TrustFix

Getting started

Connect your estate

Read-only, agentless grants for AWS, GitHub, GCP, and Azure — least-privilege by construction, with no agent to install.

TrustFix reads your cloud and source-control estate through least-privilege, read-only connectors. Nothing in this product writes to your infrastructure during connection or scanning — connectors read, attest, and (separately) propose fixes. Any secret a connector must hold (OAuth tokens, PATs) is KMS-sealed at rest, never stored as plaintext. Connect from the catalog at Onboarding (/onboarding); live connection state comes from GET /api/onboarding/status.

Amazon Web Services

AWS connects through a cross-account read-only IAM role assumed with a server-derived External ID. You never type the External ID yourself — that is what prevents another tenant from assuming your role.

  1. Create a read-only IAM role (the recommended CloudFormation template grants only the specific read actions needed and never reads secret, parameter, or object values; the AWS-managed ReadOnlyAccess policy works as a broader fallback). For org-wide coverage, deploy the template as a StackSet at the org root so it fans out to every account.
  2. Enter your 12-digit AWS account ID; the connect page fills a read-only External ID field (GET /api/aws/accounts/external-id).
  3. Copy the External ID into your role's trust policy so sts:AssumeRole is allowed only from the TrustFix principal under a matching sts:ExternalId condition.
  4. Paste the role ARN and submit (POST /api/aws/accounts). TrustFix re-derives the External ID server-side, ignores the client-supplied value, and performs a live sts:AssumeRole test before saving.

GitHub

Connect by installing the TrustFix GitHub App (not a personal token). The app requests read-only metadata and contents — no write, deploy, or admin scopes — and you choose which repositories it sees.

  1. Install the app (/api/github/app/install) and select repositories.
  2. Repos sync automatically; Sync Repos (POST /api/github/sync) re-pulls on demand.
  3. Each repo row shows OIDC and Actions usage, workflow and finding counts, and last-scanned time; Scan Now scans one repo's workflows.

Google Cloud

GCP connects through Workload Identity Federation — no long-lived service-account keys are stored on either side.

  1. Set up an org/folder-level read-only scanner service account (Viewer / Security Reviewer) and a workload-identity provider that trusts TrustFix's scanner identity.
  2. Your setup output prints the workloadIdentityProvider resource path and the scanner service-account email.
  3. Paste both into the connect form and submit (POST /api/gcp/accounts).

Microsoft Azure

Azure connects through a Microsoft Entra ID app registration using Workload Identity Federation — no long-lived client secrets are stored on either side.

  1. Create the app registration with a federated credential trusting TrustFix's OIDC issuer, grant Reader at the root management group, and add Directory.Read.All.
  2. Your setup output prints the app id, federated credential name, and tenant id.
  3. Paste them into the connect form and submit.

A note on Slack

Slack delivers channel-routed notifications for findings, fix PRs, and verdicts. Today, connecting Slack is admin-assisted, not yet self-serve — the in-product page routes you through a "Request Slack setup" contact flow while the self-serve OAuth install is finalized. The integration itself uses Slack's standard OAuth 2.0 flow with KMS-encrypted bot-token storage and signing-secret verification on inbound events; per-channel routing is configured for you. We surface this honestly rather than market a self-serve flow that isn't shipped.

After connecting

AWS and GitHub scans run without any extra infrastructure. GCP, Azure, GitLab, and Bitbucket scans are queued to a background worker, so they progress only when that worker is being driven (a scheduled tick or a dedicated worker container). Once a scan completes, your connector health appears on Integrations (/integrations) and the live activity feed on Discovery (/discovery), both reading GET /api/discovery/overview.

← Platform quick startChoosing your path: sensor or API →