Import and manage AWS infrastructure data in the Lucid Data Hub

Supported AWS regions, resources, and lines

For a comprehensive list of the supported regions, resources, and lines from AWS that are available in Lucid refer to our Supported AWS regions, resources, and lines article. 

Import AWS infrastructure

You can import your AWS cloud infrastructure data using one of the four following methods:

• Trusted access: provide a cross-account IAM role with the proper policies. This role can be set with the following permission scopes:
  • Import via account-level access to import one individual account
    Import via organizational-level access to import all AWS accounts from one organizational unit or the entire organization
• Single-use authorization: enter credentials for an IAM user with proper policies attached
• File upload: execute a Lucid provided Python script in a configured AWS CLI profile, which gathers the data locally as a JSON file, then provide the generated file

Check out the following table for specifics on each method and to determine which is best for your use case.

*Resource type 1 is all mapped resources listed in the Supported resource section. Resource type 2 is Cloud Inventory: a broad variety of unmapped resources you can place manually in your documents.
**Automatic data source refreshes are available for users to set on a recurring schedule (daily, weekly, monthly, yearly) via the data hub. Manual refreshes are performed with a single click through the data hub as well.

With trusted access imports, Lucid saves these credentials so you can refresh your data or start new imports without re-entering your information. This storage capability allows Lucid to perform the automatic data refreshes. Credentials can be deleted via the AWS data hub credentials tab. Lucid does not store IAM user credentials for future re-use, limiting single-use authorization to only manual refresh.

If you are working with a very large environment, reduce the amount of data you are importing, or reduce the number of API calls Lucid makes to AWS. Lucid supports up to 50 concurrent account imports per user. After each import finishes, you can start a new import.

Trusted access (cross-account role)

Trusted access uses cross-account IAM roles so the Cloud Accelerator can assume read-only access to import account metadata and create data sources. There are two trusted-access scopes:

• Organization-level (recommended for multi-account AWS organizations)
• Account-level (single-account imports)

This guide provides detailed, executable steps for both methods, and includes multiple infrastructure as code implementations: Terraform, CloudFormation automation, and manual IAM creation.

Trusted access: Organization-level

To centrally manage infrastructure imports across your entire AWS Organization, follow the steps below.

First, verify the following prerequisites:

• The chosen bastion account must not already be registered as a bastion for another import in Lucid.
• A user with access to the Lucid Data Hub to initiate the organization-level registration.

Then, navigate to the Lucid Data Hub and select your method of IAM resource creation.

1. Open the Lucid Home Page.
2. Click Data hub from the bottom of the left navigation.
3. Select Import AWS data.
4. Choose Trusted access.
5. Under credential scope, select Connect to an AWS organization.
6. Choose from the options to automatically set up permissions:
   1. Use CloudFormation templates.
   2. Use a Terraform module.

Method 1: Using CloudFormation for automated AWS Organization permission setup

Use Lucid's unified CloudFormation template to automatically configure all required IAM roles and permissions across your AWS Organization in a single deployment.

Requirements

• Deployment account: You must deploy this template from the organization management account.
• Bastion account (recommended): Use a non-management member account as your bastion account. This account will coordinate imports across your organization.
  • Bastion account (alternative): You may use the management account as the bastion, but this is against AWS best practices and should only be used if your organization's policies require it. If you choose this option, the CloudFormation template will handle bastion role creation directly in the management account.
• Account eligibility: The bastion account must not have been previously used as a bastion account with Lucid.

Parameters

• BastionAccountId: This is the 12-digit AWS account ID you'd like to use for managing third-party trusted access. Lucid will assume a cross-account role in this "bastion account" to coordinate imports.
• BastionRootOrOrganizationalUnitId: This is the ID of the organizational unit (OU) (e.g., ou-xxxxxxxxxx) or root (e.g., r-xxxx) that contains your chosen BastionAccountId.
• MembersRootOrOrganizationalUnitId: This parameter controls the scope of accounts in your AWS Organization from which Lucid can import resource data.
  • To allow imports from all accounts in your organization, use the ID of your organization root (e.g., r-xxxx).
  • If you'd only like to allow imports for accounts nested within a single specific organizational unit (OU), use that specific OU's ID (e.g., ou-xxxxxxxxxx).

