# Connect Drata to AWS Generic Connector > Connect Drata's compliance automation platform with AWS to continuously monitor your cloud infrastructure, close control gaps, and stay audit-ready at scale. **Canonical page:** https://tray.ai/connectors/drata-aws-generic-connector-integrations/ **Drata connector:** https://tray.ai/connectors/drata-integrations/ **Drata documentation:** https://tray.ai/documentation/connectors/service/drata **AWS Generic Connector connector:** https://tray.ai/connectors/aws-generic-connector-integrations/ **AWS Generic Connector documentation:** https://tray.ai/documentation/connectors/service/aws-generic-connector ## Overview Drata is a compliance automation platform that helps organizations achieve and maintain certifications like SOC 2, ISO 27001, and HIPAA by continuously monitoring security controls. AWS is the backbone of countless engineering environments — and a surface area that compliance teams have to track constantly. Integrating Drata with AWS through tray.ai gives security and DevOps teams an automated pipeline for surfacing cloud configuration data, mapping it to compliance controls, and triggering remediation workflows without manual overhead. Maintaining compliance across a dynamic AWS environment is a constant challenge. Engineers spin up new resources, modify IAM policies, and adjust security group rules daily — any of which can open a compliance gap. Without tight integration between your cloud infrastructure and your compliance platform, audit prep turns into a fire drill of manual evidence collection, spreadsheet tracking, and reactive fixes. By connecting Drata and AWS through tray.ai, compliance and security teams can automatically surface AWS resource configurations, push evidence directly into Drata controls, trigger alerts when cloud posture drifts out of compliance, and feed remediation tasks back into engineering workflows in real time. The result is a continuous compliance loop that cuts audit fatigue, shortens evidence collection cycles, and gives leadership live visibility into the organization's cloud security posture. ## Use cases ### Automated AWS Evidence Collection for SOC 2 Audits Pulling evidence for SOC 2 audits from AWS environments manually is slow and error-prone. With tray.ai, teams can automatically query AWS services — CloudTrail, Config, IAM, GuardDuty — and push relevant evidence records directly into Drata's control library on a scheduled or event-driven basis. Drata always has current, accurate evidence without requiring engineers to manually export and upload logs. - Eliminates manual evidence collection from AWS consoles and CLI - Keeps Drata control evidence continuously up to date between audit cycles - Reduces the risk of stale or incomplete evidence during audit windows ### Real-Time Cloud Misconfiguration Alerts Synced to Drata When AWS Config or AWS Security Hub detects a configuration drift or policy violation, that finding needs to reach your compliance platform immediately. tray.ai can listen for AWS finding events and automatically create or update corresponding control failures in Drata, flag affected assets, and notify the responsible team — turning reactive detection into a structured compliance response. - Instantly surfaces AWS misconfigurations as Drata control failures - Alerts compliance owners without manual monitoring - Creates a documented audit trail linking cloud findings to control status ### IAM Access Review Automation Periodic IAM access reviews are a mandatory control for SOC 2 and ISO 27001, yet gathering the data from AWS and reconciling it in Drata is often done manually. tray.ai can automate the extraction of IAM user lists, role assignments, and permission boundaries from AWS, format the data to match Drata's evidence requirements, and upload it on a defined review cadence — so access control evidence is always audit-ready. - Automates quarterly or monthly IAM review evidence collection - Keeps role and permission data in Drata in sync with live AWS state - Cuts hours of manual work per review cycle down to minutes ### AWS CloudTrail Log Ingestion and Compliance Mapping CloudTrail logs are a gold-standard source of evidence for change management, access monitoring, and incident response controls. tray.ai can continuously pull CloudTrail event data, filter for compliance-relevant activities, and push summarized evidence records into the appropriate Drata controls — making log-based evidence management fully hands-off. - Continuously ingests and maps CloudTrail events to Drata controls - Filters noise to surface only compliance-relevant activities - Supports change management and privileged access control evidence requirements ### New AWS Resource Discovery and Control Assignment When new EC2 instances, S3 buckets, RDS databases, or Lambda functions are provisioned in AWS, they need to be assessed against compliance controls in Drata. tray.ai can detect new resource creation events via AWS EventBridge or CloudTrail, automatically register those assets in Drata, and trigger workflows to assign ownership and kick off control checks — so no new resource falls through the compliance cracks. - Automatically registers new AWS resources as assets in Drata - Triggers ownership assignment and control evaluation for new resources - Prevents compliance blind spots from untracked cloud infrastructure ### Vulnerability Finding Sync from AWS Inspector to Drata AWS Inspector continuously scans EC2 instances and container images for vulnerabilities, but those findings need to translate into actionable compliance data in Drata. tray.ai can consume AWS Inspector findings, evaluate their severity against your compliance thresholds, and create or update vulnerability management evidence and risk items in Drata automatically. - Bridges AWS Inspector findings directly into Drata's vulnerability control evidence - Prioritizes findings by severity so compliance attention goes where it matters - Maintains a continuous vulnerability management evidence record without manual exports ### Automated Remediation Ticket Creation from Drata Failures When Drata identifies a failing control tied to an AWS resource, the engineering team needs an actionable task to fix it. tray.ai can watch for control failures in Drata, automatically query the affected AWS resource for context, and route