Connect Wasteless to AWS read-only

Before you start

• Git and Docker

• Python 3.11 or newer

• An AWS identity allowed to assume the created role

• Permission to deploy IAM roles in the target account

1. Install Wasteless

git clone https://github.com/wasteless-io/wasteless.git
cd wasteless
./install.sh

On a compatible Linux host, ./install.sh --install-system-deps can install system dependencies. Docker Desktop remains an external prerequisite on macOS and WSL2.

2. Create the AWS roles

Use either onboarding/cloudformation/wasteless-onboarding.yaml or the module in onboarding/terraform/. Disable remediation-role creation for a read-only evaluation.

3. Start and test the connection

wasteless

Open http://localhost:8888/setup, enter AWS_ROLE_ARN, an optional ExternalId and only when needed AWS_WRITE_ROLE_ARN. Select Test connection, then Test & save.

4. Add Steampipe for full detector coverage

Load balancer, NAT Gateway, empty VPC and gp2 to gp3 detectors require Steampipe and its AWS plugin.

brew install turbot/tap/steampipe
steampipe plugin install aws

connection "aws" {
  plugin   = "aws"
  role_arn = "arn:aws:iam::123456789012:role/wasteless-readonly"
  regions  = ["eu-west-1"]
}

5. Run the first collection

wasteless collect
wasteless status

• The connection uses the AWS read-only role
• A complete or partial run appears in history
• Available inventory and recommendations are visible
• No write access was needed for detection

Run time depends on the number of resources, AWS API calls and Steampipe availability.

If the outcome is not what you expected