs as. Ask whoever operates your TRUSTIVAN deployment for both.
Connector credentials are never typed into the NHI Security console. The console asks for a credentials reference, which is a name. The name must resolve to an entry your deployment holds, even in the recommended AWS mode (assume a role), where the entry carries no secret. A reference that resolves to nothing fails the synchronization with a configuration_error. The console has no screen for registering that entry; for a first connector it is registered by your deployment operator. See Credentials references.

​
Connect the account

1

Open NHI Security

In the TRUSTIVAN dashboard at https://app.trustivan.com, choose NHI Security in the product switcher, or go to /nhi. On a new organization the overview says No environment is connected. That is expected.
2

Create a read-only IAM role in your AWS account

Create a role (for example SecurityAuditReadOnly) and attach this policy. Every action is read-only.
You set the role’s trust policy in step 4, once you have the connector’s external ID.
3

Create the connector

Go to Integrations → Connectors and choose Connect an environment. Fill in:Leave Endpoint empty unless your operator tells you otherwise.
4

Require the external ID in the role's trust policy

Open the new connector. Its page shows an External ID of the form connector-<connector id>. NHI Security generates it and you cannot choose it, which stops anyone who learns your role ARN from having this deployment assume the role for them. Set the role’s trust policy to require it:
5

Check health

Choose Check health. A healthy result means the role could be assumed, the credentials belong to the account on the connector, and they can read the account’s IAM. If the credentials authenticate in a different account, the check refuses.
6

Enable and synchronize

Choose Enable, then Synchronize now. The request waits while the run collects, and reports what it discovered, created and left unchanged, and whether it read the whole account. When the run collected anything, policy evaluation runs straight after it, so findings are ready when the run returns. Every run is listed under Integrations → Synchronizations.

​
Read what it found

1

Browse identities

Go to Discover → Identities. You see IAM roles and IAM users that look like machine users. IAM users with a console sign-in profile belong to people and are deliberately not collected. Open an identity to see its lifecycle state, its owner (or the absence of one), its graph neighbourhood and the evidence that observed it.
2

Review findings and risk

Go to Assess → Findings for the findings and the evidence behind each, and Assess → Risk for risk per identity. Some policies show as unavailable, with the missing fact named. That means no connected environment supplies the fact they need, not that your estate passed them.
3

Re-run evaluation when you change policies

After you tune or enable a policy under Govern → Policies, choose Run evaluation to apply it without waiting for the next synchronization.

​
If something fails

​
Next steps