Onboarding an AWS Account

Factor Fifty supports two AWS onboarding modes. Read-only is recommended when you only need visibility and assessment. Choose Managed when Factor Fifty must deploy or change resources in the account.

Capability	Read-only	Managed
Resource inventory and audit	Yes	Yes
Security assessment	Yes	Yes
Create, update, or delete resources	No	Yes
Deploy and maintain Factor Fifty IAM roles	No	Yes
Configure monitoring resources	No	Yes, according to the environment SLA
Runtime role	Customer-managed FactorFifty-ReadOnly	Customer-provided FactorFifty-Admin plus Factor Fifty-managed roles

Access for the person performing setup

Read-only describes Factor Fifty's runtime access. The person launching the CloudFormation stack still needs permission to create the stack and its named IAM role.

Prerequisites

• Access to the AWS account you want to onboard
• A Factor Fifty project to add the environment to
• For read-only onboarding: permission to create a CloudFormation stack and named IAM role
• For managed onboarding: permission to create an IAM role and attach AdministratorAccess

Read-only onboarding (recommended)

Read-only onboarding creates one role in your AWS account. Factor Fifty validates that it can assume the role, but it does not deploy any roles or other resources into the account.

Step 1: Start the environment in Factor Fifty

1. Open the Factor Fifty project.
2. Click Add new environment.
3. Select Read-only.
4. Enter the environment name and 12-digit AWS Account ID.
5. Keep the default role name, FactorFifty-ReadOnly.
6. Copy the generated External ID and leave the dialog open.

The External ID binds the role trust policy to this onboarding attempt and protects against the confused deputy problem.

Step 2: Create the read-only role in AWS

Launch the Factor Fifty read-only CloudFormation stack

1. Sign in to the target AWS account and open the link above.
2. Enter the External ID copied from Factor Fifty.
3. Keep FactorFifty-ReadOnly as the role name. If you change it, enter the same name in Factor Fifty.
4. Review the template, acknowledge that it creates a named IAM resource, and choose Create stack.
5. Wait for the stack status to become CREATE_COMPLETE.

The stack creates only the IAM role. Its trust policy permits the Factor Fifty production account (872515262065) to call sts:AssumeRole when the External ID matches. The role uses the AWS-managed ReadOnlyAccess policy.

Read-only can include workload data

AWS ReadOnlyAccess is broad. It includes resource metadata and some data-plane read actions, including S3 Get actions, and AWS can update the managed policy over time. Review the linked policy before onboarding. If your policy requires metadata-only access, contact CloudSisters before continuing; the automated onboarding flow does not yet support a reduced custom policy.

Step 3: Validate and save

1. Return to the open Factor Fifty dialog.
2. Choose Validate. IAM changes can take several seconds to propagate, so retry once if the first attempt fails.
3. Select the environment SLA.
4. Choose Save.

For read-only environments, the second step does not offer managed integrations or monitoring because those capabilities require Managed access.

The environment is connected after validation succeeds. Factor Fifty stores the read-only role as customer-managed and does not enqueue role deployment.

Manual role creation

If your organization does not allow the supplied CloudFormation stack, create an IAM role with the same settings:

1. In IAM, choose Roles → Create role → Custom trust policy.
2. Use the trust policy below, replacing <EXTERNAL_ID> with the value from Factor Fifty.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::872515262065:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}

3. Attach the AWS-managed ReadOnlyAccess policy.
4. Name the role FactorFifty-ReadOnly.
5. Return to Factor Fifty and validate the role.

Managed onboarding

Managed onboarding is required when Factor Fifty must deploy IAM roles, configure monitoring, or plan and deploy infrastructure. The onboarding role has administrative permissions because it bootstraps and maintains the narrower operational roles used by the platform.

Administrative runtime access

Unlike read-only onboarding, the FactorFifty-Admin role remains available to Factor Fifty for managed operations. Use this mode only for accounts where that access has been approved.

