Connect your AWS organization
Grant read-only access so ShellShift can scan your source environment and plan the migration.
3 steps · ~5 minutes
ShellShift only requires read-only IAM permissions. No write access is needed to scan your source environment.
1
Create an IAM role in your AWS account
Go to IAM → Roles → Create role. Select "Another AWS account" and enter the ShellShift account ID below.
Account ID: 027087672282
2
Attach the read-only policy
Attach the following managed policies to the role. This covers Lambda, SQS, DynamoDB, ECS, and S3 read access.
ReadOnlyAccess
AmazonDynamoDBReadOnlyAccess
AWSLambdaReadOnlyAccess
AmazonDynamoDBReadOnlyAccess
AWSLambdaReadOnlyAccess
3
Paste your Role ARN
Copy the Role ARN from the IAM console and paste it here. ShellShift will validate the format now and attempt technical verification during the inventory scan.
What we scan
Lambda Functions
SQS Queues
DynamoDB Tables
ECS Clusters & Services
IAM Role dependencies
EC2 / VPC (coming soon)
RDS (coming soon)
Security
ShellShift never stores your AWS credentials. The IAM role uses cross-account trust — revocable at any time from your AWS console. All scan data is encrypted in transit.