Docs · Your AWS

Leaving CloudGrant

The order to end access, disconnect, delete the stacks in your AWS and delete your workspace - and what stays behind.

Leaving is four steps, in this order. CloudGrant's roles cannot delete anything in CloudFormation on purpose (see what the roles can do), so the stacks in your AWS are yours to remove, and the console tells you which ones.

1. End any access that is still live #

Open Audit, then Live access. Anything listed there is access CloudGrant handed out that has not expired. End it, or wait for it to expire. CloudGrant refuses to disconnect while any grant is live, because once it has forgotten the connection it cannot take that access away.

2. Disconnect #

Open AWS, then Connect AWS. Identity Center has a Disconnect button; each direct-access account has its own. You type the account id to confirm. CloudGrant forgets the roles, the external ID and its map of your organization, records the disconnect in the audit log, and stops assuming the roles from that moment.

Rules that pointed at those accounts stay, but grant nothing until you reconnect.

3. Delete the stacks in your AWS #

Nothing in your AWS changes when you disconnect. Delete what you deployed, in your management account:

  • The cloudgrant-access stack.
  • The cloudgrant-member-reader StackSet, if you deployed it: delete its stack instances first, then the StackSet.
  • Each cloudgrant-broker-role stack, in the account it was deployed to.

From the AWS CLI, with your own credentials:

aws cloudformation delete-stack --stack-name cloudgrant-access
aws cloudformation delete-stack-instances --stack-set-name cloudgrant-member-reader --deployment-targets OrganizationalUnitIds=<your OU ids> --regions <region> --no-retain-stacks
aws cloudformation delete-stack-set --stack-set-name cloudgrant-member-reader

Deleting a stack before you disconnect is not harmful. The connection shows an error until you disconnect, and nothing else happens.

4. Delete the workspace #

Open your Account page from the avatar menu. Delete this workspace erases everything CloudGrant holds for you: members, rules, connections, requests, grants and the audit trail. It refuses while other members are still in, invites are open, a grant is live, or a subscription is active - each is a one-line fix on the page it names.

If you want to keep the audit trail, download the CSV or the evidence pack first. After deletion there is nothing to recover.

What CloudGrant keeps after you leave #

Nothing about your AWS. Billing records stay with Paddle, our merchant of record, for as long as tax law requires. Our privacy policy has the details.