Connect AWS to SubImage

What this does

Deploys a read-only IAM role named SubImageScanRole in one or more AWS accounts so SubImage can assume it and inventory the account. Walks the user through three paths and asks for the values it needs before running anything.

When to use

✅ User wants to onboard an AWS account, an Organization, or the management account into SubImage. ✅ User asks for the IAM role definition, StackSet template, or Terraform for SubImage scanning. ✅ User is in their IaC repo and wants to commit the setup as code.

❌ User wants to scan EKS clusters but already has the AWS module connected: use subimage-setup:connect-kubernetes-outpost (and the EKS RBAC steps reachable from there) instead. ❌ User wants to remove an account: this skill only adds; deletion goes through their CloudFormation/Terraform tooling.

Required inputs

Before generating any commands or HCL, collect these values. If any are missing, ask the user explicitly. Do not invent, guess, or paste a literal placeholder string into a command.