Hey everyone. I'm starting to use Wiz at my new job and I'm really trying to think about cloud security the right way. One thing my senior engineer mentioned is that we should "trust, but verify" even our security tools.
So, Wiz needs a ton of permissions to scan everything. But how do you actually audit what it's doing? Like, where does *it* live and what can *it* access? I want to make sure its own footprint is clean.
I'm trying to do this in Terraform since that's what we use. I know Wiz has a CloudFormation template for setup, but I need to see the actual IAM roles and resources. How do you guys review this?
For example, I found the IAM role it creates. Do you just periodically run something like this to see what it's attached to?
```hcl
data "aws_iam_role" "wiz_connector_role" {
name = "WizConnectorRole"
}
output "wiz_role_policies" {
value = data.aws_iam_role.wiz_connector_role.assume_role_policy
}
```
Is checking the trust policy and the managed policies enough? Or do you also track the API calls it makes with CloudTrail? Any gotchas you've found?