> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS honey tokens setup

> One-time organization setup for AWS honey tokens.

> [!NOTE]
>
> This setup is performed **once per organization** by an admin. After
> completing these steps, any project member with the appropriate [permissions](https://infisical.com/docs/documentation/platform/honey-tokens/overview#permissions) can [create honey
> tokens](https://infisical.com/docs/documentation/platform/honey-tokens/aws/usage.md) without repeating this
> process.

## Prerequisites

* You must have the organization-level **Honey Tokens → Setup** permission. By default, only organization **Admins** have this permission.

* Create an [AWS App Connection](https://infisical.com/docs/integrations/app-connections/aws.md) at the organization level with the following IAM permissions:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "HoneyTokenIAMManagement",
      "Effect": "Allow",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser",
        "iam:CreateAccessKey",
        "iam:DeleteAccessKey"
      ],
      "Resource": "arn:aws:iam::*:user/inf_ht_*"
    },
    {
      "Sid": "HoneyTokenStackVerification",
      "Effect": "Allow",
      "Action": ["cloudformation:DescribeStacks"],
      "Resource": "*"
    }
  ]
}
```

> [!NOTE]
>
> The IAM permissions are scoped to users prefixed with `inf_ht_`, which is the
> naming convention Infisical uses for honey token IAM users.

## Connect

**1. Open Honey Token settings**

Go to **Organization Settings** → **Product Settings**.

![AWS Honey Tokens section](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/product-settings.png)

**2. Click Connect**

Select **Connect** to open the configuration modal.

![Click Connect](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/connect.png)

**3. Fill required fields and save**

Configure:

* **App Connection** — select your AWS App Connection.
* **Webhook Signing Key** — auto-generated by default; customize it if needed. This key is used to validate webhook calls from AWS.

Optionally expand **Advanced Options**:

* **CloudFormation Stack Name** (default: `infisical-honey-tokens`)
* **AWS Region** (default: `us-east-1`)

Click **Save**.

![Configure and Save](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/connecting.png)

**4. Deploy CloudFormation Stack**

Copy the command shown under **Deploy CloudFormation Stack**.

Run the command in a terminal with AWS credentials that can deploy CloudFormation stacks in your target account and region.

![Deploy CloudFormation Stack Command](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/cloudformation-deploy.png)

> [!NOTE]
>
> If you already deployed the stack and need to apply the latest Infisical CloudFormation template, run:
>
> ```bash theme={"dark"}
> aws cloudformation update-stack \
>   --region '<region>' \
>   --stack-name '<stack-name>' \
>   --template-url 'https://infisical-static-assets.s3.us-east-1.amazonaws.com/honey-tokens/honey-tokens-v1.yaml' \
>   --capabilities CAPABILITY_NAMED_IAM \
>   --parameters \
>     ParameterKey=WebhookUrl,UsePreviousValue=true \
>     ParameterKey=WebhookSigningKey,UsePreviousValue=true
> ```
>
> Replace `--region` and `--stack-name` with the values saved in Infisical if you customized them. `UsePreviousValue=true` keeps your existing webhook settings so only the template is updated.

**5. Verify deployment**

After the CloudFormation stack finishes deploying, select **Verify connection** in the **AWS Honey Tokens** section.

![Click Verify connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/verify-connection-click.png)

Once verification succeeds, confirm the status badge is updated to **Verified**.

![Verified status badge](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/honey-tokens/verify-connection-verified-badge.png)

## Manage

After setup is saved, the **Connect** button changes to **Manage**.

Use **Manage** any time you need to update:

* AWS App Connection
* Webhook signing key
* CloudFormation stack name
* AWS region

In the modal, you can also copy the pre-filled AWS CLI command under **Deploy CloudFormation Stack** and run it to deploy the stack.

You can also verify directly in AWS CLI:

```bash theme={"dark"}
aws cloudformation describe-stacks \
  --stack-name infisical-honey-tokens \
  --query "Stacks[0].StackStatus"
```

You can only [create honey tokens](https://infisical.com/docs/documentation/platform/honey-tokens/aws/usage.md) after the stack status is **Verified**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.