The account form dies around account 40

I have watched a platform lead add accounts by hand. Friendly name. Schedule. Who gets the email. Next account. Around the fifteenth one, the tab and the person are both tired. Account 40 sits in a spreadsheet and never gets added.

Then someone asks why the org scan missed a sandbox in ap-southeast-2. It was not a detection gap. Nobody registered the account.

Two different jobs

The role is the part you should still read. CloudFormation, Terraform, or StackSets. You inspect the template. We assume it with an ExternalId that belongs to your org. Nothing in the account changes. A scan does not start until that role exists.

The form is the other job. It only tells us which account to scan, when, and where to send the digest. Clicking it a hundred times does not make the scan more careful. It makes the list incomplete.

What the API is for

On Startup and above, an admin creates a key in Team settings. It expires. You copy the secret once. We store a hash of it, not the secret.

Then a script does what the form did. PUT each 12-digit account id with the name, the schedule, the recipients, the tags. POST when you want a scan now, and poll until that account finishes. Omitted fields stay as they were, so you are not resending the whole config to change a tag.

Individual stays on the dashboard. One account does not need this.

The API does not create the IAM role, and it does not delete a volume. StackSets can land the role across the org. The script lands the registration. Both have to happen, or you get a row in our app and no scan, or a role in AWS that nobody asked us to use.

If you are about to click Add account for the twentieth time, stop and write the loop. Start with one account if you have not seen a scan yet.