Skip to content

Update the IAM Role

Each version of the unusd.cloud IAM Role grants read access to more AWS services. If your role is behind, the detections that need those permissions cannot run, and the matching findings never appear in your reports — they are not reported as clean, they are simply never looked at.

Updating takes about two minutes. The role stays read-only, and scanning keeps running throughout.

Update the stack in place — do not delete it. Deleting the stack removes the role, which stops scanning for this account until you redeploy. CloudFormation updates the role in place without replacing it, so there is no window where unusd.cloud loses access.

Pick your deployment method

The current template version is 1.4, always published at:

https://unusd-cloud-saas-prod-artifacts-spoke.s3.eu-west-1.amazonaws.com/spoke-role.yml

CloudFormation, single account

Option 1: AWS CLI (fastest)

One command, run against the AWS account you want to update:

aws cloudformation update-stack \
    --stack-name unusd-cloud-saas-spoke-role \
    --template-url https://unusd-cloud-saas-prod-artifacts-spoke.s3.eu-west-1.amazonaws.com/spoke-role.yml \
    --parameters ParameterKey=ExternalID,UsePreviousValue=true \
    --capabilities CAPABILITY_NAMED_IAM

UsePreviousValue=true reuses the External ID already stored in the stack, so there is nothing to look up.

If the stack name above does not match yours, find it with:

aws cloudformation describe-stacks \
    --query "Stacks[?contains(StackName, 'spoke-role')].StackName" \
    --output text

Add --region <region> to both commands if the stack was not created in your default region. IAM is global, so the role exists everywhere regardless of which region holds the stack.

Option 2: AWS Console

  1. Open the CloudFormation console and select your unusd.cloud spoke role stack.
  2. Choose Update.
  3. Select Replace existing template, then Amazon S3 URL, and paste the template URL above.
  4. Choose Next through the remaining pages, leaving all parameters unchanged.
  5. Choose Update stack.

CloudFormation shows you a change set before applying: expect modifications to the role's policies and tags, and no resource replacement.

The Deploy button in the dashboard creates a new stack, so it cannot be used to update an existing one. If you click it with a stack already deployed, CloudFormation returns AlreadyExistsException. Use one of the two options above instead.

CloudFormation StackSets

Update the stack set; CloudFormation then rolls the new template out to every stack instance:

aws cloudformation update-stack-set \
    --stack-set-name unusd-cloud-spoke-role \
    --template-url https://unusd-cloud-saas-prod-artifacts-spoke.s3.eu-west-1.amazonaws.com/spoke-role.yml \
    --parameters ParameterKey=ExternalID,UsePreviousValue=true \
    --capabilities CAPABILITY_NAMED_IAM \
    --operation-preferences FailureToleranceCount=5,MaxConcurrentCount=5

Track the rollout and confirm every instance reached CURRENT:

aws cloudformation list-stack-instances \
    --stack-set-name unusd-cloud-spoke-role \
    --query "Summaries[].[Account,Status,StackInstanceStatus.DetailedStatus]" \
    --output table

See the Multi-Account Deployment guide if you have not set up a stack set yet.

Terraform

  1. In the dashboard, open the deployment modal for the account and select the Terraform tab. It always renders the current module.
  2. Replace your existing .tf file with the new contents.
  3. Apply it:
terraform plan
terraform apply

The plan should show an in-place update to aws_iam_role.unusd_cloud_spoke_role and its policies, never a destroy-and-recreate.

Terraform deployments do not send a CloudFormation deployment callback, so the dashboard learns your new version from the role's Version tag during the next scan. The version shown may lag by one scan cycle.

Confirm the update worked

In the dashboard, the Accounts page shows the IAM Role status for each account. It should read Up to date.

To check directly in AWS:

aws iam list-role-tags \
    --role-name unusd-cloud-spoke-role \
    --query "Tags[?Key=='Version'].Value" \
    --output text

This should print 1.4.

What each version unlocks

Version Released New detections it unlocks
1.4 Aug 2026 CloudWatch Logs Intelligent-Tiering, Infrequent Access log class
1.3 Apr 2026 AWS Cost Optimization Hub recommendations, cost efficiency score
1.2 Feb 2026 DynamoDB unused tables and GSIs, Lambda unused functions / Arm migration / memory right-sizing, EFS unused file systems and Intelligent-Tiering, Kinesis unused streams, CloudFront missing compression, Step Functions Standard-to-Express, OpenSearch idle domains and extended support
1.1 Feb 2026 Savings Plans and Reserved Instance recommendations, ECR unused images, idle KMS keys, Glue interactive sessions, CloudWatch custom metrics
1.0 Dec 2025 Transfer Family idle servers, Route53 unused hosted zones, CloudWatch log group retention
0.9 May 2025 QuickSight inactive users
0.8 Apr 2025 CloudTrail duplicate trails

Why 1.2 matters most

Version 1.2 replaced a hand-maintained list of IAM actions with the AWS managed policy SecurityAudit as a baseline. Before 1.2 the role had no read access at all to DynamoDB, Lambda, EFS, Kinesis, CloudFront, Step Functions or the OpenSearch describe APIs.

If your report shows a "blind spot" notice at the top, this is why. A single stack update closes the gap, and the role stays read-only. See Security for the full permission list.

Troubleshooting

AlreadyExistsException — you used the dashboard Deploy button, which only creates stacks. Update the existing stack instead, using either option above.

No updates are to be performed — the stack already matches the published template. Your role is current; if the dashboard still says otherwise, run a scan to refresh it.

Scans stopped after an update — this should not happen with an in-place update. If you previously deleted and recreated the stack, the account may have been left disabled; check the toggle on the Accounts page or contact support@unusd.cloud.

Keep on chasing 🧡