Connect a cloud account

Once a cloud account is connected, ODiiN starts collecting assets automatically.

No agent to install — you only delegate read access, and it takes about 5 minutes per account.

About 10 minAdmin rights requiredUpdated 2026.0728

Before you start

Get these three things ready first. If any is missing, registration fails at step 3.

  • Admin rights on the cloud account you are connecting — you must be able to create an IAM role.
  • The owner or ops admin role in your ODiiN workspace.
  • If internal policy restricts external delegation, prior approval from your security officer.
ODiiN only asks for read access

Asset collection and diagnostics use read permissions only. If you later want automated actions, you delegate write access separately, and even then you pick the target resource scope yourself.

1. Choose an integration method

Pick one of two methods. Unless something blocks it, we recommend role delegation.

RecommendedRole delegationAssume Role
AlternativeAccess keyRotate every 90 days
  • Role delegation — create an ODiiN-only IAM role and set up a trust relationship. No credentials change hands, and revoking access is a single role deletion.
  • Access key — enter the access key and secret directly. Use it only where roles cannot be created, and rotate the key every 90 days.

2. Create the IAM role

The steps below use the AWS console. For Azure, GCP and Oracle, follow the same steps in their respective docs.

  1. 1IAM → Roles → Create role
    Open IAM in the AWS console and click Create role. For the trusted entity type, choose AWS account.
  2. 2Enter the trust policy
    Paste the policy below. Replace ExternalId with the value issued on the ODiiN account registration screen.
  3. 3Attach permission policies
    These are the minimum permissions for collection. If you plan to use automated actions, attach the optional policy in the table as well.
  4. 4Copy the role ARN
    When the role is created, copy its ARN from the detail screen. It looks like arn:aws:iam::123456789012:role/ODiiN-Collector.
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::905612345678:root" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": { "sts:ExternalId": "odiin-xxxxxxxx" }
    }
  }]
}
PurposePolicyRequired
Asset collectionReadOnlyAccessRequired
Cost analysisAWSBillingReadOnlyAccessRequired
Security diagnosticsSecurityAuditRecommended
Automated actionsCustom policy (scoped)Optional

3. Register the account in ODiiN

In the ODiiN dashboard go to Settings → Cloud accounts → Add account, then paste the ARN you copied.

Screenshot of the ODiiN add-account screen
Settings → Cloud accounts → Add account
  • Account alias — the name shown in the list. Make the environment obvious, e.g. production / staging.
  • Role ARN — the value copied in step 2.
  • Collection interval — 1 hour by default. Lower it to 15 minutes if resources change often.
If the connection test fails

It is usually an ExternalId mismatch, or permissions that have not propagated right after the role was created. Retry in a minute or two; if it still fails, see common problems below.

4. Verify collection

The first collection starts right after registration. It takes 5–20 minutes depending on account size, and the resource counts fill in on the dashboard cards when it finishes.

Screenshot of the dashboard after collection
Once collection finishes, assets appear on the unified dashboard

When the status moves from Collecting to Healthy, the connection is done. Next, check the asset collection doc to make sure nothing is missing.

Common problems

The connection test returns AccessDenied
Check that the `Principal` account number and `ExternalId` in the trust policy exactly match the values on the registration screen. Stray leading or trailing spaces are the most common cause.
Only some resources are collected
With only `ReadOnlyAccess` attached, cost and security data are missing. Attach the recommended policies from the step 2 table and run a manual collection.
An SCP blocks delegation to external accounts
Your organization's service control policy restricts `sts:AssumeRole`. Add an exception rule, or fall back to the access key method.
Can I register the same account twice?
You can, but we don't recommend it. Resources get counted twice and cost reports are inflated. To split by region or environment, use tag groups instead.
Was this page helpful?