---
title: "AWS Resource Discovery Tool"
slug: "red-canary-aws-resource-discovery-tool"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/red-canary-aws-resource-discovery-tool"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Resource Discovery Tool

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

Our resource discovery tool scans your Amazon Web Services (AWS) environment (organization or account) to determine how many resources your company is using on AWS. This tool is intended to help all stakeholders understand the resources that Zscaler MDR will monitor and protect in your AWS environment.

This page describes how to:

- Create Zscaler MDR resource discovery roles within your account or organization (and sub-accounts) via AWS CloudFormation
- Run the resource discovery tool
- Delete the resource discovery user and roles

## Setup

You can get the resource discovery tool as a pre-built binary from the Zscaler MDR S3 bucket. Click [here](https://rc-customer-tools.s3.us-east-2.amazonaws.com/aws/enumerate-resources) to initiate a download.

If you prefer to compile a local version, the source code is available from the Zscaler MDR Github repository [here](https://github.com/redcanaryco/red-canary-aws-resource-discovery).

## Prerequisites

- Administrative rights in AWS
- [Red-canary-resource-discovery-role.yaml](https://github.com/redcanaryco/red-canary-aws-resource-discovery/blob/main/red-canary-resource-discovery-role.yaml) CloudFormation template
- Set up a Discovery Role in the Primary Account
  - See [Prerequisite Steps](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisite-steps) for instructions
- Set up a Discovery Role in Sub Accounts (if using Organization)
  - See [Prerequisite Steps](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisite-steps) for instructions

If you’d like to scan a different account, you can specify the profile name via the `AWS_PROFILE` environment variable.

## Usage

Official support for this script is limited to running from AWS CloudShell using either the prebuilt binary or a locally compiled version of this code.

### **Prerequisite Steps:**

1. Open AWS CloudShell and run the following command to retrieve the ARN of your logged-in account:

```Custom
$ aws sts get-caller-identity
{
  "UserId": "ABC1234:first.last@email.com",
  "Account": "12345677898",
  "Arn": "arn:aws:sts::12345687:assumed-role/AWSReservedSSO_Admin/first.last@email.com"
}
```

**Note:** You can also find the ARN in the Identity and Access Management service section of the AWS console.

****Set up a Discovery Role in the Primary Account****

To scan your account (or your primary account if you’re using Organization), you’ll need to create a role with resource discovery permissions in your environment. This role will be configured with a trust boundary to allow the scanning process to assume it.

1. From the search bar in the AWS Console, type and select **CloudFormation**:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/CloudFormationAWSSelect-AWSResourceDiscoTool.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
2. Click **Create Stack**:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/CreateStack.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
3. Click **With new resources (standard)**:

![AWSResourceDisco-CFWithNewResourcesSS](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDisco-CFWithNewResourcesSS.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
4. From the Prerequisite section, select **Template is ready**.
5. From the Specify template section, select **Upload a template file**.
6. Click Choose file:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step7-AWSResourceDiscoTool.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
7. Select the `red-canary-resource-discovery-role.yaml` you downloaded as a [prerequisite](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisites).
8. Click Next.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step9-AWSResourceDiscoToolPreReq.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
9. For the Stack name, enter `RedCanaryResourceDiscoveryRoleName`.

**Note:** We suggest leaving it as the default `red-canary-resource-discovery-role`.
10. Enter the **ManagementAccountUserRole** **ARN** of the user account logged-in to as found in [Prerequisites Step 1](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisites)..
11. Click **Next**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step12-AWSResourceDiscoToolPreReq.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
12. Click **Next**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step13-AWSResourceDiscoToolPreReq.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
13. Scroll to the bottom of the Review page.
14. Select the agreement.
15. Click Submit.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolStep16PreReq.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)

****Set up a Discovery Role in Sub Accounts (if using Organization)****

If your company uses AWS Organizations, you’ll need to deploy a stackset to build the Zscaler MDR Resource Discovery role in each sub-account.

1. From the search bar, type and then select **CloudFormation**.

![CloudFormationAWSSelect-AWSResourceDiscoTool](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/CloudFormationAWSSelect-AWSResourceDiscoTool.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
2. From the navigation menu, select **StackSets**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSStep2PreReq-ResourceDiscoSubAccounts.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
3. Click **Create StackSet**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step3AWSResourceDiscoPreReqCreateStackset.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
4. From the Permissions section, select **Service Managed Permissions**.
5. From the Prerequisites section, select **Template is ready**.
6. From the Specify Template section, select **Upload a template file**.
7. Click **Choose file**.
8. Select the `red-canary-resource-discovery-role.yaml` you downloaded as part of the [prerequisites](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisites).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolPreReq-Step8SubAccounts.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
9. Click **Next**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Step9-AWSResourceDiscoTool-PreReqSubAccounts.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
10. Enter the stack name. For the stack name, enter `RedCanaryResourceDiscoveryRoleName`.

