Strays
Sign inStart free

Connecting an AWS account

Open AWS accounts in Strays

Strays reads your AWS account through an IAM role that you create, in your account, with a CloudFormation template. The template is short enough to read before you run it: see exactly what Strays installs, and how to remove it in one click.

What the role can do

One account, or your whole organization?

Until you have more than one account connected, This week and AWS accounts offer the two ways side by side:

Not sure? If your company has several AWS accounts under one bill, choose the organization.

Connecting, step by step

  1. On AWS accounts, under One AWS account, enter the 12-digit account ID and a name.
  2. Open the one-click set-up: CloudFormation opens with our account ID and your organisation's external ID filled in. Create the stack (about a minute).
  3. Choose Check the connection. Strays tries to use the role and, if it can, checks it belongs to the account ID you entered. The first scan starts straight away.

Only admins can add an account and check the connection.

When someone else looks after the AWS account

If you can't sign in to the AWS account yourself, open Ask someone else to do this on the account's page. Write an email with the instructions opens your email app with a ready-made message for your IT person or developer: what to do, the one-click link, and what the role can and can't do. You add their address. Or use Copy and paste the same instructions into a chat. When they say it's done, choose Check the connection.

Until the account is connected, Remove Strays from this AWS account is folded away at the bottom of its page (open it to see the steps, or to take an account added by mistake out of Strays). Once it's connected, it's a card of its own.

On a phone

The AWS Console app (Android and iPhone) opens AWS links itself and loses the one-click set-up, so nothing happens. The set-up is easiest on a computer. On a phone, long-press Open the one-click set-up and choose Open in browser, or use Copy under "On a phone" on the account page and paste the link into your browser. To stop the app taking over AWS links, turn off Open supported links (Android: Settings, Apps, AWS Console, Open by default).

Scans

Scans run on your plan's schedule (monthly on Free, weekly on Team, daily on Business); members can also choose Scan now beside an account on AWS accounts (or on the account's own page), or Scan all now above the list to scan every connected account at once. An account already being scanned isn't scanned twice. The first scan usually starts within a few minutes and takes a minute or two. When it has finished, the account's page says Scan finished: see what Strays found, with a link to This week. The budget form appears on the account's page after the first scan.

When a scan doesn't finish

While a scan is queued or running, the account page checks for the result every 20 seconds and reloads when it has finished (you can still choose Check again). The account page says how long ago a scan was asked for and whether it has started. A scan normally starts within a few minutes and finishes in a minute or two (longer for large accounts).

What the status means

Many accounts: connect your whole AWS Organization

If your accounts are in an AWS Organization, you can set Strays up once instead of account by account. It is on the Business plan and during the free trial. You need to be signed in to the management account (the one that owns the organization).

Already connected your management account on its own? Strays notices when an account's bill covers other accounts and suggests this on AWS accounts and the This week screen, with the account ID filled in. The accounts you connected by hand stay as they are. The management account already has the Strays role from its own stack, so the one-click set-up is filled in with ManagementRole set to existing: the organization stack leaves that role alone (creating it again would fail with "already exists") and only adds the permission to list your accounts.

  1. On This week or AWS accounts, under Your whole AWS Organization, choose Connect your organization and enter the management account's 12-digit ID. That is the only ID Strays asks for: the root or unit IDs go into the CloudFormation stack, in AWS, later.
  2. In AWS, once only, switch on trusted access: CloudFormation → StackSets → Enable trusted access with AWS Organizations. (Or run aws cloudformation activate-organizations-access in the management account.) Check it with aws cloudformation describe-organizations-access: the status should be ENABLED. Without it, the stack fails with a message about trusted access.
  3. Open the one-click set-up. It creates a stack called strays-audit-organization. In AWS CloudFormation, in the OrganizationalUnitIds field, enter the root ID (r-...) for every account. Find it under AWS Organizations → AWS accounts, above the account list, or run aws organizations list-roots. Or enter organizational unit IDs (ou-...) separated by commas for just those. The root covers every account now and later; units cover only the accounts in them.
  4. Tick the IAM acknowledgement and choose Create stack. In the stack's Events, ListAccounts and (unless the management account already had its own Strays role) ManagementAuditRole reach CREATE_COMPLETE within a minute or two. MemberAuditRoles, the StackSet that adds the same read-only role to every member account in those units (now, and whenever an account is created or moved into them), takes longer: a few minutes, more with many accounts. The stack shows CREATE_IN_PROGRESS until it finishes.
  5. Back in Strays, choose Check the connection as soon as those are complete. Member accounts the StackSet hasn't reached yet show "Waiting for the role"; Strays looks again every hour on the first day (or choose Look again now), then daily. Once accounts are connected, Scan now on the organization page scans them all straight away; otherwise each new account is scanned within the hour.

