Setup

Connect your AWS account

One read-only IAM role scoped to metadata calls. Takes about two minutes, and you can revoke it any time by deleting the role.

What we read

Bucket names, regions and creation dates
Versioning, lifecycle and object-lock configuration
Encryption mode, public access block, logging, replication
Size and object count from CloudWatch metrics
Incomplete multipart upload counts

What we never touch

Object contents — there is no s3:GetObject grant
Any write, delete or modify operation
Policies, ACLs or lifecycle rules
Services other than S3 and CloudWatch metrics

Create an IAM role

In the target account open IAM → Roles → Create role and choose Custom trust policy. Paste the policy below.

trust-policy.json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::…:root" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": { "sts:ExternalId": "sign in to get yours" }
    }
  }]
}

Attach read-only permissions

Add this as an inline policy on the role.

permissions.json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:ListAllMyBuckets", "s3:GetBucketLocation",
      "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration",
      "s3:GetBucketObjectLockConfiguration",
      "s3:GetEncryptionConfiguration",
      "s3:GetBucketPublicAccessBlock",
      "s3:GetBucketLogging", "s3:GetBucketReplication",
      "s3:GetBucketTagging", "s3:GetBucketCORS",
      "s3:ListBucketMultipartUploads",
      "s3:ListBucketIntelligentTieringConfigurations",
      "cloudwatch:GetMetricStatistics",
      "sts:GetCallerIdentity", "iam:ListAccountAliases"
    ],
    "Resource": "*"
  }]
}

Role details

Role ARN

Copy this from the role summary page in IAM.

Account ID

Environment

Connection Not connected

External ID —

Our account —

Access mode read-only