**Note:** We suggest leaving the name as the default `red-canary-resource-discovery-role`. If you changed the name in the Setup Discovery Role in the Primary Account step, you must use the same name in this step.
11. Enter the **ManagementAccountUserRole ARN** of the user account logged-in to as found in [Prerequisites Step 1](/doc/docs/red-canary-aws-resource-discovery-tool#prerequisites).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolSubAccountsStep11.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
12. Click **Next**.
13. In the **Configure StackSet Options** section, leave the selected default options.
14. Click **Next**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolPreReqSubAccountsStep14.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
15. From the **Add stacks to stack set** section, select **Deploy new stacks**.
16. From the **Deployment targets** section, select **Deploy to organization**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolSubAccountsPreReqStep16.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
17. From the **Specify regions** section, select **US East (N. Virginia)**. Since roles are global, only one region is required.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolSubAccountsPreReqStep17.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
18. Click **Next**.
19. Scroll to the bottom of the **Review** page.
20. Select the agreement.
21. Click **Submit**.

### Running the script:

Once you’ve configured the `red-canary-resource-discovery-role`, upload and run the resource discovery tool binary to scan the resources in your AWS account:

1. From the AWS console, navigate into AWS CloudShell
2. Select **Actions**, then click **Upload file**.
3. After a successful upload, enter `chmod +x enumerate-resources` so you can run the binary.
4. If you want to scan the whole organization, run the binary as is: `./enumerate-resources`
5. If you want to scan the whole Organization and display the CloudTrail information for the accounts, run the binary with the AWS_TRAIL flag set to true. By default, it’s set to false:

`./enumerate-resources —-AWS_TRAIL=”true”`
6. If you want to scan the whole organization and exclude certain accounts, run the binary with the **EXCLUDE** flag with one or multiple accounts separated by a comma:

`./enumerate-resources —-AWS_TRAIL=”true” —-EXCLUDE=”123456789”`

`./enumerate-resources —-AWS_TRAIL=”true” —-EXCLUDE=”123456789, 423456789, 523456789”`
7. If you’d like to scan a different account, you can specify the profile name via the **AWS_ACCOUNT_ID** environment variable:

`./enumerate-resources —-AWS_ACCOUNT_ID=”123456789”`

The following flags can be used for each run. Any combination of flags is supported, except for simultaneously specifying a single AWS account (AWS_ACCOUNT_ID) and excluding accounts (EXCLUDE).

```Custom
./enumerate-resources —-AWS_ROLE_ARN=”arn:aws:iam:123456789:role/red-canary-resource-discovery-role” 
—-AWS_ACCOUNT_ID=”123456789” —-AWS_REGION=”us-east-1” —-AWS_ROLE_NAME=”red-canary-resource-discovery-role” 
—-AWS_TRAIL=”true” —-EXCLUDE=”123456789, 5236756789,2344675689,3446756890”
```

The application will display the summarized output in the console and produce a CSV report in the current working directory:

```Custom
$ Red Canary - AWS Resource Discovery Scan Progress: 34 / 34

Scanned 2 AWS accounts.

ResourceType Count
Storage Buckets 10
Container Hosts 35
Databases 9
Non-OS Disks 12
Serverless Containers 25
Serverless Functions 16
Virtual Machines 65
Container Registry Images 13

Scan completed in 45 seconds

$ ls
aws-resource-discovery.csv$ cat aws-resource-discovery.csv

...
123456789,us-east-1,AWS::S3::Bucket,3
123456789,us-east-1,AWS::RDS::DBInstance,0
123456789,us-east-1,AWS::ECS::Cluster,1
123456789,us-east-1,AWS::EKS::Cluster,2
123456789,us-east-1,AWS::ECR::PublicRepository,1
123456789,us-east-1,AWS::EC2::Instance,3
123456789,us-east-1,AWS::ECR::Repository,0
123456789,us-east-1,AWS::EFS::FileSystem,0
123456789,us-east-1,AWS::DynamoDB::Table,0
123456789,us-east-1,AWS::Lambda::Function,0
123456789,us-east-1,AWS::EC2::Volume,3
...
```

## Existing Setup Scan Attempt

If you’ve already granted the discovery tool the necessary permissions (a resource discovery role with trust boundary) on the AWS account, it should function without additional configuration. However, if you're using AWS Organizations or lack the required account permissions this command will fail.

