Skip to main content

Project Settings

Project Settings currently has five tabs: General, AWS Connection, Scheduled Runs, Project Members and Data Location.

This document covers the AWS Connection, General and Scheduled Runs tabs, and the Run History screen that collects every run record.

Project Settings is organized into the following areas:

  • General – Manage basic project information, mute notifications for this project, and the AWS account owner, team and IAM analysis primary flag
  • AWS Connection – Configure AWS account integration
  • Scheduled Runs – Schedule sync, assessment and IAM analysis to run repeatedly on a set interval
  • Project Members – Manage project users
  • Data Location – the data location report for this connection (see Data Location)

Notifications are not a separate tab: muting lives inside the General tab. Notification channels and categories are managed on the Notifications page of the organization portal.

This document focuses on the AWS Connection setup process.

1. AWS Connection Overview​

AWS Connection is the process of securely linking your AWS account to the RMF service.

  • The connection must be complete before Asset Synchronization can expand its scan scope using Resource Explorer.
  • The integration process does not require you to directly share AWS credentials (Access Key / Secret).

2. Prerequisite: Enable Resource Explorer​

Before proceeding with AWS Connection, you must first enable Resource Explorer in your AWS account.

Resource Explorer is an AWS service that allows unified cross-region search of resources within your account. Security Hero RMF relies on this service to discover assets, so synchronization will not work properly if it is not enabled.

How to Enable​

  1. Sign in to the AWS Console.
  2. Navigate to the Resource Explorer service.
  3. If Resource Explorer is not yet enabled, click the Turn on Resource Explorer button.

Resource Explorer setup

  1. Select Quick setup or your preferred option and complete the activation.
  2. Note the region where the Aggregator index is created (typically the current region).
Note

It may take several minutes for indexing to complete after enabling Resource Explorer. Some resources may not appear in search results immediately, so wait a moment before proceeding with AWS Connection.

For more details, refer to the AWS Resource Explorer official blog post.

3. Connection Process (3 Steps)​

3.1. Enter Your AWS Account ID​

AWS Connection screenshot

Enter your AWS Account ID.

  • The Account ID is used to identify your AWS account and confirm the integration target.
  • The goal is to connect your account to Security Hero RMF without sharing credentials.

3.2. Create a CloudFormation Stack​

CloudFormation stack screenshot

After entering your Account ID, create the integration IAM Role in your AWS Console.

  • Use the CloudFormation template provided by the service to create the stack
  • The stack creation process sets up the IAM Role and permissions required for RMF integration
  • This standardizes the integration process and reduces the chance of missing configurations compared to manual setup

3.3. Verify Connection Status​

AWS Connection status

Once the stack is successfully created, the connection between your AWS account and the RMF service is complete.

  • A successful connection enables expanded asset scanning in future synchronization jobs
  • Connection status can be verified on the AWS Connection screen

4. Operational Tips​

  • After connecting, adjust Sync Scope to selectively scan only the services and resources you need
  • When modifying the CloudFormation Stack, always check whether the changes affect IAM Role permissions

5. The General tab​

Besides the project name, description and notification settings, the General tab has an AWS account ownership section. It is shown for Standard plan connections as well, and contains the fields below. For organization behaviour, see Organization.

AWS account ownership section on the General tab

  • Owner / Team – free-text fields naming who is responsible for this account. A connection created through organization discovery starts with these filled from the account's AWS tags (Owner/Team), and you can edit them at any time afterward. These values also become the default assignee for new risk findings raised against that account.
  • IAM analysis primary (IAM analysis primary for this account) – shows whether this connection is the one IAM permission analysis runs on, when the same AWS account has more than one connection (one per region). Exactly one connection per account can hold this flag; turning it on for another connection automatically turns it off on the current holder. Turning it off directly is only allowed when another connection for the same account already holds it — an account can never be left with no primary connection. See the primary connection section of the Organization document for details.

The connection kind (management or member account) is not on the General tab; it is shown as a badge (e.g. Member account) next to the connection status on the AWS Connection tab.

6. The Scheduled Runs tab​

The Scheduled Runs tab lets you have one connection run sync, assessment (scan), IAM analysis, and so on automatically, on a recurring interval. Use Add a schedule to add one.

