AWS Authentication
Ventra reaches AWS through an IAM identity that carries read only access. You save that identity once as a connection under Configuration, Authentication, and Ventra reuses it for platform collection runs and for building acquisition kits. Nothing is stored in the browser.
The wizard offers two authentication methods on the Authentication method step. Choose the one that matches how the client grants access.
| Method | What you provide | When to use |
|---|---|---|
| Credentials | Access Key ID, Secret Access Key, and an optional Session Token | A dedicated IAM user, or temporary STS credentials issued for the engagement |
| IAM Role | Role ARN | Ventra assumes a cross account role using the base credentials already present on the Ventra host |
Always create a dedicated collector identity. Never use personal administrator keys. Attach the Ventra read only policy, or deploy the CloudFormation stack or Terraform module linked on the Permissions page.
- Create an IAM user or role called ventra collector and attach the read only policy.
- For the Credentials method, create an access key for that user.
- For the IAM Role method, note the role ARN and allow the Ventra host identity to assume it.
- Open Configuration, Authentication, and choose Add cloud connection, then select Amazon Web Services.
- On Provider details, enter a display name and the twelve digit account ID.
- On Authentication method, choose Credentials or IAM Role.
- On Authenticate, paste the access keys or the role ARN.
- Run Validate connection. A pass confirms Ventra can call the STS GetCallerIdentity API.
The Session Token is only needed for temporary credentials from STS AssumeRole. Permanent IAM user keys leave the Session Token field empty.
Deploy with infrastructure as code
- CloudFormation template: Creates a read-only IAM user, managed policy, and optional access key.
- Terraform code: Terraform module for the Ventra collector IAM user and policy.
Policy references