FEATURES / IAM Role Onboarding
/// IAM Role Onboarding
Connect AWS without ever pasting a key.
Onboard AWS S3 by assuming an IAM Role instead of handing over long-lived access keys. A one-click CloudFormation stack, a per-connection ExternalId, and a two-hop STS chain for temporary credentials — Storafleet stores no long-lived keys.
Start for free/// How it works
Launch the CloudFormation stack
Click to open a CloudFormation quick-create stack in your AWS account. It creates an IAM Role that trusts Storafleet, scoped by a per-connection ExternalId — no manual trust-policy JSON.
Storafleet probes the trust
Before saving, Storafleet runs verification probes: AssumeRole without the ExternalId must fail and with it must succeed. The connection is only accepted once the trust policy is proven correct.
Browse with temporary credentials
From then on, every request uses a two-hop STS AssumeRole chain to mint temporary credentials on the fly. No long-lived keys are stored — and revoking access is as simple as deleting the role.
No long-lived keys stored
Connect AWS S3 by assuming an IAM Role — Storafleet never stores long-lived access keys for role-based connections. There's no static secret in our database to leak, rotate, or audit.
One-click CloudFormation setup
Onboarding is a CloudFormation quick-create stack. One click in your AWS account provisions a role that trusts Storafleet — no hand-crafting JSON trust policies or copying ARNs between tabs.
Per-connection ExternalId
Every connection is scoped by a unique ExternalId baked into the trust policy. This defends against the confused-deputy problem — another tenant's role can never be assumed on your behalf.
Temporary credentials per request
Storafleet uses a two-hop STS AssumeRole chain to obtain short-lived temporary credentials for each request. Credentials expire on their own — nothing long-lived is ever persisted.
Trust verified before saving
Before a connection is saved, Storafleet runs probes: AssumeRole without your ExternalId must fail, and AssumeRole with it must succeed. The connection is only accepted once the trust policy is proven correct.
Cross-account S3 in one workspace
Assume roles in multiple AWS accounts from a single Storafleet workspace. Manage buckets across separate accounts side by side, each scoped by its own role and ExternalId.
/// Without Storafleet
Connecting AWS means generating a long-lived access key, pasting it into a third-party tool, and trusting that it's stored safely and never leaks. Rotating it later means hunting down every place it was used.
- Long-lived access keys are generated and pasted into an external tool — a standing secret that can leak
- The trust relationship is implicit: whoever holds the key has the access, with no per-connection guardrail
- Rotating a key means re-entering it everywhere it was ever used
- Revoking access means tracking down and deleting the right key, hoping no copy survives
- No built-in check that the credential is scoped correctly before it's saved
/// With Storafleet
A CloudFormation stack creates a role that trusts Storafleet, scoped by an ExternalId. No long-lived key leaves your account, credentials are temporary, and revoking access is one delete.
- A CloudFormation quick-create stack provisions a role that trusts Storafleet — no long-lived key is stored
- A per-connection ExternalId scopes the trust and defends against the confused-deputy problem
- A two-hop STS AssumeRole chain mints temporary credentials per request — nothing long-lived persists
- Revoke access by deleting the role; no key to chase, no shared secret left behind
- Probes verify the trust before saving: AssumeRole without the ExternalId must fail, with it must succeed
/// When you'll use this
Connecting S3 where long-lived keys are banned
Your security policy forbids long-lived IAM access keys leaving the account — full stop. Pasting an access key into a third-party tool is a non-starter. With Storafleet you launch a CloudFormation stack instead: it creates a role that trusts Storafleet, scoped by an ExternalId. No static credential ever leaves your account, and there's nothing in Storafleet's database to leak.
Key featureKeyless onboarding via assumed IAM Role
Rotating credentials without re-entering them anywhere
Key-based integrations mean a rotation event turns into a scavenger hunt for every place the old key was pasted. With a role-based connection there's no key to rotate — Storafleet assumes the role and gets fresh temporary credentials on every request via STS. Rotation is automatic and you never re-enter anything.
Key featureTwo-hop STS AssumeRole for temporary credentials
Managing a cross-account S3 estate
Your buckets are spread across a dozen AWS accounts — prod, staging, data-lake, per-team. You launch the stack in each account, and Storafleet assumes the right role per account, each scoped by its own ExternalId. When a team offboards, you revoke access by deleting their role — no key wrangling, no shared secret to chase down.
Key featureCross-account roles, revoke by deleting the role
Your storage estate deserves a control plane.
Join the DevOps teams and founders who run every cloud's buckets from one control plane.
Free plan · No credit card · 50+ cloud providers · Cancel any time