Skip to main content
The OnePatch agent can act in your AWS account while it investigates — describe resources, read logs, take whatever actions you permit. Access goes through an IAM role in your account: you decide what the role can do, and your CloudTrail records everything it does.

​
Connect

An org admin connects on the Integrations page under AWS account. The card shows two values: the Principal — the AWS identity your role will trust — and an External ID unique to your organization.
1

Create the role

In your AWS account, create an IAM role whose trust policy names that principal and external ID. Copy trust policy JSON on the card gives you the exact document:
2

Attach permissions

Attach the permissions you want the agent to have. ReadOnlyAccess is a reasonable start. The agent can do exactly what the role’s policies allow, and you can widen or narrow them at any time without touching OnePatch.
3

Paste the role ARN

Paste the role’s ARN into the card and click Connect. OnePatch verifies by assuming the role from your workspace, and the card flips to Connected within a few seconds. If it stays on Verifying…, it shows the error from the last attempt — usually a trust policy that doesn’t match yet.

​
How access works

Credentials are short-lived STS sessions, one hour at most, requested on demand while the agent works. Nothing long-lived is stored on either side. Every API call appears in your CloudTrail under a session named for the chat that made it, so you can trace any action back to the conversation.

​
Disconnect

Disconnect on the card stops OnePatch from requesting new credentials within about 30 seconds; sessions already issued expire within the hour. To revoke immediately, delete the role — or just its trust policy — in your account.