Skip to main content
Cloud Connect lets Hilt discover every EC2 instance across your accounts, install the Linux agent with one click (SSM) or a copy-paste command, and quarantine a host by swapping its security groups. Hilt never gets standing access: you create least-privilege IAM roles in your own accounts, Hilt assumes them on demand, and deleting the roles revokes everything.

Connect your whole organization — one deployment

  1. In the Hilt dashboard, open Settings → Integrations → AWS accounts, expand Have a lot of accounts?, and click Create the role org-wide in AWS. It opens a CloudFormation quick-create screen in your management account with everything pre-filled except one field — your organization root ID:
    The stack creates the org-read role, a Hilt role in the management account, and a service-managed StackSet that creates the Hilt role in every current and future member account automatically. (First-time orgs: the console will prompt to enable StackSets trusted access.)
  2. Back in the dashboard, paste your management account ID. Done. Hilt connects it within seconds, discovers the rest of your organization from it, registers every account, and flips each to Connected as the rollout reaches it. New AWS accounts join with no action at all.
Every EC2 in a connected account appears on Collectors → Cloud automatically — named or not, present or launched later.
Quarantine works by replacing a host’s security groups with a deny-all group. It blocks new connections; established flows persist until they age out. It contains a host — it is not an instant kill of live traffic.

Single accounts (no organization)

Use Single accounts on the same page: a per-account quick-create link creates the role in one account; add it by ID or role ARN. Connection tests run automatically when you add accounts.

What the role can and cannot do

Can: read EC2 inventory; create and manage only security groups tagged hilt:quarantine=true; swap an instance’s ENI groups; run the agent installer via the AWS-owned AWS-RunShellScript SSM document; read your organization’s account list (org role only). Cannot: touch IAM, open SSM sessions, stop or terminate instances, or modify any security group you own. Every action lands in your CloudTrail attributed to the acting Hilt user.
Last modified on October 8, 2026