AWS Account-Level Onboarding -Manual Method

Last updated: April 6, 2026

Integrating AWS using the Manual Method includes the following major steps:

  1. Configure Integration in the Matters Console

  2. Create IAM Role with Custom Trust Policy in AWS

  3. Attach IAM Policy to the Role

  4. Complete Integration by providing IAM Role ARN in Matters Console

IAM Role Configuration, Prerequisites, and Permissions Required

1. Trust Policy

Specifies the entities allowed to assume this IAM role, in this case the Matters platform AWS account.

2. IAM Role Permissions and Prerequisites needed for AWS Export and Discovery Tasks

S3 Export Permissions (Scoped)

s3:* s3-object-lambda:*

arn:aws:s3:::*optiq-*

Full access to export buckets for RDS

IAM List Permission

iam:ListGroup iam:ListRole iam:ListUser

*

List identities

RDS Export + Discovery

ec2:DescribeSecurityGroups rds:CancelExportTask rds:DescribeDBClusterSnapshotAttributes rds:DescribeDBClusterSnapshots rds:DescribeDBClusters rds:DescribeDBInstances rds:DescribeDBParameters rds:DescribeDBSnapshotAttributes rds:DescribeDBSnapshots rds:DescribeExportTasks rds:DescribeTenantDatabases rds:StartExportTask

*

Snapshot export + DB metadata discovery

DynamoDB Export + Discovery

dynamodb:DescribeContinuousBackups dynamodb:DescribeExport dynamodb:DescribeTable dynamodb:ExportTableToPointInTime dynamodb:ListTables

*

Export DynamoDB tables + metadata

EBS Discovery

ec2:DescribeVolumes

*

Discover storage volumes for RDS

Secrets Manager Scoped Access

secretsmanager:CreateSecret secretsmanager:DeleteSecret secretsmanager:DescribeSecret secretsmanager:GetSecretValue secretsmanager:PutSecretValue secretsmanager:UpdateSecret

arn:aws:secretsmanager:*:secret:events!connection/*optiq*

Manage DB connection secrets

IAM Pass Role + Assume Role Update

iam:UpdateAssumeRolePolicy iam:PassRole

arn:aws:iam:::role/RdsExport arn:aws:iam:::role/Matters arn:aws:iam::*:role/Optiq

Delegate export tasks to specific roles

S3 Discovery Global

s3:Get* s3:List*

*

Bucket and object discovery

IAM Read Permissions (Full Discovery)

iam:GetGroupPolicy iam:GetPolicy iam:GetPolicyVersion iam:GetRole iam:GetRolePolicy iam:GetUserPolicy iam:ListAttachedGroupPolicies iam:ListAttachedRolePolicies iam:ListAttachedUserPolicies iam:ListGroupPolicies iam:ListGroups iam:ListRolePolicies iam:ListRoles iam:ListUserPolicies iam:ListUsers

*

IAM entity + permission mapping

IAM Role Tagging + Identity Check

iam:CreateServiceLinkedRole iam:GetRolePolicy iam:ListRoles iam:TagRole sts:GetCallerIdentity

arn:aws:iam:::role/RdsExport arn:aws:iam:::role/Matters arn:aws:iam::*:role/Optiq

Role validation + tagging for identification

S3 Full Access Buckets (Scoped)

s3:*

arn:aws:s3:::*optiq-*

arn:aws:s3:::<Bucket to Export Audit Logs>

arn:aws:s3:::<Bucket to Export Audit Logs>/*

Store exported logs + backups

KMS Encryption Permissions

kms:CreateAlias kms:CreateGrant kms:CreateKey kms:Decrypt kms:DescribeCustomKeyStores kms:DescribeKey kms:Encrypt kms:GenerateDataKey kms:GenerateDataKeyPair kms:GenerateRandom kms:GetKeyPolicy kms:ListAliases kms:ListGrants kms:ListKeys kms:PutKeyPolicy kms:ReEncrypt* kms:ReplicateKey kms:TagResource

*

Access encrypted exports & grant temporary key permissions

CloudTrail & Logs Discovery

cloudtrail:DescribeTrails cloudtrail:GetEventSelectors logs:FilterLogEvents

*

Log discovery from CloudTrail

DAM Permissions (Monitoring)

logs:DescribeLogGroups logs:DescribeLogStreams logs:GetLogEvents s3:GetObject s3:ListBucket s3:PutObject

*

Pull log events for monitoring

Follow Below Steps for Integrating AWS on Matters Console

Step 1: Configure Integration in Matters Console

  1. Log in to the Matters Console using a Super Admin user account.

  2. Navigate to:

    Integrations → Cloud → AWS

    (URL: app.matters.ai/data-security/integrations?type=cloud)

If you are using a dedicated tenant, please replace the word ‘app’ with your tenant name in the Url

  1. Click Connect on the AWS Integration card.

  1. Enter:

  • A valid Integration Name

  • Choose Account under Access Level Scope

  • Select Manual Integration Method

  1. You may skip CloudTrail Logs for DDR now (you can click on this CloudTrail for detailed explanation on CloudTrail).

  2. Click Connect.

  1. In the next Step Copy the Trust Policy from the Matters Console and Use it for creating the IAM Role with Custom Trust Policy

Step 2: Create IAM Role with Custom Trust Policy in AWS Console

Follow these steps in the AWS Console:

  1. Log in to your AWS Management Console.

  2. In the top search bar, type IAM and select IAM (Identity and Access Management).

  3. In the left navigation panel, click Roles → Create role.

  4. Under Trusted entity type, choose Custom trust policy.

  5. Click the “Switch to custom trust policy” button.

  6. Copy and paste the following trust policy JSON from Matters Console into the editor :

  1. Click Next (no permissions need to be added at this stage).

  2. Provide a Role Name (example: Demo-Matters-Role).

You may also add an optional description.

Important: The role name should include the keyword “Matters”. This helps the platform automatically detect and validate the correct role during the integration process, ensuring a smooth and error-free setup.

  1. Click Create role. Your role with the required trust relationship is now created.

  2. On Matters Console confirm by clicking on "I’ve Created The Role With Trust Policy" to proceed.

Step 3: Attach the IAM Policy to the Role

  1. Copy the Role Policy from Matters Console

  1. ​On AWS Console, Navigate back to the IAM → Roles page.

  2. Select the role you created in Step 1.

  3. Open the Permissions tab.

  4. Click on Add inline policy.

  1. Select the JSON tab.

  2. Paste the following IAM policy JSON(You can also copy the Role Policy from the Matters Console):

  3. Click Next.

  1. Enter a name for the inline policy (example: Demo-AWS-Integration-Policy).

  2. Click Create policy.

Your IAM role is now fully configured. Copy and Save ARN from created role for further use.

​

  1. On Matters console confirm by clicking on “I’ve Created the IAM Policy.”

​

Step 4: Provide Role ARN and Complete Integration

  • Paste the ARN of the IAM Role you created in AWS and Click Save Integration.

Once the integration is successfully completed, you will see a confirmation message on the Console.