Connecting an AWS account takes four steps: create the connection, create a read-only role in AWS, verify it, then scope a diagram.

You need a Teams licence and cloud_connections.manage on the owning organisation or team. Below Teams the action refuses with "Continuum is a Teams-plan feature."

Set the connection scope correctly at the start. Single account and AWS Organization stay changeable only while the connection is a draft, by going Back in the wizard. Once a role has been recorded the choice is fixed: "This connection already has a role, so its scope can't be changed. Create a new connection instead."

Create the connection

Open Settings → Continuum on the organisation or team, select the AWS card, then choose New connection. Enter the 12-digit AWS account number, choose Single account or AWS Organization, pick the region to discover, and give it a display name.

Single account creates one read-only role in one account. AWS Organization creates a management role that enumerates the organisation plus a StackSet member role in every account, including accounts created later.

Create the role in AWS

The connection page shows the stack name, the role name and the external ID. Choose Launch with CloudFormation to open the AWS console with those values filled in. To deploy it yourself instead, open Or do it manually - AWS console or CLI for the same template and parameters.

An AWS Organization connection uses the org StackSet template, launched from the management or delegated-admin account. It needs trusted access between AWS Organizations and CloudFormation StackSets, enabled once per organisation.

Verify

Blueprintr watches the account and picks the role up on its own once the stack finishes. To finish immediately, paste the role ARN into Or paste the role ARN and choose Verify. The header changes to Verified and the page reports that the role assumed and responded.

Scope a diagram

In the blueprint, open the + menu in the tab bar and choose Continuum. Select the connection, name the tab, confirm the account and regions, then choose Create. Narrow it first with Refine VPCs / subnets or a tag filter.

Regions are fixed when you create the connection: one region in single-account mode, a set of regions in AWS Organization mode. There is no region control on the connection afterwards, so covering a new region means a new connection.

What the role can do

The template grants list and describe actions. Nothing in it changes infrastructure, and Continuum never writes to your cloud account. The external ID stops another Blueprintr tenant assuming your role, so do not omit it. On the current template it is filled in for you.

Reading Terraform state is not included. Adding a state backend to this connection also needs s3:GetObject on the state object added to the role policy.

If a sync will not start

An AWS Organization connection needs the org StackSet role. Pointing one at a single-account role fails to load the account list, because the single-account template grants no organizations: permissions. Create a Single account connection instead, or deploy the StackSet.

A finished sync reports what it could not read, under Adapter errors. Read that list before concluding a resource was decommissioned.

Reaching the connection cap refuses with "Connection cap reached (3 per org)", or "(3 per team)". Blueprintr first reclaims your own drafts that have sat untouched for a day with no credential and nothing referencing them; drafts from the last 24 hours, and anyone else's, are left alone.

Scopes and syncing covers what a diagram covers and how to keep it current.

What the role can do

If a sync will not start

Next