Instructions

To set up permissions automatically with CloudFormation, follow these steps:

1. From AWS:
   • Identify your bastion account ID (if using delegated admin approach).
   • Identify the organizational unit or root IDs for parameters listed above.
   • Sign in to the AWS organization management account.
2. In Lucid, click Launch CloudFormation template to open the template in your AWS console.
   • You will be taken to the CloudFormation stack creation page with the template pre-loaded.
3. Set UseManagementAccountAsBastion to “false” (recommended) or “true”.
   • If using delegated admin (UseManagementAccountAsBastion = “false”), provide:
     • BastionAccountId: Your chosen bastion account ID.
     • BastionRootOrOrganizationalUnitId: The OU or root containing the bastion account.
4. Set “MembersRootOrOrganizationalUnitId” to control import scope.
5. Set “CreateOrgResourcePolicy” to “true” (default) if your organization doesn’t have a resource policy. 
   • If using the management account as the bastion, you can set this value to “false”.
   • If your organization has an existing resource policy, set this value to “false” to prevent failure when deploying the stack. Instead, manually add the following “Statement” object to the “Statement” array in your existing organization resource policy (this adds to your existing policy — it does not replace it). Be sure to substitute your actual bastion account ID where indicated”:
     
     {
      "Sid": "Statement",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<YOUR_BASTION_ACCOUNT_ID>:root"
        ]
      },
      "Action": [
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListChildren",
        "organizations:ListParents",
        "organizations:ListRoots",
        "organizations:DescribePolicy",
        "organizations:DescribeOrganizationalUnit",
        "organizations:DescribeOrganization",
        "organizations:DescribeAccount",
        "organizations:ListOrganizationalUnitsForParent"
      ],
      "Resource": "*"
     }
      
6. Optionally, customize BastionRoleName and MemberRoleName.
7. Click Create stack and wait for deployment to complete.
   • The template will automatically:
     • Create the bastion role in your chosen bastion account.
     • Deploy StackSets to create member roles across target accounts.
     • Configure the organization resource policy to delegate read access to the selected bastion account (when CreateOrgResourcePolicy is set to “true”).
     • Enable auto-deployment for future accounts added to the organization.
8. In the AWS IAM console of your bastion account, go to “Roles”.
9. Locate the bastion role (default name: `lucid-import-bastion-role` or your custom name).
10. Copy the role's ARN.
11. Return to the Lucid Data Hub tab and scroll down to the “Add the cross-account role to Lucid” section.
    • Paste the bastion role ARN in the “Bastion role ARN” field.
    • If you used a custom MemberRoleName, update the “Member account role name” field to match.
    • Optionally, update the Credential display name to identify this connection.
12. Click Next to register the cross-account role with Lucid.
13. Select the role and click Next.
14. Proceed with the steps to import accounts and create documents.

Method 2: Using Terraform for automated AWS Organization permission setup

Per AWS best practices, we recommend using a delegated administrator account as your bastion account. The org-read-delegation submodule (described below) must still be deployed from the management account.

Submodules

• The org-read-delegation submodule: Configures a bastion account with delegated administrator access to scan your AWS Organization structure. (Lucid will subsequently assume a role in this bastion account to perform the import).
  • This must be deployed in the management account.
  • AWS Organizations only allows one resource-based delegation policy. If such a policy already exists in your organization, the deployment will fail. Instead of adding this submodule, manually add the required actions and principal from the module to your existing policy. Do not replace the existing policy.
• The bastion-role submodule: creates the primary IAM role in your bastion account that Lucid will assume.
  • Set the external_id parameter using the unique "External ID" value copied from your Lucid account's AWS import setup page.
• The import-role submodule: creates the IAM role to be deployed in member accounts for reading resource data.
  • The module creates a role in the member account that can be assumed by the bastion account — the module is unable to automate that process to the member accounts. This module needs to be deployed in every member account from which you want to import data, including whenever you’d like to add new accounts to your organization in the future. Follow your organization’s standard practices to apply code from this module to newly added accounts.

