Skip to the page
CloudArqStart free

There's a 12-digit AWS account in my trust policy. Whose is it?

Check the number against the vendor's own documentation, check for an external ID, and check what the role allows; a number that no vendor page names is the one to chase.

You are reading an IAM role's trust policy and you find a line like arn:aws:iam::<12 digits>:root. It is not one of your accounts. Who is it?

Most of the time it is a vendor's integration account: a monitoring, compliance or data tool that you asked to read something. Sometimes it is not. Here is how to tell.

Three checks

1. The vendor's own documentation. Search for the number. If the vendor's own docs page, or a file in the vendor's own repository, names that account, it is very likely that vendor's. A blog post, a forum answer or a community list is a lead, not proof.

We checked 201 account numbers that vendors are said to use, most of them from a community list of known AWS accounts. Only 108 were confirmed on a vendor's own page or a vendor-owned repository. Of the 166 that the community list names, 91 were not. Community lists alone are not enough.

2. The external ID. A vendor that has many customers should give you a value that only you and they know, and the trust policy should require it. Our research shows the pattern. New Relic's external ID is the customer's own New Relic account ID. Sumo Logic's is SumoDeployment:SumoAccountId. Alert Logic's is the Alert Logic customer ID. Hightouch's is optional in its trust policy, and Honeycomb's page has no external ID condition at all. If the trust policy has no condition on the account you found, ask why.

3. What the role allows. The documentation should say what the vendor needs. Drata's entry, for example, is a cross-account read-only role. Compare the permissions on your role with that. A monitoring tool with write access to your storage is a question for the vendor.

Some well-known vendors

Each entry below is as we found it on 19 October 2026: the account ID and the page the vendor published.

  • Datadog, AWS integration: 464622532012. Source: Datadog's CloudFormation template. Our research notes that Datadog's docs pages hide the ID behind a site selector, so no docs line states it.
  • New Relic, AWS polling integrations: 754728514883. Source: New Relic docs.
  • Sumo Logic, hosted collector sources: 926226587429. Source: Sumo Logic docs.
  • Drata, Autopilot: 269135526815. Source: Drata's Terraform module.
  • Fivetran, external logs to CloudWatch: 834469178297. Source: Fivetran docs.
  • env zero, cost monitoring: 913128560467. Source: env zero docs.
  • Spacelift, AWS cloud integration: 324880187172 for spacelift.io. Source: Spacelift docs.

Some vendors have more than one account. Spacelift gives one account for spacelift.io and another for us.spacelift.io, and Vanta's page gives three accounts. Match the account to the product, region and instance you actually use.

What this does not tell you

Pages go stale. Most pages show no date; where a page shows no date, we give the day we read it, 19 October 2026. Some vendors publish no fixed account at all because the ID is per customer or shown only in a console. Our research also found pages that the community list cites that now return 404.

If a number is on none of these pages, that does not make it hostile. It means you have to ask.

What to do

  1. Search for the account ID together with the word "AWS" and the names of tools you use.
  2. Open the vendor's own page, not a copy. Check the number matches digit for digit.
  3. Confirm the trust policy has an external ID condition and that the value is yours.
  4. Read the permissions on the role and compare them with what the vendor says it needs.
  5. If you cannot find an owner, check CloudTrail for who assumed the role, and ask your team before you remove it.

CloudArq reads the trust policies that let pipelines, partner accounts and sign-ins into your cloud without a password, and tells you in one sentence who each one actually lets in.

Sources