Connect Your AWS Account

Link your AWS account so SOFE can scan your resources. Read-only access via IAM role — SOFE cannot modify anything.

How It Works

1. You deploy a CloudFormation stack in your AWS account
2. The stack creates an IAM role: "sofe-read-only"
3. SOFE assumes that role to scan your resources
4. Your ExternalId ensures only YOUR SOFE account can assume it

Step-by-Step

  1. 1. Go to platform.sofe.dev/accounts
  2. 2. Click "🚀 Launch Stack in AWS Console" — opens CloudFormation in your AWS
  3. 3. In AWS Console: accept defaults, check "I acknowledge that AWS CloudFormation might create IAM resources", click Create stack
  4. 4. Wait ~1 minute for stack to complete (status: CREATE_COMPLETE)
  5. 5. Go to Outputs tab → copy the RoleArn value
  6. 6. Back in SOFE: paste the Role ARN → click "Connect & Verify"
  7. 7. ✅ Connected! Run your first evaluation.

What Permissions Does SOFE Get?

✅ ReadOnlyAccess — AWS managed policy (describe, list, get only)
✅ ce:GetCostAndUsage — Read cost data from Cost Explorer
✅ ce:GetCostAndUsageWithResources — Per-resource cost breakdown ($/month per resource)
✅ cloudwatch:GetMetricStatistics — Read CPU/memory metrics
✅ bedrock:InvokeModel — For AI features (optional)
❌ No write access — SOFE cannot create, modify, or delete ANY resource
❌ No billing access — Only cost breakdown, not payment methods

Optional: Per-Resource Cost Data

To see real $/month per resource (not just estimated savings), enable Resource-level data in Cost Explorer:

  1. 1. AWS Console → Cost Management → Cost Explorer → Settings
  2. 2.Under "Historical and granular data settings":
    ☑️ Enable "Daily granularity"
    ☑️ Enable "Resource-level data at daily granularity"
    → Select ALL services (free, no additional cost)
  3. 3. Save → Data available in 24-48 hours

⚡ Daily granularity is FREE. Do NOT enable "Hourly" (paid feature). Each SOFE evaluation makes 1 Cost Explorer API call ($0.01). At 4 evals/day = ~$1.20/month.

Without this, SOFE still works — you just won't see per-resource cost metrics. The ce: permissions are optional.

Security: ExternalId

Each SOFE user gets a unique ExternalId (your Firebase UID). This prevents the "confused deputy" attack — even if someone knows your Role ARN, they cannot assume it without YOUR ExternalId.

Troubleshooting

❌ "AssumeRole failed" → Check the Role ARN is correct (starts with arn:aws:iam::YOUR_ACCOUNT:role/sofe-read-only)
❌ Stack stuck in ROLLBACK → Delete the stack and re-launch. Usually caused by an existing role with the same name.
❌ "Access Denied" during scan → The role may not have the correct trust policy. Re-deploy the stack from platform.sofe.dev/accounts.
Related: Getting Started • Scheduled Evaluations