Instructions

First, ensure you have Terraform set up for the accounts where you’ll deploy Lucid’s terraform modules.

Next, configure and deploy Lucid’s Terraform module, following these steps:

• Access Lucid’s Terraform module for configuring permissions by clicking View in Terraform Registry, or access the module directly with this link.
• On the module registry page, click on Submodules. You will configure each of the three required submodules from the dropdown (org-read-delegation, bastion-role, and import-role) in your main.tf.
• Follow the “Usage” instructions on each submodule’s Readme page to add the module to your Terraform configuration code.
• Deploy your Terraform code and wait for the included resources from Lucid’s module to be created.
• From the AWS IAM console in your bastion account, copy the ARN of the created lucid-import-bastion-role (or its custom name). Alternatively, output this ARN from your Terraform configuration.

Lastly, add your new IAM role to Lucid.

1. Return to the Lucid Data Hub tab and scroll down to the “Add the cross-account role to Lucid” section.
   1. Enter the bastion account role ARN into the “Bastion role ARN” field.
   2. If you used a custom MemberRoleName when configuring the Terraform module, update the "Member account role name" field to that value.
   3. (Optional) Update the prepopulated value for “Credential display name” to represent the bastion role used to coordinate imports. This display name will be used in Lucid’s Data Hub so you can identify the credential for future use and management.
2. Click Next to register the cross-account role with Lucid.
3. Select the role and click Next.
4. Proceed with the steps to import accounts and create documents.

Trusted access: Account-level

To import AWS infrastructure for individual accounts via a cross-account IAM role, follow the steps below.

Step 1: Create a new cross-account

To register a new cross-account IAM role (i.e. an import credential) for your chosen account, you’ll start by:

1. Navigate to the Lucid Home Page.
2. Click Data hub from the bottom of the navigation menu on the left-hand side of the page.
3. Select Import AWS data.
4. Select Trusted access.
5. Under credential scope, choose Connect to individual AWS accounts.
6. Choose your preferred method to register a new credential (i.e. AWS IAM role):
   • Use a Terraform module
   • Use a CloudFormation template
   • Create manually 

Here, you’ll choose your preferred method of creating a new cross-account role credential: automatically with a Terraform module (select Terraform), automatically with a CloudFormation stack (select CloudFormation) or manually using IAM Roles and Policies (select Manual creation). Complete Step 1 for your chosen method, then skip to complete Step 2 for adding the cross-account role to Lucid.

Method 1: Using Terraform for automated individual AWS account role creation

First, ensure your Terraform environment is configured with AWS credentials that have sufficient permissions to create and manage IAM roles in the AWS account where you intend to deploy Lucid's import role. Refer to Terraform’s Get Started - AWS documentation for details.

Next, proceed with Step 1 of Lucid's setup process to configure and deploy Lucid’s Terraform module.

1. After selecting the Terraform option for account-level imports within Lucid, access the module for configuring AWS permissions by clicking View in Terraform Registry, or directly access the import-role module in the Terraform Registry here. 
2. On the import-role module’s Readme page, locate and follow the “Non-Org Level Imports” section under “Usage” to add the module to your Terraform configuration code
   1. This submodule requires an external_id value. Get the value for this external ID by returning to your Lucid tab and clicking Copy next to the provided external ID in Lucid’s Step 1 setup.
3. Deploy your Terraform code and wait for the included resources from Lucid’s module to be created.
4. Navigate to the AWS IAM console in the AWS account where you deployed the role, locate the lucid-import-account-role (or your custom role_name), and copy its ARN from the Summary page. Alternatively, output this ARN from your Terraform configuration.

