> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS accounts (Cloud Connect)

> Connect your AWS organization so Hilt can inventory EC2 instances, install the Linux agent, and network-quarantine a compromised host.

Cloud Connect lets Hilt **discover** every EC2 instance across your accounts, **install** the Linux agent with one click (SSM) or a copy-paste command, and **quarantine** a host by swapping its security groups. Hilt never gets standing access: you create least-privilege IAM roles in your own accounts, Hilt assumes them on demand, and deleting the roles revokes everything.

## Connect your whole organization — one deployment

1. In the Hilt dashboard, open **Settings → Integrations → AWS accounts**, expand **Have a lot of accounts?**, and click **Create the role org-wide in AWS**. It opens a CloudFormation quick-create screen in your **management account** with everything pre-filled except one field — your organization root ID:
   ```bash theme={null}
   aws organizations list-roots --query Roots[0].Id --output text
   ```
   The stack creates the org-read role, a Hilt role in the management account, and a service-managed StackSet that creates the Hilt role in **every current and future member account** automatically. (First-time orgs: the console will prompt to enable StackSets trusted access.)
2. Back in the dashboard, **paste your management account ID**. Done. Hilt connects it within seconds, discovers the rest of your organization from it, registers every account, and flips each to *Connected* as the rollout reaches it. New AWS accounts join with **no action at all**.

Every EC2 in a connected account appears on **Collectors → Cloud** automatically — named or not, present or launched later.

> [!NOTE]
>
> Quarantine works by replacing a host's security groups with a deny-all group. It blocks **new** connections; established flows persist until they age out. It contains a host — it is not an instant kill of live traffic.

## Single accounts (no organization)

Use **Single accounts** on the same page: a per-account quick-create link creates the role in one account; add it by ID or role ARN. Connection tests run automatically when you add accounts.

## What the role can and cannot do

Can: read EC2 inventory; create and manage **only** security groups tagged `hilt:quarantine=true`; swap an instance's ENI groups; run the agent installer via the AWS-owned `AWS-RunShellScript` SSM document; read your organization's account list (org role only).

Cannot: touch IAM, open SSM sessions, stop or terminate instances, or modify any security group you own. Every action lands in **your** CloudTrail attributed to the acting Hilt user.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.