AWS

Liddr inventories your AWS footprint — ECS services, Lambda functions, RDS databases, EC2 security groups, and IAM roles — so Know can answer infrastructure questions and Signals can flag identity/network changes as risks. Liddr never writes to AWS; the credentials only ever need read access.

What Liddr accesses

Direction	Access
Ingest (read into your knowledge graph)	Read-only
Reverse sync	None — Liddr never writes to this source

Setup

1. In IAM: create a dedicated user (e.g. liddr-readonly) with programmatic access — no console access needed — and assign it an MFA device.
2. Attach a read-only policy: the AWS-managed ReadOnlyAccess is the simple option; the least-privilege action list is below.
3. In Liddr: Settings → Connections → AWS, enter the Access key ID, Secret access key, and MFA device serial (arn:aws:iam::ACCOUNT:mfa/…), plus the region(s) to scan.
4. Use Refresh MFA session to mint the 12-hour session token, then Test and run an Ingest. Re-mint the session when it expires.

Required scopes

Least-privilege IAM policy

Ingest — minimum

• ecs:ListClusters, ecs:ListServices, ecs:DescribeServices
• lambda:ListFunctions
• rds:DescribeDBInstances, rds:DescribeDBClusters
• ec2:DescribeSecurityGroups
• iam:ListRoles
• sts:GetCallerIdentity (used by Test)

TIP

This list is both the minimum and the maximum — there is no reverse sync to AWS. Never attach write/admin policies; the AWS-managed ReadOnlyAccess policy also works if broader read visibility is acceptable.

Reference

• AWS docs: managing access keys for IAM users