Method 2: Using CloudFormation for automated individual AWS account role creation

To create a new role automatically with CloudFormation, follow these steps:

1. Log in to the AWS console using the account you would like to import
2. In Lucid, click Launch CloudFormation to open a new browser tab. Leave your Lucid browser tab open so you can return to it later.
3. In the AWS console, click Create Stack.
4. After the stack has been created, navigate to the Resources tab within your AWS console and select the "LucidImportRole" (or your custom CrossAccountRole name). Copy the role ARN.
5. Skip to the steps to register your cross-account role in the data hub.

Method 3: Using AWS IAM console for manual individual AWS account role creation

To manually create a new role in the AWS IAM Console, follow these steps:

1. Under “Step 1: Start creating a role” select Create role.

1. You will be navigated to your AWS account. Leave your Lucid browser tab open so you can return to it later.
2. Lucid will auto-generate a unique External ID associated with your Lucid account. This is in alignment with AWS security recommendations.
3. Add ReadOnlyAccess policy:
4. In AWS, click Next to go to the permission step.
5. On the “Add permissions” page, search for and select the ReadOnlyAccess policy. This setting is enabled by default in Lucid and is required for all resources to appear correctly in your created Lucidchart documents.
6. Add custom permissions:
   1. Navigate back to the Lucid tab to "3. Add custom permissions" and click Copy permissions to copy the JSON text file.
   2. Open a new tab or window and navigate to your AWS IAM console, go to the left navigation pane and select Policies.
   3. From the Policies page, click Create policy.
   4. On the “Create Policy” page, toggle to the JSON tab and paste the file you copied into the JSON tab in your AWS Console.
   5. Click Next: Tags.
   6. Add tags to the policy if you want, and click Next: Review.
   7. Give the policy a name and description.
   8. Click Create policy.
7. Attach custom policy to role:
   1. In the previous AWS tab where you were creating a new cross-account role, click the refresh button, and search for the name of the policy you just created.
   2. Select the policy and click Next.
   3. Give the role a name and description. If you’d like, add tags to the role.
   4. Click Create role.

Step 2: Add the cross-account role to Lucid

Once you have the Role ARN from your chosen method (Terraform, CloudFormation, or manual creation), return to Lucid's AWS import setup to complete Step 2:

1. Paste the copied Role ARN into the “Role ARN” field of the provided form in Lucid's AWS import setup Step 2.
   • If desired, update the prepopulated value for “Credential display name”. This display name will be used in the “Data hub > AWS > Credentials” section so you can locate the credential for future use and management, and will represent the cross-account role used to coordinate imports of your chosen AWS account.
2. Click Next to register the cross-account role with Lucid, followed by selecting the credential role, then clicking Next again.
3. Proceed to select the AWS accounts for data import and document creation.

Single-use authorization

Single-use authorization imports an AWS account using a short-lived IAM user access key (access key ID + secret). Lucid does not store these credentials after the scan completes; you must re-enter credentials for subsequent updates. Use this flow for one-off imports or when you cannot deploy cross-account roles.

Prerequisites

• An AWS account with permissions to create IAM policies, users, and access keys.
• A Lucid user with Cloud Accelerator access and permissions to import in the data hub.
• Access to the Lucid-provided custom policy JSON from the data hub.

Temporary STS credentials (optional)
AWS temporary credentials include three fields: AccessKeyId, SecretAccessKey, and SessionToken. Lucid accepts these temporary credentials for single-use imports when you provide the session token along with the access key and secret. You can generate temporary credentials using aws sts assume-role or an SSO flow.

    aws sts assume-role --role-arn
    arn:aws:iam::123456789012:role/YourRole --role-session-name
    lucid-session
    

      aws configure sso
      ### Follow prompts: SSO start URL, region, then select role and account
    

Create and register an AWS IAM user (step-by-step)

Step 1: Start in Lucid

1. Open the Lucid Home Page.
2. Click Data hub in the bottom-left navigation.
3. Select Import AWS data.
4. Choose Single-use authorization.

