Vigilare + Terraform: Infrastructure-as-Code Setup Walkthrough

Vigilare connects to your AWS account through a read-only IAM role — no agents, no compute resources, no changes to your existing infrastructure. The recommended way to deploy this role is with Terraform, so your Vigilare integration is versioned, repeatable, and manageable alongside the rest of your infrastructure code.

Here's the complete walkthrough.

Prerequisites

• Terraform v1.0+ installed
• AWS credentials configured (CLI profile, environment variables, or IAM role)
• A Vigilare account (sign up at vigilare.io — the external ID is generated during signup)

Step 1: Add the Vigilare Module

In your Terraform configuration directory, create a new file or add to an existing one:

module "vigilare" {
  source  = "vigilare/monitor/aws"
  version = "~> 2.0"

  external_id = var.vigilare_external_id
}

variable "vigilare_external_id" {
  description = "External ID from Vigilare dashboard for cross-account role assumption"
  type        = string
  sensitive   = true
}

The module creates two resources: an IAM role with a trust policy that allows Vigilare's AWS account to assume it (using the external ID for security), and an IAM policy that grants read-only access to the AWS services Vigilare monitors (CloudTrail, GuardDuty, Config, Cost Explorer, SES, Service Quotas, Health).

Step 2: Store the External ID Securely

The external ID is a secret that prevents confused deputy attacks. Don't hardcode it in your Terraform files. Use one of these approaches:

Terraform variables file (gitignored):

# terraform.tfvars (add to .gitignore)
vigilare_external_id = "your-external-id-from-dashboard"

Environment variable:

export TF_VAR_vigilare_external_id="your-external-id-from-dashboard"
terraform apply

AWS Secrets Manager or SSM Parameter Store: For production environments, store the external ID in Secrets Manager and reference it via a data source.

Step 3: Review and Apply

terraform init    # Download the module
terraform plan    # Review what will be created
terraform apply   # Create the IAM role and policy

Review the plan output carefully. You should see exactly two resources being created: aws_iam_role.vigilare and aws_iam_policy.vigilare_readonly. No EC2 instances, no Lambda functions, no compute resources of any kind.

Step 4: Verify in Vigilare

After terraform apply completes, go back to the Vigilare dashboard. Click "Verify Connection" on the account you're adding. Vigilare will attempt to assume the newly created role. If successful, the initial scan begins immediately — you'll see your risk score and first findings within 2-3 minutes.

What the Module Creates

For full transparency, here's what the Terraform module deploys:

IAM Role: A role named VigilareMonitorRole with a trust policy that allows Vigilare's AWS account to assume it. The trust policy requires the external ID, which prevents any other AWS account from assuming the role even if they know the role ARN.

IAM Policy: A policy attached to the role with read-only permissions for specific services. The policy includes guardduty:Get*, guardduty:List* for security findings; config:Describe*, config:Get* for compliance data; ce:GetCostAndUsage, ce:GetCostForecast for billing; ses:GetAccountSendingEnabled, ses:GetSendQuota for SES reputation; servicequotas:Get*, servicequotas:List* for quota monitoring; health:Describe* for account health events; and iam:Get*, iam:List* for IAM configuration analysis.

The policy does not include any write permissions. Vigilare cannot modify, create, or delete any resources in your account.

Multi-Account Deployment

If you manage multiple AWS accounts, deploy the module in each account. Use Terraform workspaces or separate state files per account:

# For each account
module "vigilare" {
  source  = "vigilare/monitor/aws"
  version = "~> 2.0"

  providers = {
    aws = aws.production  # or aws.staging, aws.client_acme
  }

  external_id = var.vigilare_external_id
}

Each account appears as a separate entry in your Vigilare dashboard with its own risk score, findings, and billing data.

Updating and Removing

Updating: When Vigilare releases a new module version (to support new monitoring capabilities), update the version constraint and run terraform apply. The role ARN stays the same — no reconfiguration needed in the Vigilare dashboard.

Removing: Run terraform destroy targeting the module. This deletes the IAM role and policy. Vigilare will detect the disconnection and mark the account as disconnected in your dashboard.

Related Reading

• Getting started with Vigilare
• Terraform module documentation
• Vigilare API reference
• Vigilare vs AWS-native tools