InfrastructureService accountVerified September 7, 2026
Lutril inventories IAM users, IAM roles and access keys across every account of your AWS Organization, maps accounts and OUs, and grants just-in-time access through IAM Identity Center account assignments. One IAM user (or role) for Lutril in the management account, plus one read-only role per member account.
Management account: organizations:ListAccounts, DescribeAccount, ListRoots, ListOrganizationalUnitsForParent, ListAccountsForParent, DescribeOrganizationalUnit, DescribeOrganization, account:ListRegions, sts:AssumeRole (scoped to the member role), sts:GetCallerIdentity
Each member account (LutrilRole): iam:GetAccountAuthorizationDetails, iam:GenerateCredentialReport, iam:GetCredentialReport, iam:ListAccessKeys, iam:GetAccessKeyLastUsed
Just-in-time grants (optional): sso:CreateAccountAssignment, sso:DeleteAccountAssignment, sso:DescribeAccountAssignmentCreationStatus, sso:DescribeAccountAssignmentDeletionStatus, sso:ProvisionPermissionSet. Recommended: scope these two writes by Resource to the permission sets and accounts Lutril may grant.
Reversible remediation (optional): iam:UpdateAccessKey and iam:DeleteLoginProfile on the accounts where Lutril may disable an IAM user. Without them the inventory still works and the Disable button reports a permission error.
Reversible remediation only: Lutril never deletes an IAM user or a role. Disable means deactivating access keys and removing the console password; hard deletion stays a human action.
Identity Center account assignments have no native expiry: Lutril removes each just-in-time assignment at its deadline.
Last used values come from the IAM credential report (regenerated at most every 4 hours, first two access keys per user) and from RoleLastUsed for roles; very recent activity can lag.
Setup steps
1
Create an IAM user for Lutril in your management account (no console access) and an access key. Paste the Access Key ID and Secret Access Key in Lutril's AWS connect form. Attach the management policy below to it.
If the Lutril user lives outside the management account, create a LutrilOrgReader role in the management account with this policy instead, trust the Lutril user with the External ID shown in the connect form (Condition StringEquals sts:ExternalId), and set its ARN as Management role ARN in Lutril.
3
Create a read-only LutrilRole in every member account (CloudFormation StackSets deploys it org-wide in one operation). Trust policy: the management account (or the LutrilOrgReader role). Permissions:
These five actions cover users, roles, role last-used, key age and key last-used. Accounts invited into the organization do not carry OrganizationAccountAccessRole automatically: deploy LutrilRole there too, or those accounts appear with a warning and an empty inventory.Open StackSets
4
Optional, for Identity Center inventory and just-in-time grants: attach the Identity Center policy to the Lutril user (or LutrilOrgReader), and set the Identity Center region in the connect form. Lutril grants access by creating an account assignment (user, permission set, account) and removes it at the deadline; assignments have no native expiry in AWS.
The third statement is scoped to the roles Identity Center creates for itself (aws-reserved/sso.amazonaws.com): the first time a permission set reaches an account, AWS provisions that role, and without these actions the first grant on a fresh account fails. Scoping the path is what keeps this from being a general role-creation permission. Tighter still: limit the JustInTimeGrants statement's Resource to the permission set ARNs and account ARNs Lutril may grant, so AdministratorAccess or the management account are excluded outright. Identity Center admin APIs must be called from the management account or a delegated administrator, in the region where Identity Center is enabled.
5
In Lutril, open Settings, then Integrations, then AWS. Paste the access key, set the region, the member role name (default LutrilRole), the Identity Center region if used, and optionally the Management role ARN. The External ID to put in the trust policy is displayed in the form.
Open Non-Human Identities and click Refresh. The sync walks every active account (a few minutes on large organizations) and lists warnings per account it could not reach. Accounts become requestable access levels of the AWS catalogue app for just-in-time grants.
