Connect a cloud
Connect a cloud opens a chooser: AWS, Azure, or Google Cloud. Every provider connects the same way in principle — a scoped, read-only identity you create in your own account — and SolveGRC never stores long-lived keys or makes changes to your environment.
What read-only means here
The connection can look, not touch. On AWS, SolveGRC assumes a read-only role you create, via STS with a secret External ID — no access keys are ever stored. On Azure and GCP you paste a credential once, and it is stored encrypted in a vault, never in a plaintext column. Access on every provider is limited to security findings and resource inventory.
AWS: the guided wizard
The AWS wizard is three steps and takes about two minutes:
- Basics. Name the connection, enter your 12-digit account ID, and pick a region. Security Hub is regional, so pick the region whose findings you want.
- Create the read-only role. Click Launch AWS Stack. It opens CloudFormation in your own console with everything pre-filled; you tick the IAM acknowledgment and create the stack. When the stack completes (about a minute), it reports back and the dialog finishes itself — nothing to copy. A manual CloudShell script is available if you prefer the CLI; it attaches the AWS-managed SecurityAudit read-only policy.
- Paste the ARN — only if the automatic callback did not arrive. The role ARN is in your stack's Outputs tab.
The wizard states the consequence before you commit: the connection is read-only and syncs every 6 hours — findings, assets, and attack paths update automatically.
You need permission to create IAM roles, and Security Hub must be enabled in the chosen region with a standard turned on (CIS or FSBP), or there will be no findings to pull. Enabling AWS Resource Explorer is recommended so the full systems inventory syncs; without it, only tagged resources are inventoried.
Azure: Defender for Cloud
Create an Azure AD app registration and grant it the Security Reader role on the subscription (for findings) plus the Reader role (for the systems inventory — Security Reader alone cannot list resources). The dialog asks for the subscription, tenant, and client IDs and the client secret; the secret is stored encrypted, and SolveGRC reads Defender for Cloud assessments and Resource Graph inventory through the native Azure APIs.
An Azure connection also unlocks an Entra ID assessment: from the connection's detail view you can run identity-configuration checks through the same credentials, no separate connection required.
Google Cloud: Security Command Center
Create a service account with the Security Center Findings Viewer role (for findings) plus Cloud Asset Viewer (for the systems inventory), then paste its JSON key. The key is stored encrypted, and SolveGRC reads Security Command Center findings and Cloud Asset Inventory through the native Google APIs. The connection can be scoped to an organization or a single project.
No live access? Import a scan
The chooser also offers Import findings for teams that cannot connect live yet. Paste or upload a scan export — Prowler (native or OCSF), AWS Security Hub (ASFF), ScoutSuite, or a simple normalized JSON format — and the formats are auto-detected. Imported findings enter the same table and the same mapping flow as live ones.
What the first sync brings
The first scan lands within minutes of connecting. Each connection card then shows its last sync time, asset count, open findings, and control-mapping coverage, and re-syncs every 6 hours from there. A Sync now button on the connection's detail view forces a fresh pull on demand.
Expect three kinds of arrivals: findings (with severity, the failing resource, and remediation guidance), discovered assets (deduplicated into a living inventory), and — from the same data — topology diagrams and attack paths in the Network Diagrams module.
Once findings are flowing, the work is turning them into assurance. Continue to Findings to frameworks.