Step 2: Create the custom policy in AWS

1. In the Lucid Data Hub registration flow, download or copy the custom JSON policy provided in Step 1.
2. In the AWS console, open IAM → Policies → Create policy.
3. Switch to the JSON tab and paste the Lucid-provided policy JSON.
4. (Optional) Customize the policy if you understand the permission scope required.
5. Click Next, give the policy a meaningful name (for example: "lucid_custom_iam_user_policy"), add a description and tags, then Create policy.

Step 3: Create an IAM user and attach permissions

1. In IAM → Users, click Create user.
2. Provide a username and enable Programmatic access.
3. On the Permissions step choose Attach policies directly.
4. Attach ReadOnlyAccess (AWS-managed) if broader read access is acceptable.
5. Also attach the custom policy created in Step 2.
6. Complete user creation and go to the Security credentials tab for that user.

Step 4: Create access keys

1. In the Security credentials tab, under Access keys, click Create access key.
2. For Use Case choose Third-party service if prompted.
3. Copy the Access Key ID and Secret Access Key or download the CSV. Treat the secret like any sensitive credential.

Step 5: Register credentials in Lucid and import

1. Return to the Lucid Data Hub and choose to upload the CSV or enter the credentials manually.
   • (Optional) If you are using temporary STS credentials, provide the session token along with the Access Key ID and Secret Access Key.
2. Click Next.
3. Configure the regions and resource types you want to import; deselect any heavy or unsupported resource types to narrow the import surface.
4. Provide a name for the account import and click Finish.

File upload

To import AWS infrastructure via a JSON file upload, follow these steps:

1. From the Lucid Home Page, click Data hub in the left-hand navigation menu.
2. Select Import AWS data in the top-right corner.
3. Choose File upload.
4. Download or copy the Lucid-provided profile permissions from the Lucid Data Hub tab.
5. Configure your AWS CLI with a named profile that includes these permissions.
6. In the Lucid Data Hub tab, download or copy the Python script.
7. Execute the Python script in your AWS CLI. An aws.json file will be generated.
8. In the Lucid Data Hub tab, select Choose file and upload the aws.json file.
   • You can import up to 50 accounts at a time. If you have more than 50 accounts in the uploaded file, separate the file into multiple JSON files to import.
9. Click Next. 
10. Provide an alias name for each account you’d like to import.
11. Select Import AWS accounts.

AWS file upload script description
The Lucid-provided import script, awscliscript.py, requires the configuration of a named profile in the CLI. A named profile is a collection of settings and credentials that you can apply to an AWS CLI command. For detailed instructions on creating an AWS profile, refer to AWS’s documentation on Configuration and credential file settings in the AWS CLI.

Running aws configure will store the entered credentials into the profile named default. If you have multiple accounts we recommend creating named profiles for them. For example, if I have two accounts, preprod and prod and I store their credentials as two separate profiles, then I could easily describe the ec2 instances in preprod by doing aws ec2 describe-instances -- profile preprod. Then, to describe instances in prod I can change the profile argument to aws ec2 describe-instances -- profile prod.

Requirements

• Python: Versions 3.0-3.9. Ensure "Add Python to PATH" is selected during installation.
• AWS CLI: Installed and configured.
• `botocore`: Version 1.27.77. Install using pip3 install botocore==1.27.77.

Parameters

• -p, --profile [REQUIRED]
  • Specifies the name of the AWS profile to use. This option can be repeated to import from multiple profiles.
• -r, --regions [REQUIRED]
  • Specifies one or more AWS regions from which to import resources. This option must correspond to the preceding --profile option.
• -c, --count
  • Outputs a JSON file containing a count of resources. When this flag is used, the generated JSON file is not suitable for Lucid imports.
• -a, --anon
  • Anonymize the output data by hashing all strings.
• -o, --output
  • Specifies the filename for the generated output JSON.