The stack gives Strays one extra permission in the management account: to list the organization's accounts (organizations:ListAccounts and organizations:DescribeOrganization: names, IDs and status, nothing else). The management account gets its role from the stack itself, because StackSets never deploy to it. Every account gets the identical role, from the same template as the single-account set-up.

Strays then looks at the organization every day. It adds new accounts up to your plan's limit. Accounts beyond it are listed as Not scanned: upgrade or add accounts, or choose which ones to scan (below). Suspended accounts and accounts that leave the organization are flagged, never deleted, so their history stays. An account removed in Strays isn't added back. Each AWS account can belong to one Strays organisation only. Prefer Terraform? The onboarding pack's module takes organizational_unit_ids.

Choosing which accounts to scan

When you have more accounts than your plan scans, an account that isn't scanned, or an AWS Organization connected, admins see a Scan tick box beside each account on AWS accounts. Tick the ones you want and choose Save which to scan. The count under the table shows how many you've ticked against your plan's limit; once you reach it, it says "untick one to choose another" and the other boxes can't be ticked until you do. Unticked accounts stay listed as Not scanned, with their history kept. An account that isn't connected yet says "Can't be scanned until it's connected": you can tick it to keep its place, but it is only scanned once the role works. Let Strays choose (first connected) clears your choices and names the accounts it picked: connected accounts first, in the order they were added to Strays, then any still waiting for the role, up to the limit. Suspended accounts and accounts that left the organization show "Can't be scanned". New accounts found later are scanned if there's room. When your plan doesn't scan every account, This week and the quarterly report say so, for example "4 connected · 3 scanned".

Removing Strays

You are always in control. Strays only reads, so it never deletes the role (or anything else) in your AWS account: you delete it, and Strays loses access the moment you do.

  1. On the account's page, find Remove Strays from this AWS account (open it first if the account isn't connected yet). The link opens the CloudFormation console at the strays-audit stack in the right region. Sign in to that AWS account, select the stack, choose Delete and confirm.
  2. Prefer the command line? The same page has the exact aws cloudformation delete-stack command to copy. If you installed the Terraform module, run terraform destroy -target=module.strays_audit instead.
  3. Choose Check it's gone. Strays tries to use the role: if AWS refuses, it is removed. If AWS gives an unclear answer, Strays says so rather than guess.
  4. Then stop scanning it in Strays (or leave it, and it shows as unable to connect).

An account you connected by hand before connecting your AWS Organization keeps its own strays-audit stack, even though the organization now lists it: its removal page shows the stack steps above, and deleting the organization's StackSet does not remove it. If that account is the management account, delete the organization's stack first: it added a permission to that role, and the role's own stack can't delete the role while it's there.

For a whole organization, the three steps go in this order, in the management account: delete the stack instances (the role in each member account), then the strays-audit-members StackSet, then the strays-audit-organization stack. The organization page has a console link and command for each. All the removal steps are on one page, and deleting your organisation in Settings lists them too, because deleting it in Strays does not touch AWS.

See exactly what is installed

What Strays installs shows the templates word for word, a SHA-256 for each so you can check your copy (shasum -a 256 file on macOS and Linux, certutil -hashfile file SHA256 on Windows), every permission with the reason Strays needs it, how the role is locked to Strays' account and your external ID, and a list of what the role cannot do.

Still stuck? Email support@getstrays.com.