Scan Source

AWS S3 Integration

Find credential patterns in supported, readable objects from connected S3 buckets.

Connect AWS S3 View Setup Guide

Key Features

CloudFormation, manual IAM role and IaC setup paths
Reads supported current object content, not only object names
Records findings by object location and tracks skipped or unreadable objects
SSE-KMS objects require the relevant KMS decrypt permission

Requirements

1Cremit Platform account and permission to connect an AWS scan source
2An AWS IAM role with the required S3 list and object-read permissions
3KMS decrypt permission for any customer-managed KMS keys in scope

Step-by-step setup guide

Review the steps needed to configure this integration.

What the connection scans

The S3 source lists current objects in connected buckets and retrieves supported, readable object content for credential detection. A finding records an object location for investigation. It is not a complete inventory of IAM identities or every service that can access the bucket.

Choose a setup path

In Configuration → Scan Sources, create an AWS S3 source. The current product offers CloudFormation, manual IAM role and IaC setup paths. Review the generated trust policy and requested permissions in the product and AWS console before granting access; follow the current in-product steps rather than an old screenshot or copied policy.

The role uses S3 list and object-read operations. Objects encrypted with a customer-managed KMS key also need permission to decrypt with that key. The scanner retrieves object content for analysis; do not treat read-only IAM access as a promise that object bytes remain in your AWS account. Review your organization’s data-handling requirements before connecting a bucket.

Verify coverage after connection

Check that the source can list the intended bucket and read a supported test object. Review connection errors, KMS failures and objects skipped for access, storage-class, format, size or run-limit reasons. The current scan enumerates current objects, not earlier versions in a versioned bucket. A run with no findings does not prove that every object was checked.

Investigate a finding

Use the object location to review who could read it. For supported credential types, check issuer validity; use supported AWS or GCP permission analysis separately where relevant. Assign a responder to replace or revoke an exposed key at its issuer and review retained copies and available logs.