Help & Documentation Center
Quick setup guides, CloudFormation onboarding walkthroughs, permission troubleshooting, and direct engineering support.
CloudFormation Setup
Deploy read-only access in under 5 minutes.
External ID Guide
Confused Deputy security and trust policy.
Troubleshooting
Fix common IAM and stack creation errors.
Access Revocation
1-click deletion commands and verification.
Deploying the Read-Only CloudFormation Stack
To conduct your 24-hour audit, KloudSense requires read-only IAM visibility. The fastest and safest way to provision this is through our pre-built CloudFormation template:
- Open AWS Console: Log into your primary AWS account where your production or workload resources reside with administrator permissions.
-
Launch Stack: Navigate to CloudFormation > Create Stack > With new resources, and upload the
kloudsense-audit-role.yamltemplate provided upon onboarding. -
Parameters: Confirm the
ExternalIdprovided in your scoping dashboard is populated and setRoleNametoKloudSenseAuditRole. - Acknowledge Capabilities: Check the box "I acknowledge that AWS CloudFormation might create IAM resources with custom names" and click Create Stack.
-
Copy Outputs: Once status shows
CREATE_COMPLETE(takes ~45 seconds), copy theRoleArnvalue and paste it into your KloudSense dashboard.
Understanding the External ID Requirement
An External ID is a secret token required by AWS best practices for cross-account IAM role assumption. It ensures that another party cannot trick KloudSense into assuming your role without knowing your unique tenant secret (the "Confused Deputy" problem).
"StringEquals": {
"sts:ExternalId": "<your-unique-tenant-token>"
}
}
Troubleshooting Setup & Verification Errors
Error: "User is not authorized to perform: iam:CreateRole"
The IAM user or role deploying the CloudFormation stack lacks permissions to create IAM roles. Please deploy the stack using an account administrator role.
Error: "STS AssumeRole access denied"
This typically occurs if the ExternalId parameter in the role's trust policy was modified or does not match the token shown in your KloudSense onboarding panel.
Multi-Account / AWS Organizations Environments
If you run consolidated billing through AWS Organizations, we recommend deploying the role in your Management (Payer) account for billing access, plus workload accounts for resource telemetry. Contact our team for multi-account StackSets.
How to Revoke Access in Under 30 Seconds
You can sever KloudSense's access at any moment. Simply delete the CloudFormation stack from your AWS console, or run the following AWS CLI command:
This automatically deletes the IAM Role, trust relationships, and all attached policy assignments immediately.
Need Live Engineering Assistance?
Our lead cloud architects are on standby to assist with custom IAM boundaries, enterprise procurement, or multi-account AWS Organizations.