Step 1: Start the environment in Factor Fifty

1. Open the Factor Fifty project and click Add new environment.
2. Select Managed.
3. Enter the environment name and AWS Account ID.
4. Keep the default role name, FactorFifty-Admin.
5. Copy the generated External ID and leave the dialog open.

Step 2: Create the admin onboarding role

1. Open the IAM console in the target account.
2. Choose Roles → Create role → Custom trust policy.
3. Use the trust policy from the manual read-only instructions above, with the External ID from the Managed onboarding dialog.
4. Attach the AWS-managed AdministratorAccess policy.
5. Name the role FactorFifty-Admin and create it.

Step 3: Validate and configure

1. Return to Factor Fifty and choose Validate.
2. Select the environment SLA.
3. Enable the approved managed integrations.
4. Choose Save.

After validation, Factor Fifty registers the admin role and queues deployment of the selected platform roles. Monitoring is configured for Production and Non-Production environments; it remains disabled for Unmanaged environments.

Connect an AWS billing source

AWS billing sources are configured at the customer level and can be reused across that customer's projects. This connection is separate from the environment access mode and uses a dedicated read-only role for Factor Fifty FOCUS exports; it cannot access workloads.

Launch the Factor Fifty AWS billing source CloudFormation stack

Sign in to the payer or organization management account before opening the link. The documentation link pre-fills the production template, Factor Fifty principal, and role name. Paste the External ID generated by Factor Fifty into the required ExternalId parameter. The Open CloudFormation in AWS button in Factor Fifty supplies that value automatically.

1. Open the customer in Factor Fifty and go to Projects.
2. Choose Billing Sources, then AWS billing export.
3. Enter a display name for the source.
4. Copy the generated External ID and choose Open CloudFormation in AWS, or use the documentation link above and paste the copied value into ExternalId.
5. Deploy the stack in the payer or organization management account.
6. Copy the Role ARN from the CloudFormation outputs into Factor Fifty. You can also enter the expected 12-digit payer account ID as an additional safety check.
7. Choose Verify & connect.

Changing the access mode

Access mode is selected when the AWS environment is first onboarded. Do not add AdministratorAccess to FactorFifty-ReadOnly or reuse the read-only role as the admin role. Contact CloudSisters to change an existing environment between modes so the registration and deployed roles can be migrated safely.

Removing or disabling FactorFifty-Admin stops managed operations. Read-only environments have no admin role, and Factor Fifty explicitly blocks infrastructure planning and deployment for them.

Troubleshooting

Validation failed

Check all of the following:

1. The AWS Account ID is the 12-digit ID of the account containing the role.
2. The role name in Factor Fifty matches IAM exactly.
3. The trust policy uses arn:aws:iam::872515262065:root as its principal.
4. The trust policy External ID matches the current Factor Fifty dialog.
5. No Service Control Policy, permissions boundary, or explicit deny blocks sts:AssumeRole.
6. IAM has had several seconds to propagate the new role or trust-policy change.

Read-only scans report missing permissions

1. Confirm that FactorFifty-ReadOnly still has the AWS-managed ReadOnlyAccess policy attached.
2. Check for Service Control Policies, permissions boundaries, session policies, or explicit denies that reduce the role's effective permissions.
3. Confirm that the CloudFormation stack is still present and has not drifted.

Managed role deployment fails

1. Confirm that FactorFifty-Admin has AdministratorAccess attached.
2. Check whether Service Control Policies or permissions boundaries block IAM role creation or policy attachment.
3. Open the AWS onboarding status in Factor Fifty, correct the External ID if necessary, and choose Save & retry.

Revoke access

• Read-only: delete the CloudFormation stack or remove the FactorFifty-ReadOnly role.
• Managed: remove or disable FactorFifty-Admin to stop further managed operations. Coordinate removal of Factor Fifty-managed roles with CloudSisters if the account is being fully offboarded.