Example
python3 awscliscript.py --profile preprod --regions us-east-1 us-west-1

The command above runs the script and generates data for resources in the preprod profile residing in the regions us-east-1 and us-west-1.

Use the data hub to manage AWS infrastructure data and credentials

Import accounts and create documents

To import AWS accounts and create Lucid documents, follow these steps:

1. Select the account(s) you want to import to the data hub.
2. Click Next.
3. Using the instruction detailed at the end of this section under Account configuration using a cross-account role, you can specify the regions you want to import.
4. Click Import AWS Account.

To visualize your AWS account after the import completes:

1. Return to the data hub.
2. Select Create new document.
3. Select the account you imported and click Choose accounts.
4. Review the details and add filters to exclude unnecessary resources.
5. Select Create AWS document.

The Lucidchart document will generate in the background of your Lucid account. We will notify you once it has been created via a status modal that appears in the bottom-right of the page.

You can open the document from the status modal that appears directly after creating a new document. The document (and previously created documents) will also be stored and accessible in the "Documents" section of your Lucid Home Page after you generate it.

Access imported accounts

After importing your AWS account, it will be listed as a data source with the account name you specified in the "AWS: Imported Accounts" section of the data hub. From this section you can also click + New account to import a new account to the data hub.

Accounts listed in this section are data sources that can be used to create new Lucidchart documents. Data sources (“Accounts”) contain the AWS account metadata used to create Lucidchart documents. The “Last updated” field indicates when your data source was last refreshed to account for any updates in your connected AWS account.

You can import the same AWS account more than once. Each import creates an independent data source that exists alongside any previously imported versions of that account. You don't need to delete an existing data source before re-importing the same account — both will coexist in the data hub and can be used to create documents independently.

The Cloud Inventory of each account can be seen on the right-hand side after selecting an account from the list. This inventory allows you to see a full count of each type of resource that has been imported before creating a document. You can also download a CSV with the list of resources and count directly from the data hub by clicking Download CSV.

The inventory lists all resources that can be accessed by your permissions policy attached to the cross-account role. If you elect to use “Create a new role automatically” with our CloudFormation Stack template, all resources in your account which are accessible by AWS’s ReadOnlyAccess policy will be rendered in the inventory. If you create a role manually with a custom policy, only the resource types specified in your attached permissions policy will be rendered in the inventory. 

Click the three-dot menu rendered on an account to see six potential options: Create New document, Update Account from AWS, Schedule update, Edit resources, Rename Account, and Delete account.

Create New document will start rendering the AWS infrastructure associated with the account as a diagram in a new document's workspace. The document will be generated in the background of your Lucid Home Page and we will notify you once it has been rendered through the status modal that appears in the bottom-right of the page.

Update Account from AWS and Schedule update allows you to manually or automatically update the AWS account data you have imported to the data hub to reflect any changes in the connected AWS account. New documents created from the account after the update will reflect the changes in the connected AWS account.

Edit resources allows you to edit the resources included in each dataset. Select this option to open a modal in which you can add or remove any resources from your existing datasets. When you’ve finished with the selection, click Save and update Account. This ensures the dataset refreshes and documents referencing that dataset are updated to the latest information.

Rename Account allows you to change the name of the selected dataset.

Delete Account removes the imported account from the Lucid Data Hub and any documents created from that account would lose the ability to update data from AWS. Keep in mind, deleting an account is not required to re-import it — a new import of the same account can be initiated at any time from + New account.

Share and delete saved credentials

The Saved Credentials section in "Data hub > AWS" lists the cross-account roles you can use to import your AWS accounts to the data hub. From this section, click + New Cross-account role to add a new set of credentials that can be used to import an AWS account.  

You can also share the cross-account roles you have created with other users. If you click the three-dot menu rendered on an account, you will see two potential options: Share credential and Delete credential.

Share credential opens a modal where you can share a cross-account role with another user on your Lucid account by specifying their email address. Granting them access to the credential will allow them to import the associated AWS account to the data hub and create Lucidchart documents. After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the same modal. 

