Skip to main content

Manual setup — single AWS account

Use this path if CloudShell, CloudFormation, and Terraform aren't viable in your environment. Those automated options are faster and less error-prone — the wizard generates a ready-to-run script/template for each.

What you'll create​

Everything is created in your own AWS account — Rivia has no AWS presence of its own, so nothing here trusts a Rivia-side principal. You create:

  • An IAM user named rivia-connector with a long-lived access key. This is the identity Rivia uses.
  • An IAM role named RiviaAccess-Role that trusts that user (same account), gated by a per-connection External ID.
  • Read policies on the role: the AWS-managed ViewOnlyAccess and SecurityAudit, plus one small Rivia inline policy.

At the end you paste three values back into the Rivia wizard: the Role ARN, the connector user's access key ID, and its secret access key. Rivia stores the key encrypted and assumes the role with it.

1. Copy the External ID​

Open the Rivia wizard and keep it open. It displays an External ID generated specifically for this connection — something like rivia-ab12cd34ef56…. Copy it; you'll use it in the role's trust policy.

2. Create the connector user​

In the AWS console go to IAM → Users → Create user. Name it rivia-connector. Don't attach any policies to the user itself. After it's created, open the user's Security credentials tab and Create access key (use case: Application running outside AWS). Copy the Access key ID and Secret access key — the secret is shown only once.

3. Create the role​

Go to IAM → Roles → Create role. Choose Custom trust policy and paste the JSON below, substituting your 12-digit account ID and the External ID from step 1 (the Rivia wizard's Manual tab renders this with your values already filled in — copy it from there):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:user/rivia-connector" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "<external-id>" } }
    }
  ]
}

4. Attach the read policies​

During role creation, attach both AWS-managed policies:

  • ViewOnlyAccess (arn:aws:iam::aws:policy/job-function/ViewOnlyAccess)
  • SecurityAudit (arn:aws:iam::aws:policy/SecurityAudit)

Then add one inline policy named RiviaSupplementalRead with the document shown on the wizard's Manual tab (cost/usage, organizations, optimizer/advisor, and log-bucket reads the managed policies don't cover).

5. Name the role and finish​

Name the role RiviaAccess-Role to match the automated paths, and create it.

6. Paste the three values back into Rivia​

In the Rivia wizard, fill in:

  • Rivia Role ARN — the role's full ARN (arn:aws:iam::<account>:role/RiviaAccess-Role).
  • Connector access key ID — from step 2.
  • Connector secret access key — from step 2.

Click Continue and finish. Rivia immediately verifies by assuming the role with the connector key — if the trust policy and External ID are correct, the connection moves to Verified and data sync starts running.

Troubleshooting​

  • "The role trust policy is missing the ExternalId condition" — your trust policy allows the connector user to assume the role without the External ID. Add the StringEquals condition for sts:ExternalId as shown in step 3.
  • AccessDenied on verify — the External ID doesn't match, the principal ARN in the trust policy is wrong (must be the rivia-connector user in the same account as the role), or the access key you pasted doesn't belong to that user.
  • Role shows Verified but data sync is thin — a read policy is missing. Re-check step 4 (both managed policies plus the inline policy).