Scheduled Runs tab

  • What runs – pick what the schedule fires (sync, assessment, IAM analysis, and so on).
  • How often – choose Daily, Weekly, Monthly or Quarterly, or write your own cron expression. The start time is read in the timezone you set; left unset, a run starts at 02:00.
  • On/off – turning a schedule off keeps its settings but stops it firing. Deleting it removes the schedule itself, but runs it already produced stay in the Run History.
  • Only when a critical-function asset is present – if this connection has no asset labelled as carrying a critical function, that firing is skipped rather than run. A skipped firing is still recorded, with its reason.

Whether a run was scheduled or started by hand (like clicking + New Scan), every result shows up in the connection's Run History, along with what triggered it (manual, schedule, or API). See 7. Run History for details.

7. Run History​

Run History is a screen in the Risk Management group of the left menu. It records every scan, sync and IAM analysis run on this connection in one place, whoever started it (by hand, on a schedule or through the API). The follow-up computation steps that the platform queues on its own right after a scan are recorded here too. It is also the record that shows an auditor "what ran, when, and whether it actually did anything."

7.1. Run now​

Pick Compliance scan, Resource sync or IAM analysis in the selector at the top right and click Run now to queue it. Once queued, a <kind> queued notification appears. If nothing was run and only a record was kept, a <kind> was not started notification appears along with the reason (see the skip reasons table below).

Read-only users (Viewers) and auditors cannot use Run now.

7.2. List and filters​

Use the filters above the list to narrow it down.

  • Kind of run – Everything (all), Compliance scan, Resource sync, IAM analysis, Exposure paths (the follow-up computation step that runs automatically right after a scan)
  • Outcome – Any outcome (all), Queued, Running, Succeeded, Failed, Timed out, Skipped
  • Refresh – reloads the list.
ColumnContent
What ranThe kind of run and the start of its run ID
Asked for byWho started it — By hand, Schedule or API
OutcomeCurrent state. For Skipped, the skip reason is shown next to it; for a failure, the error code.
Due atWhen a scheduled run was originally due
RecordedWhen the run was recorded
Last changeWhen its state last changed
ResultLink to the result — Assessment (risk assessment results) for a scan, Sync jobs for a sync, Analysis for an IAM analysis

The list shows 25 per page; use Newer / Older to page through. If there are no records, No runs recorded yet. Start one above, or set up a schedule in project settings. is shown.

Skip reasons​

Skipped is not a failure: it means the run was not performed and only its reason was recorded.

Shown asMeaning
No scans left on this planThe plan's assessment (scan) allowance is used up (see Subscription)
Storage is not connected yetThe customer-owned storage (S3/KMS) connection is not finished (see Data Security)
Held back by the run budgetHeld back by the run limit
The schedule is turned offThe schedule is off
The connection is goneThe connection has been deleted
A run of this kind was already goingA run of the same kind was already in progress
Another connection already covers this AWS account for account-level analysisAnother connection for the same AWS account is the IAM analysis primary (see the primary connection in Organization)

7.3. Run detail​

Click a row to open a detail panel on the right.

  • The state, Asked for by, Requested by (the requesting user), From schedule (the schedule number, for a scheduled run), Due at, Recorded, Started, Finished, Took (duration), and a link to the result
  • Tool – the name, version, number of checks and number of frameworks of the tool used (when recorded)
  • What this run measured – the numbers the run left behind (for example, resources scanned, new problems, problems gone, problems that came back)
  • How it got here – the sequence of state changes. Each step shows its time, plus partial results if only partial results were kept, scanner changed if the scanner changed, and the error message if there was one. The short hash under each step is the value used for the integrity check below.

7.4. Checking the record (Check the record)​

Run records are stored as a hash chain, where each state change carries forward the hash of the record before it. Clicking Check the record re-verifies this connection's entire record and shows the result at the top of the screen.

  • All N recorded state changes are intact. – the record is unchanged.
  • The record does not verify after checking N state changes. – the record does not verify. The number of the entry where the chain first breaks is shown with it.
  • If there are no records yet, No runs recorded for this connection yet. There is nothing to check. is shown.

The same verification result is also included in the Evidence Package as ledger-verify.json.