Targets

A target is an AWS account CloudCerta is authorized to read. This is where you add one, connect it through a read-only cross-account role, run scans against it, and browse everything the scan discovered.

For the full step-by-step of connecting an account, see Connect your AWS account. This page covers the Targets area as a whole.

What’s on the page

• List: account name and id, and a status pill (Verified, Failed, or another muted state). Adding a target is available to Owner and Admin.
• Target detail:name, account id, status; once verified, a “What we can read” card lists the exact services and regions proven accessible, with the caption “A scan can only report on what is covered here”; links to connect/reconnect, view inventory, and view findings; a scan runner (if you can run scans) or an explanation of who can; and a scan history list showing each run’s outcome and counts.
• Connect wizard: a two-step flow — generate connection details (External ID, CloudCerta account id, trust policy, permission policy), then paste a role ARN to validate the connection.
• Resource inventory:a region-by-service tree; each service shows a resource count, and a service without registered checks is tagged “not yet assessed.” Expanding a service lazily loads its resources with pagination.

What you can do

Add a target

Owner or Admin only — a stricter gate than running a scan.

Connect / verify

Owner or Admin only. Nothing in your AWS account changes until you create the IAM role yourself; validating performs a read-only role assumption to confirm access.

Run a scan

Owner, Admin or Engineer, and only against a verified target. The button polls for progress for up to about two minutes before telling you to check back later.

Browse inventory

Read-only, available to anyone who can view the target.

How to read it

• Coverage is proven, not assumed. The services/regions shown as readable come only from the verification step itself — a scan can never discover more than verification already proved it could reach.
• A failed validation isn’t an error page.A typo’d role ARN or a missing policy shows a plain, specific “Failed” result explaining what to fix — see the troubleshooting table in Connect your AWS account.
• Scan status is never overstated. Only a scan that finished cleanly counts as succeeded; a failed or cancelled scan is always shown as a failure, never folded into a passing result.
• Discovered isn’t the same as assessed.The inventory can show a service CloudCerta has found resources for but doesn’t yet run checks against — it’s tagged “not yet assessed” rather than implied to be clean.
• A target id that doesn’t exist and one that belongs to another organisation return the identical “This target does not exist, or you do not have access to it” message, so neither case reveals whether the target is real.

Before your first scan

• No targets yet:“No targets yet — Add an AWS account to connect and scan it,” with the Add button available to Owner/Admin above the empty card.
• Target added but not verified:the “What we can read” card doesn’t appear at all until verification succeeds.
• Verified but never scanned:scan history shows “No scans yet.”
• Inventory with nothing collected yet:“No resources collected yet. Run a scan from the target page” — the tree itself doesn’t render.