Why the connection is blocked

AWS Organizations lets the management account apply policies to every member account. Two of them can stop Topscan:

  • Resource control policies (RCPs) limit who can access resources in your account, including who can assume its IAM roles. A common RCP allows only identities from your own organization — so Topscan's account can't assume the role, even though the role's trust policy allows it.
  • Service control policies (SCPs) limit what roles in your account can do. They apply to the Topscan role after it is assumed. Common SCPs deny requests that don't come from your corporate network, restrict AWS regions, or block creating IAM roles without a permissions boundary — the last one makes the CloudFormation stack fail.

These policies can't be changed from inside the member account. Only an administrator of your AWS Organization (management account or a delegated administrator) can add an exception. Policy changes apply within a few minutes.

You will see this in Topscan as the error Your AWS Organization blocks this connection. If the CloudFormation stack itself fails in the AWS console with an access-denied error, see step 4.

What Topscan needs

Two things:

  1. Topscan's AWS account 106870842038 must be allowed to assume the role TopscanIntegrationRole in your account. The same ID is shown in the connection form (Settings → Integrations → Amazon Web Services → IAM role).
  2. The role must be allowed to make read-only API calls from Topscan's infrastructure, in every region you want covered.

Topscan never gets write access: the role has only ReadOnlyAccess (and SecurityAudit if cloud configuration checks are enabled).

Step 1 — RCP: allow Topscan to assume the role

  1. In the AWS console of the management account open AWS Organizations → Policies → Resource control policies.
  2. Review the RCPs attached to the account, its organizational units and the root.
  3. Find the statement that denies sts:AssumeRole (or sts:*) for identities outside your organization. It usually checks aws:PrincipalOrgID.
  4. Add Topscan's account ID to the statement's exception list:
"Condition": {
  "StringNotEqualsIfExists": {
    "aws:PrincipalOrgID": "o-xxxxxxxxxx",
    "aws:PrincipalAccount": ["106870842038"]
  },
  "BoolIfExists": { "aws:PrincipalIsAWSService": "false" }
}

If the statement already lists third-party accounts, add ours to the same list. If your RCP uses a resource tag as an exception (for example aws:ResourceTag/dp:exclude:identity), tag the role TopscanIntegrationRole with that tag instead.

Step 2 — SCP: let the role work from outside your network

  1. Open AWS Organizations → Policies → Service control policies.
  2. Find statements that deny requests not coming from your corporate IP ranges or VPCs — they use aws:SourceIp, aws:SourceVpc or aws:SourceVpce.
  3. Topscan calls AWS from its own infrastructure, so exempt the role in those statements:
"ArnNotLikeIfExists": {
  "aws:PrincipalArn": ["arn:aws:iam::*:role/TopscanIntegrationRole"]
}

If the policy uses a principal tag as an exception (for example aws:PrincipalTag/dp:exclude:network), tag the role with that tag instead.

Step 3 — SCP: regions

If an SCP allows only certain regions (aws:RequestedRegion), Topscan can read resources only there. Either add the same role exemption to that statement, or accept that resources in other regions stay invisible to Topscan.

Step 4 — SCP: role creation

If the CloudFormation stack fails with an access-denied error on iam:CreateRole or iam:AttachRolePolicy, your SCP restricts who can create roles or requires a permissions boundary on new roles. Options:

  • Ask an organization administrator to launch the stack.
  • Pass your boundary in the Permissions boundary ARN parameter of the stack.
  • Create the role manually with the boundary attached — see the step-by-step instructions in the connection form.

Step 5 — Verify in Topscan

Go back to Topscan and press Try again in the connection form. For cloud configuration checks press Verify permissions on the account page. Once the exception is in place, the connection completes and the first sync starts.

What's next