Before you start.
Four quick checks. The scanner runs as a one-shot Docker container — no agent installed, no persistent access, no changes made.
docker --version. Missing? Install from docs.docker.com.
aws --version. Missing? Follow the AWS install guide.
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_SESSION_TOKEN from environment variables.
Describe*, List*, and Get* actions. Nothing is created, modified, or deleted. Still, we recommend a dedicated role or user with minimal permissions.
Option A
Dedicated IAM role
Recommended
+
1. Create the role
In the AWS Console: IAM → Roles → Create role.- Trusted entity: AWS account (your own account ID)
- Attach the policy at the bottom of this page (or AWS-managed
ReadOnlyAccess) - Name it
CloudHeroScanRole
2. Assume the role & export
Replace YOUR_ACCOUNT_ID with your 12-digit AWS account ID. Credentials expire in 1 hour by default.
Option B
Dedicated IAM user
+
1. Create the user
IAM → Users → Create user.- Name:
cloudhero-scan - Attach the policy below (or
ReadOnlyAccess) - Create an access key, use-case "CLI"
2. Export the credentials
Option C
Use your existing session
+
SSO / Identity Center
Named profile
Default profile
Run the scanner.
Paste this command into the same terminal where you exported your credentials. It pulls the public image, runs a one-shot scan, and uploads the result.
What happens next.
The container does three things, exits, and disappears. No persistent access, no follow-up installs.
Collect.
The scanner lists EC2, RDS, S3, EBS, EKS, ElastiCache, OpenSearch, CloudFront, load balancers — and pulls CloudWatch + Cost Explorer summaries.
Encrypt & upload.
Everything is bundled into a single JSON payload, encrypted on your machine with AES-256-GCM + RSA-OAEP, and pushed over HTTPS to a presigned S3 URL. The container then exits.
Report.
Our analysis engine cross-references your inventory with your billing history. A full cost-savings report lands in your inbox within 24 hours.