a detailed remediation ticket — including resource ARN, failure reason, and remediation guidance — to the engineering workflow tool of choice, then update Drata once remediation is confirmed. - Turns Drata control failures into structured, context-rich remediation tasks - Enriches tickets with live AWS resource data for faster resolution - Closes the loop by updating Drata control status after remediation is complete ## Templates ### Sync AWS IAM Users and Roles to Drata as Access Control Evidence This template runs on a scheduled interval to query AWS IAM for all users, roles, and attached policies, then formats and uploads the results to the corresponding access control evidence section in Drata — eliminating manual IAM review exports. Connectors used: Drata, AWS Generic Connector ### Push AWS Security Hub Findings to Drata Control Failures This template monitors AWS Security Hub for new or updated findings and automatically maps them to the relevant Drata controls, marking them as failing and attaching the finding details as evidence — enabling real-time compliance posture updates. Connectors used: Drata, AWS Generic Connector ### Register New AWS Resources in Drata Automatically This template listens for new resource creation events in AWS via CloudTrail or EventBridge and automatically creates corresponding asset records in Drata, assigns ownership, and queues the asset for control evaluation. Connectors used: Drata, AWS Generic Connector ### Collect AWS CloudTrail Evidence and Upload to Drata This template runs on a nightly schedule to retrieve CloudTrail events related to privileged access, configuration changes, and data access, then summarizes and uploads them to Drata as evidence for change management and audit logging controls. Connectors used: Drata, AWS Generic Connector ### Sync AWS Inspector Vulnerability Findings to Drata Risk Register This template monitors AWS Inspector for new vulnerability findings, evaluates their severity, and creates or updates corresponding risk and vulnerability evidence items in Drata — keeping vulnerability management control evidence current without manual effort. Connectors used: Drata, AWS Generic Connector ### Drata Control Failure to AWS Remediation Enrichment Pipeline This template detects failing controls in Drata that reference AWS resources, automatically enriches the failure with live AWS resource data, and routes a detailed remediation task to the engineering team — then monitors for resolution and updates Drata accordingly. Connectors used: Drata, AWS Generic Connector ## Challenges Tray.ai solves ### Mapping Diverse AWS Resource Types to Drata Controls AWS exposes hundreds of resource types and service APIs, each with its own data schema. Mapping the right fields from EC2, IAM, S3, RDS, CloudTrail, or Security Hub findings to the specific evidence format Drata expects requires significant custom transformation logic — which gets harder to maintain as both AWS APIs and Drata's control library evolve. **How Tray.ai helps:** tray.ai's visual workflow builder includes built-in data transformation tools — JSONPath selectors, custom scripts, and schema mapping steps — that make it straightforward to normalize AWS API responses into the format Drata expects. Workflows are easy to update when APIs change, and reusable transformation components can be shared across multiple AWS-to-Drata pipelines. ### Handling AWS API Rate Limits During Large Evidence Collection Jobs Bulk evidence collection workflows that query IAM, CloudTrail, Config, or Security Hub at scale can quickly hit AWS API rate limits, causing workflows to fail mid-execution and leaving Drata with incomplete or inconsistent evidence. Without throttling and retry logic, these failures are difficult to detect and recover from. **How Tray.ai helps:** tray.ai supports configurable retry logic, exponential backoff, and rate-limit-aware looping natively within workflows. Teams can set per-step retry policies and add pagination handling for large AWS list operations, so even high-volume evidence collection jobs complete reliably without overwhelming AWS API quotas. ### Keeping Up as AWS Environments Scale As AWS accounts grow to include hundreds of resources, multiple regions, and complex multi-account architectures, evidence collection workflows need to dynamically account for new regions, accounts, and resource types without requiring constant manual updates to the integration logic. **How Tray.ai helps:** tray.ai workflows can be parameterized to iterate dynamically over AWS account lists, region sets, and resource type filters pulled from configuration stores or AWS Organizations. As your AWS footprint grows, the same workflow logic scales automatically without bespoke modifications for each new account or region. ### Staying Current Without Over-Polling Compliance teams want Drata to reflect the current state of AWS at all times, but polling AWS APIs continuously at high frequency is expensive, rate-limited, and operationally noisy. Building an event-driven architecture that's both timely and efficient requires careful design — and most teams don't have the tooling to pull it off. **How Tray.ai helps:** tray.ai supports event-driven workflow triggers via webhooks, so integrations with AWS EventBridge can push events to tray.ai the moment a resource changes — no polling required. For cases where event-driven triggers aren't available, tray.ai's scheduler supports high-frequency runs with efficient pagination to minimize unnecessary API calls. ### Securing Credentials and Maintaining Least-Privilege Access Connecting Drata and AWS requires managing sensitive AWS credentials and Drata API tokens securely. Hardcoding credentials in integration scripts or using overly permissive IAM roles creates real security risk — ironically undermining the compliance posture the integration is meant to support. **How Tray.ai helps:** tray.ai stores all credentials in an encrypted secrets-management layer and never exposes them in workflow configurations or logs. Teams can configure dedicated IAM roles with least-privilege policies scoped specifically to the API calls each workflow requires, and tray.ai's audit log provides a full record of all connector authentications and API calls made during workflow execution. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/