AWS integration
AWS access changes,
recorded and verifiable.
Governax records access and security changes from AWS into a tamper-evident ledger: IAM users, roles, groups and policies, credentials, root and console sign-in, audit-trail tampering, and storage and network exposure. It reads CloudTrail event history every 10 minutes through a cross-account IAM role protected by an External ID, and appends each change to a per-entity, SHA-256 hash-chained record.
What lands in the ledger
What does Governax record from AWS?
IAM lifecycle and privilege
Users, roles and groups created and deleted, policies attached and detached (managed, inline and permissions boundaries), policy versions, group membership and trust policy changes.
Credentials
API credentials created and revoked, password and MFA changes, and password policy changes.
Sign-in
Root sign-in, failed console sign-ins, and IAM user console sign-ins that report no MFA.
Audit-trail tampering
CloudTrail logging stopped, and trails deleted or changed.
Storage exposure
S3 bucket policy and ACL changes, and S3 public access block removed or changed.
Defences
Threat detection disabled or changed, Config recording disabled, and KMS keys disabled or scheduled for deletion.
Network exposure
Security group rules, network ACLs, gateways, route tables, VPCs and VPC peering. Rules opened to 0.0.0.0/0 or ::/0 are tagged open_to_world.
Organisation escape
An account leaving, or being removed from, its AWS organisation.
Not captured: Read-only API calls are excluded at the source, and most failed calls are dropped. Three classes of failure are kept: console sign-in failures, attempts to tamper with a security control, and authorisation denials against sensitive services.
How does the AWS connection work?
You create an IAM role in your account with a custom trust policy that names the Governax AWS account and requires an External ID that Governax generates for your entity, and you attach the AWS-managed, read-only SecurityAudit policy. You then paste the role ARN into Governax. Governax reads CloudTrail event history, which is on by default and retains 90 days.
At connect, Governax checks that the role cannot be assumed without the External ID, and that with it the role can read CloudTrail. A role that can be assumed without the External ID is rejected, because that is a security problem in your account.
Governax polls every 10 minutes, across every region your account has enabled, recording write events only. The first poll backfills the previous 7 days, and each later poll re-scans a 2-hour trailing window to absorb CloudTrail's delivery delay. Disconnecting stops the polling; delete the role in IAM to revoke fully.
Scope
What Governax does not do
Governax is a system of record, not a control plane. It records AWS access changes after they have happened; it does not grant, revoke or block anything.
It cannot change your account
SecurityAudit is an AWS-managed, read-only policy. Governax cannot change anything in your account with it.
It does not record reads
Read-only API calls are excluded at the source, so every recorded event is a change.
It does not remove its role
Disconnecting stops polling. The IAM role still exists and still trusts Governax until you delete it.
It does not block changes
CloudTrail events are read after the change has happened. Governax records changes; it cannot prevent one.
How this helps with audits
When an auditor asks who had access in AWS and when it changed, the answer is a filtered view of the ledger rather than a folder of screenshots. Approvals are recorded for access requests raised with /governax in Slack. Filters combine tool, event type, actor and a date range, and the date range matches when the change happened in AWS, not when Governax recorded it.
Every event is appended to the entity's SHA-256 hash chain, and database triggers reject every update and delete. Anyone given read access to the entity, an auditor included, can re-run verification, which recomputes every hash and checks every link.
Verification proves that what was recorded has not changed. It cannot prove that everything that happened was recorded. Governax records the evidence; it does not map it to controls, perform the audit or export reports.
Questions
AWS integration FAQ
Does Governax need write access to AWS?
No. The role you create carries the AWS-managed SecurityAudit policy, which is read-only. Governax cannot change anything in your account with it, and you should not write a policy of your own.
How often is AWS polled?
Every 10 minutes. The first poll backfills the previous 7 days, and each later poll re-scans a 2-hour trailing window to absorb CloudTrail's delivery delay. Expect up to about 15 minutes before a change appears.
Which AWS regions are covered?
Governax discovers which regions your account has enabled and polls each of them, each tracking its own position. IAM, STS and root sign-in are recorded in one region, but S3, GuardDuty, Config, KMS and EC2 events are recorded where they happen, so activity outside your primary region is not missed.
What is the External ID for?
It is AWS's standard protection against the confused deputy problem. Governax generates it from your entity, and at connect it checks that the role cannot be assumed without it. It is not a secret; what matters is that the trust policy requires it.
Do we need CloudTrail enabled?
Governax reads CloudTrail event history, which is on by default and retains 90 days. You also need permission to create IAM roles in the account you want recorded.
Other integrations
- SlackWorkspace membership, channels, external sharing and access requests
- GitHubOrganisation, team and repository access, branch protection
- OktaUsers, groups, app assignments and admin roles
- Google WorkspaceUsers, groups, admin roles and third-party app grants
- Microsoft Entra IDDirectory roles, group membership and app consent
- GitLabGroup and project membership, tokens and deploy keys
Connect AWS and start the record.
Read the AWS setup guide, compare plans, or start free with one entity.