Delete credential removes the cross-account role from the data hub. After deleting a credential, all accounts that were previously imported with that credential along with documents created from those accounts will lose the ability to update data from AWS.  

Security information

Cross-Account roles

Cross-Account roles are the preferred method from AWS for granting 3rd party access to your account. This method allows Lucid to securely store credentials that allow you to easily refresh a diagram. See these resources for more information:

• How to Use an External ID when Granting Access to Your AWS Resources to a Third Party
• Providing Access to AWS Accounts Owned by Third Parties

Enforced External ID

Following the best security practices provided by AWS, Lucid enforces that External IDs remain unique in Lucid's database. Therefore, Lucid provides a unique External ID to the user and disallows the user from entering in their own External ID.

Secure, limited access for IAM users

We request limited, “describe”-level permission for the IAM user you create. An IAM user created with these permissions cannot change settings in your AWS infrastructure or read data in your databases. We only use the IAM user to read the structural metadata of your AWS infrastructure. 

CLI script alternative

If you wish to review and control the actions we take during our AWS infrastructure scan, you can download and use our provided Python script instead of creating an IAM user. In this scenario, your IAM credentials will never be passed to Lucid, and you can review both the code that will run in your environment and the resulting metadata before uploading the metadata to Lucid. The imported JSON will be accessible in the Lucid Data Hub to use for creating Lucidchart documents. 

Safe storage of documents (documents)

Lucid stores the AWS imported metadata and generated documents using industry standard protections for confidential data. Imported AWS data is embedded as part of the Lucidchart document, so you can control access to the data using Lucid’s standard sharing permissions. For additional information regarding how we protect your documents, please refer to our Content Security page or contact our sales team.

No storage of access keys

Lucid will not store your AWS IAM credentials after performing the initial scan of your AWS infrastructure. Your credentials will be transferred to our servers using standard encryption methods. Clients may negotiate encryption protocols up to AES-256. We can store a Cross-Account Role that only gives us “describe and list” access to your environment.

FAQ

How does Lucid get access to our AWS environment? What level of access does Lucid have?

The recommended method from Lucid and AWS is through a Cross-Account Role. We provide a policy which gives us “describe and list” access to your environment so we can get an inventory of resources. The credentials stored in Lucid can only be accessed by your Lucid account. This import method will allow you to update data from the account with one action. The permissions policy we provide allows you to determine exactly what data the Cross-Account role will have access to request from AWS. 

If you use our IAM user method, credentials are not stored at all, but rather are used once and discarded. Generally our users use this import method along with AWS temporary credentials, as this method doesn't allow for additional data updates.

We also have a method using a python script you can run through the Command Line Interface (CLI) which generates a JSON file. After generating the JSON file, users can review the contents and remove data if desired prior to importing. Users can then upload this JSON file to Lucid and not populate any credential information into Lucid.

How do Lucid commercial and Lucid Suite for Gov interact when importing via cross-account roles?

While the functionality of the product is the same for each, AWS sets up security differently for these two environments. AWS IAM roles and resource-based policies delegate access across accounts only within a single partition. Lucid GovSuite is in a separate AWS partition, and thus can’t import AWS data via cross-account role from non-GovCloud AWS accounts. Cross-account roles, our recommended import method, only allow access to accounts of the same type—so if you are on the Lucid commercial environment you can access and import commercial AWS cloud accounts via cross-account role, and if you are on the Lucid GovSuite environment you can access and import AWS GovCloud accounts via cross-account role.

We do support the ability to import commercial AWS accounts to Lucid Suite for Gov via IAM user or a JSON created from our CLI script.

What APIs does Lucid access?

We primarily use describe and list API endpoints.

Can you choose which metadata (the fields and values shown in the Data panel) is imported? If not, what metadata is imported?

No, you can't currently choose what metadata is imported. However, we are looking to create some ability to do that in the future. All metadata from a describe API call is imported.

Give feedback on this article