Skip to main content
Connect each AWS account with one CloudFormation stack. The stack creates a read-only IAM role that only Runlayer can assume, and Runlayer discovers agents in every Region enabled in the account.

​
What Runlayer reads

The role created by the stack (named RunlayerDiscovery-…) can:
  • list and read Bedrock Agents;
  • list and read Bedrock AgentCore Runtimes, Harnesses, and Gateways with their targets;
  • read SKILL.md files from S3 buckets in the same account, for skills that Harnesses load from S3, so they can be scanned for risk;
  • list the account’s enabled Regions and read its account name.
It has no write permissions. It trusts only Runlayer’s service role, and only with an external ID unique to your connection.

​
Connect an account

1

Start in Runlayer

In AI Inventory, click Sources. Under AWS, click Connect account and enter the 12-digit AWS account ID.
2

Create the stack

Click Open AWS console. Sign in to that account with permission to create IAM roles through CloudFormation. AWS opens a prefilled Quick Create page: check the box acknowledging that the stack creates IAM resources, then click Create stack.The link expires. If it does, click Connect again in Runlayer for a new one.
3

Wait for the first sync

Runlayer shows Waiting for the CloudFormation stack until the role is ready, then starts the first sync on its own.
The stack must be created in the account you entered. A stack created in a different account fails, and Runlayer refuses a role from the wrong account.

​
Common errors

​
Remove the discovery role

Disconnecting in Runlayer deletes the stored role details and stops the sync, but the role stays in your account. To remove it, delete the CloudFormation stack named after the role (RunlayerDiscovery-…) in the AWS console.