AWS Connection

Overview

SnoozeDB connects to your AWS account using the standard IAM Cross-Account mechanism. You never share your access keys: a dedicated IAM role is created in your account via CloudFormation.

SnoozeDB assumes the role with AWS STS for each operation. Credentials are temporary and expire automatically. SnoozeDB does not store AWS access keys.

Your AWS AccountIAM Roleleast privilege

Secure authentication

Temporary access

SnoozeDBUses access toAWS control plane

Expected result

After verification and a successful sync, the AWS account appears as connected and SnoozeDB lists resources from the enabled regions and permission modules. No scheduling action is applied until you triage a resource and assign a schedule.

1-click deployment

SnoozeDB generates a CloudFormation template from the modules selected for this AWS account. Deploy it in AWS, then update the stack whenever those selections change.

What the template creates

A dedicated IAM role with strictly limited permissions
A policy containing mandatory RDS scheduling actions and only the optional read actions you selected

IAM Permissions

RDS Management is mandatory and cannot be disabled. Every other module is optional for each connected AWS account.

IAM Action	Purpose
rds:DescribeDBInstances	Mandatory RDS inventory and scheduling
rds:DescribeDBSnapshots	Optional snapshot inventory
rds:DescribeReservedDBInstances / ec2:DescribeReservedInstances	Optional RDS and EC2 Reserved Instance inventory
ce:GetSavingsPlansCoverage	Optional aggregate Savings Plans coverage
rds:ListTagsForResource	Read tags to apply exclusion rules
ec2:DescribeInstances / ec2:DescribeVolumes / ec2:DescribeImages / ec2:DescribeSnapshots	Optional EC2 scheduling and recommendation inventory
ecr:DescribeRepositories / ecr:DescribeImages	List ECR repositories and image metadata
cloudwatch:GetMetricData	Read CPU metrics for recommendations
ce:GetCostAndUsage	Optional cost and Savings Plans coverage data
rds:StartDBInstance	Start an instance according to the schedule
rds:StopDBInstance	Stop an instance according to the schedule

When permissions change

Changing a permission module updates the generated policy, not the deployed role. Open CloudFormation again, update the CloudFormation stack in AWS, then run a new sync so SnoozeDB can verify and use the added access.

No data access

These actions operate on the AWS control plane. They do not allow SnoozeDB to connect to a database, read its contents, delete resources, or buy Reserved Instances or Savings Plans.

Security guarantees

No AWS access keys are stored or transmitted
Access is temporary and expires automatically
The IAM role is protected against unauthorized third-party access
You can revoke access at any time by deleting the role in your AWS console

Connection troubleshooting

If verification or synchronization fails, check the connection from AWS outward before recreating it.

Confirm that the CloudFormation stack finished successfully and that its IAM role still exists.
Compare the AWS account ID, role ARN, and External ID with the values shown by SnoozeDB.
If a module was enabled later, confirm that the deployed stack contains its new IAM actions.
Review the latest sync status and error before starting another sync.

Understand the mechanism in detail

To learn exactly how AWS STS AssumeRole works, why we use an External ID, and what happens technically during each operation, read our dedicated article. STS AssumeRole explained step by step →