--- title: "Add an AWS node" description: "Add an AWS service or instance for agentless scanning." product: "Guardian" edition: "Classic" type: "workflow" url: "https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/add-a-single-node/agentless/amazon-web-services-aws-node/" --- # Add an AWS node Add an AWS service or instance for agentless scanning. Guardian supports two types of AWS nodes for Agentless scanning: service and instances. To access information about the supported services that have been tested by object and node type, see [Supported AWS Services](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/supported-cloud-services/supported-aws-services/index.md). Applies to: `Guardian Classic` !!! note Additionally, you can import AWS nodes in bulk rather than individually, as the below process describes. For more information, see [Add Nodes in Bulk via AWS](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/add-nodes-in-bulk/aws-nodes/index.md). ## AWS node types Guardian supports two main types of AWS nodes: - **Service** – Service nodes provide high-level information and basic configuration data about all your EC2 assets, within one scan. For example, the scan results of an AWS EC2 service node returns a list of all the EC2 instances, as well as a list of other EC2-related assets, such as load balancers and security groups. - **Instance** – Instance nodes provide more details on specific EC2 instances, such as buckets, load balancers, and services. For example, the scan results of an AWS EC2 Instance node returns more in-depth configuration information, particularly around linked assets. The method of adding both AWS nodes is the same, but the output varies according to the individual node type. ## Dependencies To add an AWS node, the following dependencies must be met: - **Linux Connection Manager** – Set up in Guardian. For more information, see [Linux Connection Manager](https://docs.cloudhouse.com/guardian/classic/inventory/connection-managers/connection-managers/linux/linux-connection-manager/index.md). - **AWS Scan User Account** – Set up with the permissions required for scanning. For more information, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md). - **Service Permissions** – Permissions set for the service intended to be scanned. This is only required for adding a service node type. For more information, see [Supported AWS Services](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/supported-cloud-services/supported-aws-services/index.md). ## Add an AWS node Adding an AWS node to your Guardian instance lets you monitor and track the configuration of an AWS resource. !!! note This process describes how to add AWS service and instance node types. The steps required and fields displayed are the same, except for the **[Node Type] Name** field. This field label changes depending on the node type you select. To add an AWS node for Agentless scanning, complete the following steps: 1. In the Guardian web application, navigate to the **Add Nodes** tab (**Inventory** > **Add Nodes**). The **Add Nodes** page is displayed. ![Add nodes tab](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/add-nodes/single-nodes/add-nodes-tab.png) 2. Type 'AWS' in the search bar. 3. Select the 'AWS' node type you want to add and click the **Go Agentless** button to proceed. The **Connect Agentlessly to [Node Type]** page is displayed. ![Go agentless aws](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/add-nodes/single-nodes/go-agentless-aws.png) 4. Here, complete the following options: ![Connect agentlessly aws](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/add-nodes/single-nodes/connect-agentlessly-aws.png) **Connection Manager group** drop-down list : The Connection Manager group that is responsible for scanning your AWS node. Select a Connection Manager group from the drop-down list. **[Node Type] Name** field : The name of the node. The value you enter here will be used as the display name in Guardian. !!! note The name of this field changes depending on the node type you selected. For example, for an 'AWS S3 Bucket' node, this field is labeled 'S3 Bucket Name'. **IAM [Node Type] ID** field : The unique identifier of the IAM node type you selected (role, policy, user, or group). The value you enter here will be used to identify and display the node in Guardian. The name of this field changes depending on the node type you select. For example, for an 'AWS IAM Role' node, this field is labeled 'IAM Role ID'. !!! warning This option is only available if you selected the 'AWS IAM Role, Policy, User, or Group' type. !!! tip The field was introduced in V5.41.0 of Guardian. For more information, see [March 2025 Monthly Release](https://docs.cloudhouse.com/guardian/classic/what-s-new/2-previous-release/2025/monthly/march-2025/index.md). **AWS region** field : The region your AWS account is using. This is displayed in your AWS Console login URL. For example, 'https://console.aws.amazon.com/console/home?region=**us-west-1**'. **AWS access key** field : The unique identity and access management (**IAM**) account identifier. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md). **AWS secret key** field : The secret access key that is required to sign the request. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md). **AWS IAM role ARN (Optional)** field : The Amazon resource name that specifies the role of the IAM account holder. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md). **HTTP Proxy (Optional)** field : The hostname and port of the HTTP proxy that is used to connect to AWS. For example, 'my.proxy.hostname:8080'. This field is only required if your Connection Manager uses a HTTP proxy to connect to AWS. 5. Once you've completed the above options click **Scan Node** to add the AWS node to your Guardian instance. Now, Guardian performs an initial scan of the node. You can wait on this page for the scan to finish, at which point you will see a **View Scan** button. To view the results of this initial scan, click **View Scan**. However, you can also navigate elsewhere while Guardian performs its initial scan of the node. You can then view the status of the scan on the [**Job History**](https://docs.cloudhouse.com/guardian/classic/control/job-history/job-history/index.md) page (**Inventory** > **Job History**). For more information on what to do next after adding a node, see below. ## Where next - [*Read* **Node Scan Results** What every scan of a node collected.](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/nodes/node-scan-results/index.md) - [*Organise* **Node groups** Group nodes by type, location and more.](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/node-groups/node-groups/index.md) - [*Tune* **Scan options** Choose what each scan collects.](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/scan-options/scan-options/index.md) - [*Compare* **Configuration differencing** Compare nodes, groups and scans.](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/configuration-differencing/configuration-differencing/index.md) - [*Govern* **Policies** Define the configuration you expect.](https://docs.cloudhouse.com/guardian/classic/control/policies/policies/index.md) - [*Connect* **Integrations** Sync nodes and act on events.](https://docs.cloudhouse.com/guardian/classic/control/integrations/integrations/index.md)