> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM accounts

> Give people temporary access to AWS through an IAM role.

An AWS IAM account lets people work in AWS as an IAM role without holding long-lived access keys. When someone launches a session, Infisical assumes the role through AWS STS and gives them temporary credentials. They can open the AWS Management Console in the browser or use the credentials with the AWS CLI.

AWS IAM accounts don't use a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), because Infisical calls AWS STS directly.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* Permission to create IAM roles in the AWS account
* Your Infisical organization ID, which you can copy from **Organization ID** in your organization's settings

## Create an IAM role

Each account assumes one IAM role. The role's trust policy lets Infisical assume the role only when Infisical sends your organization ID as the [external ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html), so no other Infisical customer can get Infisical to assume it.

**Step 1**

In AWS, create an IAM role, such as `infisical-pam-readonly`, with the following trust policy:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<infisical-aws-account-id>:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "<your-infisical-organization-id>"
      }
    }
  }]
}
```

Replace `<infisical-aws-account-id>` with the AWS account that Infisical runs in:

| Infisical instance | AWS account ID |
| - | - |
| Infisical Cloud (US) | `381492033652` |
| Infisical Cloud (EU) | `345594589636` |
| Dedicated instance | Ask Infisical support for your instance's account ID |
| Self-hosted | The AWS account your Infisical instance runs in |

**Step 2**

Attach permission policies to the role. People who access the account get exactly these permissions in AWS.

**Step 3**

Set the role's **Maximum session duration** to cover the longest session you'll allow, as described in [Session duration](#session-duration).

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and an AWS IAM **Account Template**, such as the default `aws-iam` [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md), then select **Next**.

**Step 3**

Enter a **Name** for the account and the **Role ARN** of the role you created, such as `arn:aws:iam::123456789012:role/infisical-pam-readonly`.

**Step 4**

Select **Create**.

To offer the same role in more than one folder, create an account with the same **Role ARN** in each folder.

## Session duration

A session lasts for the template's maximum session duration, unless the person requests a shorter one. AWS rejects a session that's shorter than 15 minutes or longer than the role's maximum session duration, so make sure both limits allow the sessions you expect.

> [!WARNING]
>
> You can't end an AWS Management Console session early. Terminating the session in Infisical doesn't sign the person out of the console, which stays signed in until the session expires. To cut off access sooner, [revoke the role's active sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html) in AWS.

## Connect

To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). In the browser, the session opens the AWS Management Console, signed in as the role.

The CLI writes temporary credentials to `~/.aws/credentials` as a profile named `infisical-pam/<folder>/<account>`:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

Pass the profile to the AWS CLI, or set `AWS_PROFILE` to use it for every command:

```bash theme={"dark"}
export AWS_PROFILE="infisical-pam/<folder>/<account>"
aws sts get-caller-identity
```

Press `Ctrl+C` to end the session. The CLI then removes the profile.

## Track activity in AWS

Infisical names each STS session after the email of the person who launched it, or after the name of the [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md). In [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html), the session name shows who made each call.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.