Connect your account

praxis only assumes a read-only role in your account. It never asks for access keys, and the app has no field for entering credentials. Both paths create the same role, PraxisAuditRole, with the SecurityAudit managed policy and a trust policy that requires your organization's external ID.

Before you start

  1. Sign up at app.meetpraxis.io. The 14-day trial starts at sign-up.
  2. Open Connect. The page shows your external ID in a read-only field. praxis generated it for your organization; the template, quick-create link and Terraform snippet on that page already contain it.

Path 1: CloudFormation template

  1. On the Connect page, use the quick-create link, or download praxis-role.yaml (it has your external ID filled in).
  2. Deploy the stack in the account you want checked, in any region (IAM is global).
  3. Copy the stack output RoleArn.

Path 2: Terraform module

The module is open source: meetpraxis/praxis-role/aws on the Terraform Registry. Your Connect page shows a snippet with your external ID.

module "praxis_role" {
  source      = "meetpraxis/praxis-role/aws"
  external_id = "<your external ID, shown on the Connect page>"
}

Finish in praxis

  1. Paste the role ARN (arn:aws:iam::<12 digits>:role/PraxisAuditRole) and pick the regions to check.
  2. praxis verifies the role and runs the first check. A failed verification shows the reason and the fix step; it never shows an empty result as if it were healthy.

Revoking access

Delete the stack (or the Terraform resource). The next run marks the connection unhealthy and keeps the last stored findings visible as stale, with the time they were evaluated.