From your AWS CloudShell terminal: copy, paste and run the following command:

```Custom
./enumerate-resources --AWS_ACCOUNT_ID=123456789
```

## Tear Down and Clean Up Your Stackset

Once you’ve completed the resource inventory, you should remove the created role. To efficiently clean up, delete the CloudFormation stacks and StackSets:

- Delete the individual stacks
- Delete the stacks within the StackSet (you cannot delete the StackSet if it’s managing the stacks)
- Delete the StackSet

1. From the search bar, type and then select Navigate to **CloudFormation**.

![CloudFormationAWSSelect-AWSResourceDiscoTool](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/CloudFormationAWSSelect-AWSResourceDiscoTool.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
2. From the left navigation menu, click **Stacks**.
3. Select the Primary Account Role creation stack:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoToolTearDownStep3.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
4. Click **Delete**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep4.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
5. Click **Delete**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep5.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
6. Repeat Steps 1-5 for the Zscaler MDR Resource Discovery User stack.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep6.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
7. Click **Delete**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep7.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
8. Click **StackSets**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep8.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
9. Select the **Resource Discovery Roles** StackSet.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep9.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
10. Click the **Actions** dropdown.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep10.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
11. Select **Delete stacks from StackSet**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep11.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
12. Enter the **Organizational Unit ID** for your root account.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTeardownStep12.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)This can be found in the organization’s service. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep12b1.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
13. Select the region where the StackSet deployed.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep13.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
14. Click **Next**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep14.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
15. On the Review page, click **Submit**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep15.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
16. Once the operation has succeeded, click **StackSets**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep16.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
17. Select the **Resource Discovery Role** StackSet.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep17.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
18. Click the **Actions** dropdown and then click **Delete StackSet.**

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep18.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)
19. Confirm the **Delete** action.

![AWSResourceDiscoTearDownStep19](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTearDownStep19.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)

The stacks for the Resource Discovery User and the Resource Discovery Role on the primary account have now been deleted. Additionally, the Resource Discovery Roles within each sub account, as well as the StackSet that managed them, have been removed.

## Troubleshooting

**The resource discovery returns all 0s in <1 second with 0 accounts scanned:** This generally indicates that AWS CloudShell doesn’t have sufficient permissions to sts:assume the role.

1. Check the `aws-resource-discovery.csv` file:

```Custom
$ cat aws-resource-discovery.csv
"Unable to determine whether the given account belongs to an organization.

To scan an organization, the provided credentials must have the following permissions:
  - organizations:ListAccounts
"
```
2. Navigate into AWS IAM, find the `resource-discovery-user-role`, and click Trust Relationships. Verify the policy allows the calling user to `sts:AssumeRole`:

```Custom
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
       "AWS": 
      arn:aws:sts::12345687:assumed-role/AWSReservedSSO_Admin/first.last@email.com"
      },
     "Action": "sts:AssumeRole"
    }
  ]
}
```

**The resource discovery returns with various errors:**

1. In AWS IAM, navigate into the red-canary-resource-discovery-role.
2. Ensure that the following permissions exist in that role:

```Custom
{
  "Version":  "2012-10-17",
  "Statement":  [
    {
      "Action":  [
        "sts:AssumeRole",
        "organizations:ListAccounts",
        "ec2:DescribeRegions",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketNotification",
        "s3:ListAllMyBuckets",
        "dynamodb:ListTables",
        "dynamodb:ListGlobalTables",
        "ec2:DescribeVolumes",
        "ec2:DescribeInstances",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr-public:DescribeRepositores",
        "ecr-public:DescribeImages",
        "ecs:ListClusters",
        "ecs:ListServices",
        "ecs:DescribeServices",
        "ecs:DescribeTaskDefinition",
        "ecs:DescribeClusters",
        "elasticfilesystem:DescribeFileSystems"
        "eks:ListClusters",
        "lambda:ListFunctions",
        "rds:DescribeDBInstances",
        "cloudformation:ListResources",
        "cloudformation:DescribeStacks",
        "cloudtrail:DescribeTrails"
      ],
      "Resource":  "*",
      "Effect":  "Allow"
    }
  ]
}
```
3. Sometimes the binary upload gets stuck at some percentage without making progress: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSResourceDiscoTroubleshootingStep3.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)

**X** out of the upload.
4. Select **Actions**, then click **Restart**.
5. Switch to the region geographically closest to you and try again.

**Running the binary results in XML header issues:**

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/AWSdiscotooltroubleshootingxml.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A26Z&se=2026-11-09T12%3A54%3A26Z&sr=c&sp=r&sig=itnkrqGd3kQO0mfh66iCJ5bczbSgCUa6RVF1V4M6qXo%3D)

1. Issue the `rm enumerate-resources` command in CloudShell.
2. Switch to the region geographically closest to you and try again.